I have a generated a ssh private key .key. I want to add it into my ssh in Mac to connect to a remote server, I have only known_hosts file in ~/.ssh directory.

When I try to add it using this command:

ssh-add -K ~/.ssh/myKey.ppk

I get this error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/Users/username/.ssh/myKey.ppk' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
  • Possible duplicate of SSH with key passphrase not working – Jakuje Nov 12 at 15:54
  • @Jakuje the question is different, leaving this open. It may be a duplicate of a different one though. – Harv Nov 12 at 19:20
  • 1
    @Harv thank you for the comment. The question is different, but the answer is still the same. These answers below are just incomplete (leaving alone they are obvious first steps from the first chapter of *nix troubleshooting guide), but they do not lead anywhere. After applying either of them, the OP will find out that OpenSSH does not know how to read the Putty private key format and then he will ask why, which will boil down to my answer. – Jakuje Nov 12 at 20:07
  • @Jakuje Interesting. I didn't know that about the different format; the question pertains specifically to permissions, not the file format - but thanks to your contribution, OP will have to deal with that once permissions issues are out of the way. – Harv Nov 12 at 20:19

The error message is displayed because the file permission are set such that it is readable by other users apart from the logged-in user. To overcome the error message, you will need to change the file permissions for the private key such that it is readable only by you.

To do that, run the following command in Terminal:

cd ~/.ssh ; chmod 400 myKey.ppk

This will allow only your user to read (and not write and execute) the private key file and prevent everyone else from reading, writing and executing the file.

This will take care of the error message shown to you and you should be able to add the private key file all right.

Go to the terminal and type this command:

chmod 0600 ~/.ssh/myKey.ppk

That should be fine.

  • 5
    Why even allow write access? 0400 would be sufficient. – Ruslan Nov 12 at 12:43
  • 2
    It's quite possible he might want to update it later. At any rate, 0600 is WAY better than 0644 – Scott Earle Nov 13 at 3:33

While changing the permissions of the .ppk file will indeed make this warning go away, I would recommend to disable group/others access to .ssh directory altogether:

cd ~
chmod g-rwx .ssh
chmod o-rwx .ssh

Otherwise, with insecure permissions on your home directory, other users could place files (like authorized_keys) in your .ssh directory, or mess with known_hosts, or change config items, and gain access that way - without having to know either your password or your private key.

Secondly, in a multi-user environment it would be dubious practice just to retroactively restrict permissions to a key. If a private key has been world-readable on a multi-user system at any given time, it should be considered as already compromised.

it looks like you copied your private key from Windows or from other computer where you used PuTTY. Unfortunately, the ssh command-line tool does not support this key format and therefore you have two options:

  • Install PuTTY again (it should exist also on your mac)
  • Convert the private key from PuTTY file format to the OpenSSH format (again using PuTTYGen from PuTTY as already described in my previous answer:

    • Open PuttyGen
    • Click Load
    • Load your private key
    • Go to Conversions->Export OpenSSH and export your private key
    • Copy your private key to ~/.ssh/id_rsa

If you still see the issues using the new exported key (~/.ssh/id_rsa, make sure that the key is not readable by anyone else but you (it is your private key) by removing all the privileges of all the others by running chmod 600 ~/.ssh/id_rsa.

  • There's no point to downvoting this. The permissions are irrelevant if ssh can't understand the key even with correct permissions; futhermore the answer also shows how to set the correct permissions. – muru Nov 13 at 9:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.