"Bad owner or permissions" error using Cygwin's ssh.exe

Question

I'm trying to use ssh.exe in Cygwin (in Windows 7). I copied a config file into c:\cygwin\home\[USERNAME]\.ssh. When I run ssh (for example, ssh -vT [e-mail]) I get the following error:

OpenSSH_5.9p1, OpenSSL 0.9.8r 8 Feb 2011 Bad owner or permissions on /home/[USERNAME]/.ssh/config

How do I get ssh to read my configuration file?

Answer 1

Check the permissions of the config file using Cygwin's ls command:

> c:\cygwin\bin\ls.exe -la c:\cygwin\home\[USERNAME]\.ssh

It will probably be something like this:

total 5
drwxrwxrwt+ 1 Administrators None  0 Oct 20 17:02 .
drwxr-xr-x+ 1 [USERNAME]     None  0 Oct 19 08:15 ..
-rw-------  1 Administrators None 57 Oct 20 16:58 config

The config file needs to belong to [USERNAME]. Try this:

> c:\cygwin\bin\chown.exe [USERNAME] c:\cygwin\home\[USERNAME]\.ssh\config

ls -la should now show the correct owner. If that still doesn't work, try resetting the mode (permissions):

> c:\cygwin\bin\chmod.exe 700 c:\cygwin\home\[USERNAME]\.ssh\config

Answer 2

After doing as above, I always got this:

total 22
drwxrwxr-x+ 1 jl None    0 Sep  9 18:44 .
drwxrwxr-x+ 1 jl None    0 Sep  9 18:44 ..
-rw-rw----  1 jl None  129 Jul  1 14:30 config

and the error on .ssh/config. So I've run chown on the .ssh folder, and chmod again like this:

> chown -R [USERNAME]:users .ssh/

and then:

> chmod -R 600 .ssh/

and finally I got it working:

total 29
drwxrwxr-x+ 1 jl None     0 Sep  9 18:44 .
drwxrwxrwt+ 1 jl None     0 Sep  9 18:44 ..
drw-------+ 1 jl Users    0 Sep  9 18:44 .ssh

Edit(for bash on Windows10)

When you get the error..

Failed to add the host to the list of known hosts (/PATH_TO_HOME/USERNAME/.ssh/known_hosts).

Make sure that known_hosts is writable

$ chmod 755 known_hosts

Note: I believe you only need to set 600 for your private key

Then, try to ssh.

When you get..

Permanently added 'HOST_IP' (RSA) to the list of known hosts.

You may replace mode 600

$ chmod 600 known_hosts

P.S.: I think this is a bug on Windows 8.

Answer 3

This answer is copied verbatim from https://superuser.com/a/875934/82032. This is the only answer that worked for me after a recent cygwin upgrade.

Don't forget the ACLs

Nothing worked for me until I stripped the file of ACLs and reset the permissions.

#remove ACLs
setfacl -b ~/.ssh/config

#reset permissions
chmod 0600 ~/.ssh/config

You can use getfacl to view the current ACL on a file.

getfacl ~/.ssh/config

Before I removed the ACLs (Broken):

# owner: Administrators
# group: None
user::rw-
group::---
group:Authenticated Users:rwx
group:SYSTEM:rwx
mask:rwx
other:---

After: (working)

# file: config
# owner: myusername
# group: None
user::rw-
group::---
other:---

Answer 4

For unix & OSX

Quite simply:

chown -R $USER:users ~/.ssh/
chmod -R 600 ~/.ssh/

For Windows

If the file is a windows (NTFS) symbolic link, the above won't work. You need to make it a regular file. I am not sure why.

If you don't have openssh or cygwin, use chocolatey to install it easily.

choco install cyg-get

Open Cygwin Terminal that was installed with chocolatey and run (note that ssh-keygen creates new keys):

cyg-get install openssh
ssh-keygen
cd ~/.ssh && explorer.exe .

Verify keys are there (or replace them with the keys you want), and then in Cygwin shell:

chown -R $USER:users ~/.ssh/
chmod -R 600 ~/.ssh/

Or for the rare case that you're using (and generated the keys from) chocolatey's SSH package:

chown -R $USER:users  /cygdrive/c/Users/$USER/.ssh
chmod -R 600 /cygdrive/c/Users/$USER/.ssh

Answer 5

Important note if your Windows is not in US English: the "users" group's name is locale-dependant. For example, if your Windows is in Spanish, you'll have to change the files' ownership with chown $USER:Usuarios *

Answer 6

None of these (chmod/chown/icacls/setacl/copyacls/explorer>security) worked on my cygwin64/win7/admin, finally this works with cygwin64/ssh -F ~/.ssh/config other solutions are to use older ssh in cygwin32 or ssh in git for windows..

Answer 7

For those who uses noacl in path with ~/.ssh dir simple solution is to create native NTFS symbolic link:

cmd# mklink c:\home\.ssh c:\opt\cygwin\home\misc\.ssh
symbolic link created for c:\home\.ssh <<===>> c:\opt\cygwin\home\misc\.ssh

With noacl there is no way to set permissions other then rwxr-xr-x or rw-r--r--. As / hierarchy should be without noacl (or should be with acl) you can create directory here and point to it problematic places for Cygwin's apps.

Answer 8

tldr: You may have created the config as adminstrator

Solution

These solutions may be overkill if you ended up mistakenly creating the file as admin, and trying to use the file with local perms.

• Copy the contents of your ssh config
• Delete the file
• Open a new shell (local - non admin)
• Navigate to the path where your config is stored (usually ~/.ssh in PowerShell or %userprofile%\.ssh in cmd)
• Run notepad .\config

---

Simple commands (PowerShell):

$sshPath = '~/.ssh/config'
$content = cat $sshPath
# In case the line above fails, this check will prevent your current config to get deleted
if ($content) {
  rm $sshPath
  $content | Out-File -en ascii $sshPath
}