File Permissions

~12 min · permissions, ssh-perms, silent-failure

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Why SSH cares so much

SSH refuses to use private keys, authorized_keys, or even your home directory if permissions are too loose — and the failure mode is silent. Auth quietly falls back to password; you spend hours debugging why your key isn't working. The root cause is almost always permissions. Set them once, audit them periodically, sleep better.

The numbers to memorize

Path	Permission	Why
`~`	755 or 750	Not writable by group or others
`~/.ssh`	700	Only owner can read or list
`~/.ssh/id_ed25519`	600	Private key — only owner reads
`~/.ssh/id_ed25519.pub`	644	Public key, fine to share
`~/.ssh/authorized_keys`	600	Server-side guest list — only owner writes
`~/.ssh/known_hosts`	644	Host fingerprints, not secret
`~/.ssh/config`	644 or 600	Either is fine

Code

Diagnose perm-related auth failures·bash

# Verbose SSH shows the exact rejection
ssh -v user@host
# Look for 'Authentication refused: bad ownership or modes for...'

# Permission audit
ls -la ~/.ssh/

# Quick fix-all script
cat > ~/bin/fix-ssh-perms.sh <<'EOF'
#!/bin/bash
set -eu
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_*           2>/dev/null || true
chmod 644 ~/.ssh/*.pub          2>/dev/null || true
chmod 644 ~/.ssh/known_hosts    2>/dev/null || true
chmod 644 ~/.ssh/config         2>/dev/null || true
chmod 600 ~/.ssh/authorized_keys 2>/dev/null || true
chmod o-w,g-w ~                  # home not writable by group/other
echo 'SSH permissions normalized.'
EOF
chmod +x ~/bin/fix-ssh-perms.sh

External links

OpenSSH FAQ — file modes

Exercise

On every machine in your fleet, run ls -la ~/.ssh/ and check every entry against the table above. Any that don't match — fix immediately with the script above. Bonus: deploy the script via your dotfiles bootstrap so it runs on every new-machine setup, eliminating perm-related auth bugs preemptively.