0

I have a private key file, which is password protected. But when i try to use it, ssh complains about the permissions:

ssh -i example.pem root@myserver

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'example.pem' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "example.pem": bad permissions

There are many questions about this problem on Stackoverflow and here on Serverfault. They all can be summarized with "Comply!". All right, I will. But what I don't understand is: Why does SSH complain, when the file is password protected?

When I change the permissions and try again, SSH asks for the password:

ssh -i example.pem root@myserver

Enter passphrase for key 'example.pem':

SSH is therefore aware that it is password protected, but still complains when the file can be seen by everyone. Why? As the file is password protected, I could post it online on my Facebook profile. (If I had one.) Or is the password just fake and it is possible to extract the key without it? What am I missing?

(I am not asking how to solve this. There are already more than enough questions about that.)

1

1 Answer 1

2

Shortly: security. Even though the passphrase protection of the key is not fake (as far as I know, the passphrase is an encryption key) and means protection against someone who has access to the private key file, it can still be cracked.

The problem is that the attacker can brute-force guess the passphrase (let's say I download your private key and try random generated passphrases to decrypt it; then it is just a question of CPU time). The file permissions create just additional barrier, at least for unprivileged users/processes.

Not the answer you're looking for? Browse other questions tagged or ask your own question.