chmod Cheat Sheet — SSH Key Permissions (600, 644) — desktop.engineer
Correct chmod for SSH keys: chmod 600 ~/.ssh/authorized_keys, chmod 644 ~/.ssh/known_hosts, chmod 600 ~/.ssh/config and more.
SSH key permissions: chmod for SSH keys
SSH is strict about file permissions: any key or authorized_keys file readable by other users is rejected for security reasons. This chmod cheat sheet lists the exact permissions required for SSH keys, ~/.ssh/authorized_keys, ~/.ssh/config and ~/.ssh/known_hosts.
- chmod 600 ~/.ssh/authorized_keys — the authorized_keys file must be readable and writable only by its owner, otherwise SSH refuses key-based login.
- chmod 600 ~/.ssh/id_ed25519 (also id_rsa, id_ecdsa) — private keys must not be accessible by other users; SSH rejects them otherwise.
- chmod 644 ~/.ssh/known_hosts — known_hosts permissions of 0644 are safe and standard; the file only needs to be readable.
- chmod 644 ~/.ssh/id_ed25519.pub — the public key (permission 0644) can be shared freely.
- chmod 600 ~/.ssh/config — the SSH client configuration may contain credentials, so keep it owner-only.
- chmod 700 ~/.ssh — the .ssh directory itself must be private to the owner.
When SSH reports Bad owner or permissions — for example Permissions 0644 for ~/.ssh/authorized_keys are too open — the fix is simply chmod for the SSH key file: chmod 600 ~/.ssh/authorized_keys. Use this cheat sheet for every SSH file, on Linux or macOS, and generate the exact command with the custom checker below.
FAQ
What is the correct chmod for an SSH key?
Use chmod 600 on private keys (id_ed25519, id_rsa, id_ecdsa) and chmod 644 on public keys (*.pub). SSH rejects any private key readable by other users.
Should authorized_keys be 600 or 644?
Use chmod 600 ~/.ssh/authorized_keys — readable and writable only by the owner. With 644, SSH reports "Permissions are too open" and refuses key-based login.
What permissions should known_hosts have?
Use chmod 644 ~/.ssh/known_hosts — the server fingerprint list only needs to be readable. Also set chmod 700 ~/.ssh so the directory itself stays private.
What chmod should id_rsa have?
Run chmod 600 ~/.ssh/id_rsa — like every SSH private key, id_rsa must be readable and writable only by you. If SSH warns about an unprotected private key file, that is the fix.
What permissions should ~/.ssh and ~/.ssh/config have?
Set chmod 700 ~/.ssh on the directory and chmod 600 ~/.ssh/config on the client configuration, which may contain credentials. SSH checks the whole chain, not just the key file.
Can an SSH public key be 644?
Yes — chmod 644 on *.pub files is correct: permissions 0644 (or 0664 inside a trusted group) are safe for anything that is not secret. Only private keys and authorized_keys need the strict 600.
All tools