Reputation: 4230

openssh windows bad owner or permissions

I've installed openssh for windows and when I run ssh localhost I get

Bad owner or permissions on C:\Users\gary/.ssh/config

I've looked at these 2 questions https://superuser.com/questions/348694/bad-owner-or-permissions-error-using-cygwins-ssh-exe and https://serverfault.com/questions/253313/ssh-returns-bad-owner-or-permissions-on-ssh-config but none of the answers work for me. sshd is running as a service as the Local System user. I've run chmod 0600 C:\Users\gary\.ssh\config and chown gary C:\Users\gary\.ssh\config. I've also cleared the ACL by running setfacl -b C:\Users\gary\.ssh\config and then chmod 0600 C:\Users\gary\.ssh\config again. I've also tried changing the owner to SYSTEM and got the same error.

I'm not sure what else to do, is there anything wrong with my setup? I also have git installed which installed mingw, I deleted ssh and sshd from my git installation so they wouldn't be on my path.

Other commands I've run are icacls "C:\Users\gary\.ssh\config" /setowner gary chown -R gary:1049089 C:\Users\gary\.ssh

ls -la C:\Users\gary\.ssh\config shows

-rw-r--r-- 1 gary 1049089 229 Jan 3 14:43 'C:\Users\gary.ssh\config'

it keeps showing this even after changing the owner to SYSTEM, but in the file properties in file explorer it shows SYSTEM as the owner

Upvotes: 146

Answers (30)

demet47

Reputation: 51

I only had cmd interface so my solution will be accordingly. It turns out, my ~/.ssh/config file had the wrong permissions (which can be checked via ls -la command from terminal).

May be the file permissions are too weak. SSH requires only the owner to have write permission. Reference Read

I changed the permissions with:

chmod 600 ~/.ssh/config

and eureka!

PS: I had extra permissions to the required ones.

Upvotes: 1

Fery W

Reputation: 1532

Just got same issue after re-install windows. And easily fixed just by :

Removing inheritance
Changing the file permissions to

SYSTEM & Administrators - Full Control
[your username] - Modify & as Owner

Note:

I'm still using Windows 10 built-in SSH client C:\Windows\System32\OpenSSH\ssh.exe & not using cygwin at all

Upvotes: 40

Jason Hughes

Reputation: 3597

This started popping up immediately after I created another user with Administrator privileges, and that account began inheriting access to my .ssh folder.

You do not need to change your permissions whatsoever.

Just go to .ssh, right-click Properties, Security Tab, Advanced. DISABLE INHERITANCE. When you are disabling the inheritance you will be asked if you want to copy the current inherited access right. Accept that.

Then, click on the Administrator user (the one that is not you) and Remove them. Apply. Done.

Upvotes: 296

Tutbjun

Reputation: 41

I ended up needing a different (but quite simple) solution for a similar problem I had.

I couldn't mess with the permissions since Visual Code needed those for the ssh extension. My problem at least, centered around the file permissions of the .ssh/config file, and that OpenSSH needed few agents to have permission, while vscode needed that to add hosts etc.

Thus, my solution ended up just being to add an extra config file ("vscodeconfig") just for vscode. I added this to the vscode settings ("Remote.SSH Config File"), and then I could remove the permissions that OpenSSH didn't like from "config".

Hope someone finds this additional point useful:)

Upvotes: 0

dan-kli

Reputation: 868

For me, the problem was that the file owner of the authorized_keys file in C:\Users\username.ssh and the administrators_authorized_keys file in C:\ProgramData\ssh was wrong. It has been created by a different user, but the Windows OpenSSH server expected it to be the same user as the user that wanted to connect, resulting in the Bad owner error in the logfile of the server.

Change the file owner with icacls with the /setowner parameter:

icacls.exe "$env:ProgramData\ssh\administrators_authorized_keys" /setowner "ssh_user_name"

Or change it with PowerShell by changing the security descriptor with Set-Acl:

$acl = Get-Acl -Path "$env:ProgramData\ssh\administrators_authorized_keys"
$acl.SetOwner([System.Security.Principal.NTAccount]"ssh_user_name")
Set-Acl -Path "$env:ProgramData\ssh\administrators_authorized_keys" -AclObject $acl

I still had to break inheritance and set the correct file permissions, like it is described in other answers, but changing the file owner is what finally fixed the error for me.

Upvotes: 0

clockw0rk

Reputation: 568

This problem arose when I used the Visual studio code remote ssh connection - extension with WSL 2

I'm not exactly sure whether WSL 2 or VSCode fiddled with it, but after accepting the fingerprint of a local ssh device, the format was like this

C://users//xyz.ssh\blablabla

you see how the slashes are reversed?

Alas, this ancient problem back from the stone age ... I resolved it by just deleting the whole .ssh folder, then opening up a CMD (NOT wsl since it is again linux) and just ssh again to the device, accepting the fingerprint yadda yadda.

-> the folder is now fixed! I'm sure this will solve other bad ownership problems too, but then again I'm a local administrator on the computer here, not taking into account corporate admins who might ghost around on this box

Upvotes: 0

Iti Tyagi

Reputation: 3661

None of the solution above worked. Deleting/Setting permissions etc. Same settings and no changes done for .config file. Finally added obvious path for .ssh config as

"C:\User\USERNAME\.ssh\config" (use double slash).

Followed: https://github.com/microsoft/vscode-docs/issues/3210

Upvotes: 4

team317

Reputation: 11

This is because the config file cannot be accessed normally. We can create a new config file (this file needs to be accessible normally), such as D:/.ssh/config, and then specify the configuration file through the -F option: ssh -F D:/.ssh/config username@ip_address -p port

Upvotes: 0

grayxu

Reputation: 144

For me, re-editing the permission settings in Windows is too complicated. Regenerating another configuration in vscode does not work either.

I set a custom config file path to solve this problem.
["Remote SSH: Config file"]
The absolute file path to a custom SSH config file.

note: search this option by @ext:ms-vscode-remote.remote-ssh,ms-vscode-remote.remote-ssh-edit config file

Upvotes: 1

Gerard Carbó

Reputation: 1905

Use ssh client from Git instead of Windows inbuilt SSH client. E.g. set VS Code to use C:\Program Files\Git\usr\bin\ssh.exe instead of C:\Windows\System32\OpenSSH\ssh.exe.

Steps:

In VS Code navigated to [File] -> [Preferences] -> [Settings] -> Search remote.ssh.path
Input C:\Program Files\Git\usr\bin\ssh.exe

Alternatively:

Update PATH environment variable to point to Git bin before Windows System32.
Type "env" in Start bar to edit System (or account) environment variables.
Select Path and hit edit.
Add C:\Program Files\Git\usr\bin\ssh.exe to the list and move it to the top of the list.

Upvotes: 63

LarryH

Reputation: 1888

Instead of using the properties box, you can use the one liner:

icacls .ssh /grant:r <yourUserName>:f /inheritance:r

/grant:r username:f -> grant and overwrite permissions, giving full permissions to username /inheritance:r -> remove inherited permissions

Keep known_hosts writable with icacls .ssh/known_hosts /grant:rw <username>:f /inheritance:r

Upvotes: 25

Nicolas Chaillou

Reputation: 29

Hi guys after a troubleshoot for a day I found that this "m.. f.." config file should not stand in the .ssh/ path.

For VSCODE just set the config in 'C:\ProgrmaData\ssh\ssh_config' path as proposed in the second choice of the palette command, and forget .shh path for this configuration.

That worked fine for me.

Nota: there was also a known_host file also created here with strange VM names inside, I deleted also this file. and that helps

Upvotes: 0

Ala Eddine JEBALI

Reputation: 7821

Having the exact same issue today, this is how I solved it:

Go to C:\Users\username.ssh
Right-click the config file
Properties -> Security -> Advanced -> Disable Inheritance -> Disable inheritance -> Remove all inherited permissions from this object -> Apply -> Yes -> Ok -> Ok

Upvotes: 27

Rahul Somasundaram

Reputation: 596

after disabling inheritance, make sure you add your current user, else u cannot edit the file

Upvotes: 3

John K

Reputation: 41

After a domain change over, I started having this same problem. Went through all of the suggestions listed and nothing worked, including both chmod and chown solutions.

I ended up fixing the problem by copying the folder, pasting it, deleting the original, and then renaming it back to .ssh.

Upvotes: 1

Dave Rada

Reputation: 91

On windows server this is due to permission problem. Need to remove access to other users for the following folders

.ssh - folder

Right click on this folder -> Select "Give access to" - > Click on "Remove Access" Right click on this folder -> Select "properties" - > "Securities" - > Click on "Edit Permissions" - Remove other users except the ID you are logged in.

Repeat the same process for the folder under which you have .pem file. (Note: Keep .pem file in a separate folder)

Upvotes: 9

Fusseldieb

Reputation: 1374

I deleted C:\Users\user/.ssh/config and reran my stuff, then it worked.

However, if you have something valuable there, make a backup first, just in case!

Upvotes: 1

nilknow

Reputation: 379

I guess it was caused by the wrong path expression.

Bad owner or permissions on C:\Users\gary/.ssh/config

The /.ssh should be \.ssh. So I try to use git bash (the terminal tool when install git in Windows system) to run ssh command. It really works. But I don't really know if it is caused by the reason I guessed.

Upvotes: 0

Omemanti

Reputation: 1

Rename the config file to something like config2
Open this file with notepad
Save As config (original name)

This worked for me.

Upvotes: 0

KR-SO

Reputation: 11

I was having this problem, and no amount of changing permissions or disabling inheritance on the config file would fix it. It turned out that it did not like my computer name and user name being the same, so I re-named my computer, allowed open ssh to re-create the config file, and the permissions are now correct. That was probably a bad idea to begin with, tbh.

Upvotes: 1

Zieng

Reputation: 451

I tried all the solutions above, and sadly still can't fix this issue. I'm pretty sure the permission of my ssh config is correct, this has been verified by the Explore GUI and the Get-Acl commands.

Then I finally find a way to solve it:

delete the entire .ssh folder and then open powershell and type ssh localhost. It will create a new .ssh folder for you, then you can apply the above permission tweaks(for me I only did one thing: disable inheritance).

So if other solutions doesn't work for you, maybe you can try this. Hope it's helpful.

PS: don't forget to backup your old .ssh folder before deleting it.

Upvotes: 1

Rahul Bhatia

Reputation: 11

For me it was fixed by running chmod 0644 config under ~/.ssh/. Earlier it was set to 755 which was causing "Bad owner or permissions on /home/home/.ssh/config"

Upvotes: 1

Егор Малыгин

Reputation: 300

For those still struggling with this, check this out: https://github.com/PowerShell/openssh-portable/pull/418. This was the case for me. It turns out that your computer should be named differently from your username... 🤷‍♂️ It will probably be fixed soon in future updates, because fix got into commit.

So again: if your computer name is the same as your username and you still haven't fixed this issue with permissions dialog, then probably renaming your computer could help.

Upvotes: 20

K. Martin Holtan

Reputation: 1

For me it was fixed by running chmod 0644 config under ~/.ssh/ when running WSL.

Upvotes: 0

user11074381

Reputation:

No group change or whatever,the first answer is right.Change to git ssh.exe How?

uninstall win10's openssh in Settings
add path of git's ssh.exe to your Path

Upvotes: 0

ßastian

Reputation: 1854

The problem seems from the files are owned/has-permission for more than one user.

1- Go to your ./ssh folder and for both config & id_rsa files. From the properties -> Security -> Advanced: 2- Make sure that the user that you are logged in with IS the only user there.

Upvotes: 0

Mainak

Reputation: 31

If User is in Administrative group just keep configuration in c:\programdata\ssh\ssh_config instead %USERPROFILE%.ssh\config, will work

Upvotes: 3

SlashGordon

Reputation: 880

Use FixUserFilePermissions.ps1 to fix permissions of client side files - keys and config files of current user.

git clone [email protected]:PowerShell/openssh-portable.git
cd openssh-portable/contrib/win32/openssh
.\FixUserFilePermissions.ps1 -Confirm:$false

Upvotes: 10

benzhi

Reputation: 116

For anyone, who still has troubles after applying the owner + modify (plus full control for admins): it did not work for me. Then I saw a solution to remove all other users (incl all admins), which did not help either.

This worked for me:

leave System and Administrators in place, with full control, as suggested above
leave the user itself in place, as owner, with modify, as suggested above
however, remove any other user or group. You probably need to go to advanced first, to disable inheritance of rights

after I removed an administrative user who was added by Windows after entering my folder (by passing through the UAC box), it worked for me again.

Hope this helps for anyone who encounters this specific issue :-)

Upvotes: 3

17slim

Reputation: 1233

I'm not sure what version of Windows you're running, but since this is recent I'd guess Windows 10. I recently found out that an OpenSSH client is installed by default as of the April 2018 update. I then found I had two instances of OpenSSH: the one I installed myself and the one Windows gave me. Uninstalling the one I had installed caused the error message you describe.

The solution that worked for me was to remove the user-installed OpenSSH as well as the C:\Users\username\.ssh folder, and let Windows 10 OpenSSH create the folder when you run the command the next time. I didn't have any configuration I was worried about losing, but if you do I'd suggest copying and pasting the contents of the files somewhere and recovering them afterwards.

Hope this helps!

Upvotes: 10

openssh windows bad owner or permissions

Answers (30)

Related Questions