I need to use SSH on my machine to access my website and its databases (setting up a symbolic link- but I digress).

Following problem

I enter the command:

ssh-keygen -t dsa

To generate public/private dsa key pair. I save it in the default (/home/user/.ssh/id_dsa) and enter Enter passphrase twice.

Then I get this back:

Permissions 0755 for '/home/etc.ssh/id_rsa' are too open. It is recommended that your private key files are NOT accessible by others. This private key will be ignored. bad permissions: ignore key: [then the FILE PATH in VAR/LIB/SOMEWHERE]

Now to work round this I then tried

sudo chmod 600 ~/.ssh/id_rsa         sudo chmod 600 ~/.ssh/id_rsa.pub    

But shortly after my computer froze up, and on logging back on there was a could not find .ICEauthority error.

I got round this problem and deleted the SSH files but want to be able to use the correct permissions to avoid these issues in future.

How should I set up ICEauthority, or where should I save the SSH Keys- or what permissions should they have? Would using a virtual machine be best?

This is all very new and I am on a very steep learning curve, so any help appreciated.

  • typo- sorry just one set of keys was generated! Jan 25, 2016 at 19:18
  • 1
    permissions to .ssh dir are equally important as key permissions. It should be 600. To fix it run : chmod -R 600 ~/.ssh.
    – MAQ
    Jan 25, 2016 at 19:34
  • 11
    actually .ssh directory permissions need to be 700 not 600. The execute permission is the one that gives you access to what is inside that directory. So the correct commands should be chmod 700 $HOME/.ssh and chmod 600 $HOME/.ssh/id_rsa
    – MelBurslan
    Jan 25, 2016 at 19:38
  • 2
    The error about .ICEauthority is not related to the chmod commands you show. Either it's a coincidence or you ran some other commands that you aren't showing us. Jan 25, 2016 at 23:08

2 Answers 2


chmod 600 ~/.ssh/id_rsa; chmod 600 ~/.ssh/id_rsa.pub (i.e. chmod u=rw,go= ~/.ssh/id_rsa ~/.ssh/id_rsa.pub) are correct.

chmod 644 ~/.ssh/id_rsa.pub (i.e. chmod a=r,u+w ~/.ssh/id_rsa.pub) would also be correct, but chmod 644 ~/.ssh/id_rsa (i.e. chmod a=r,u+w ~/.ssh/id_rsa) would not be. Your public key can be public, what matters is that your private key is private.

Also your .ssh directory itself must be writable only by you: chmod 700 ~/.ssh or chmod u=rwx,go= ~/.ssh. You of course need to be able to read it and access files in it (execute permission). It isn't directly harmful if others can read it, but it isn't useful either.

You don't need sudo. Don't use sudo to manipulate your own files, that can only lead to mistakes.

The error about .ICEauthority is not related to the chmod commands you show. Either it's a coincidence or you ran some other commands that you aren't showing us.

  • 3
    What do the permissions on the ~/.ssh/known_hosts need to be?
    – Sooth
    Jan 24, 2018 at 16:24
  • I want to add to the answers above that for me my home directory (~/) also needed to have the permissions 755, regardless of the permissions of ~/.ssh and the files therein. (This was on a Synology NAS, might not apply to all linuxes)
    – hoelk
    May 30, 2018 at 18:30
  • @terdon: So, are you saying that we should have accepted Scrooge McDuck’s suggested edit?  And that Gilles should override us and accept it?   (Note that it contains an error.) Jun 23, 2020 at 1:59
  • @G-ManSays'ReinstateMonica' I find silly to state that my edit does not improve readibility; if not so, papers would only contain inline equations. On other side I can't understand how an extremely simple and properly highlighted table explaining how to read those chmod can be said superfluous; if that's the case, then why posting commands in the first place and just not point users to bash scripts all the times. Jun 28, 2020 at 4:12
  • 1
    That said, I just want my answer to be shown for very practical reasons: people ask me how to enable ssh all the time and they find very annoying to copy-paste the many inline commands from Gilles' answer, which among other things they usually find difficult to understand and remember. I don't care if you consider it an improved version of this answer or a completely new one, I only care for people I redirect here (myself included) to have their question answered in the most efficient way. Jun 28, 2020 at 4:22
    # Set public/private key permissions

    # Octal form
    chmod 600 ~/.ssh/id_rsa
    chmod 600 ~/.ssh/id_rsa.pub

    # Equivalent literal form
    chmod u=rw,go= ~/.ssh/id_rsa ~/.ssh/id_rsa.pub

    # Optional: make public key readable
    chmod 644 ~/.ssh/id_rsa.pub # chmod a=r,u+w ~/.ssh/id_rsa.pub

    # Set directory permissions
    chmod 700 ~/.ssh # chmod u=rwx,go= ~/.ssh

    # Legend for literal form
    # +: allow       -: deny         =: reset and allow
    # u: user        r: read
    # g: group       w: write
    # o: others      x: execute
    # a: all
  • 2
    Great explanations, but whats a in a=r
    – Jikku Jose
    Oct 29, 2021 at 22:40
  • 1
    a means all
    – Lagerbaer
    Nov 30, 2021 at 2:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .