chmod Cheat Sheet — SSH Key Permissions (600, 644) — desktop.engineer

Correct chmod for SSH keys: chmod 600 ~/.ssh/authorized_keys, chmod 644 ~/.ssh/known_hosts, chmod 600 ~/.ssh/config and more.

SSH key permissions: chmod for SSH keys

SSH is strict about file permissions: any key or authorized_keys file readable by other users is rejected for security reasons. This chmod cheat sheet lists the exact permissions required for SSH keys, ~/.ssh/authorized_keys, ~/.ssh/config and ~/.ssh/known_hosts.

chmod 600 ~/.ssh/authorized_keys — the authorized_keys file must be readable and writable only by its owner, otherwise SSH refuses key-based login.
chmod 600 ~/.ssh/id_ed25519 (also id_rsa, id_ecdsa) — private keys must not be accessible by other users; SSH rejects them otherwise.
chmod 644 ~/.ssh/known_hosts — known_hosts permissions of 0644 are safe and standard; the file only needs to be readable.
chmod 644 ~/.ssh/id_ed25519.pub — the public key (permission 0644) can be shared freely.
chmod 600 ~/.ssh/config — the SSH client configuration may contain credentials, so keep it owner-only.
chmod 700 ~/.ssh — the .ssh directory itself must be private to the owner.

When SSH reports Bad owner or permissions — for example Permissions 0644 for ~/.ssh/authorized_keys are too open — the fix is simply chmod for the SSH key file: chmod 600 ~/.ssh/authorized_keys. Use this cheat sheet for every SSH file, on Linux or macOS, and generate the exact command with the custom checker below.