{"record":{"id":"cd52d45154b080e8","repo":"hashicorp/vagrant","slug":"the-private-key-to-connect-to-this-box-via-ssh-has","errorCode":null,"errorMessage":"The private key to connect to this box via SSH has invalid permissions\nset on it. The permissions of the private key should be set to 0600, otherwise SSH will\nignore the key. Vagrant tried to do this automatically for you but failed. Please set the\npermissions on the following file to 0600 and then try running this command again:\n\n%{key_path}\n\nNote that this error occurs after Vagrant automatically tries to\ndo this for you. The likely cause of this error is a lack of filesystem\npermissions or even filesystem functionality. For example, if your\nVagrant data is on a USB stick, a common case is that chmod is\nnot supported. The key will need to be moved to a filesystem that\nsupports chmod.","messagePattern":"The private key to connect to this box via SSH has invalid permissions\nset on it\\. The permissions of the private key should be set to 0600, otherwise SSH will\nignore the key\\. Vagrant tried to do this automatically for you but failed\\. Please set the\npermissions on the following file to 0600 and then try running this command again:\n\n%\\{key_path\\}\n\nNote that this error occurs after Vagrant automatically tries to\ndo this for you\\. The likely cause of this error is a lack of filesystem\npermissions or even filesystem functionality\\. For example, if your\nVagrant data is on a USB stick, a common case is that chmod is\nnot supported\\. The key will need to be moved to a filesystem that\nsupports chmod\\.","errorType":"exception","errorClass":"Vagrant::Errors::SSHKeyBadPermissions","httpStatus":null,"severity":"error","filePath":"lib/vagrant/util/ssh.rb","lineNumber":51,"sourceCode":"        # about key permissions.\n        return if Platform.windows? || Platform.wsl_windows_access_bypass?(key_path)\n\n        LOGGER.debug(\"Checking key permissions: #{key_path}\")\n        stat = key_path.stat\n\n        if !stat.owned? && Process.uid != 0\n          # The SSH key must be owned by ourselves, unless we're root\n          raise Errors::SSHKeyBadOwner, key_path: key_path\n        end\n\n        if FileMode.from_octal(stat.mode) != \"600\"\n          LOGGER.info(\"Attempting to correct key permissions to 0600\")\n          key_path.chmod(0600)\n\n          # Re-stat the file to get the new mode, and verify it worked\n          stat = key_path.stat\n          if FileMode.from_octal(stat.mode) != \"600\"\n            raise Errors::SSHKeyBadPermissions, key_path: key_path\n          end\n        end\n      rescue Errno::EPERM\n        # This shouldn't happen since we verify we own the file, but\n        # it is possible in theory, so we raise an error.\n        raise Errors::SSHKeyBadPermissions, key_path: key_path\n      end\n\n      # Halts the running of this process and replaces it with a full-fledged\n      # SSH shell into a remote machine.\n      #\n      # Note: This method NEVER returns. The process ends after this.\n      #\n      # @param [Hash] ssh_info This is the SSH information. For the keys\n      #   required please see the documentation of {Machine#ssh_info}.\n      # @param [Hash] opts These are additional options that are supported\n      #   by exec.\n      def self.exec(ssh_info, opts={})","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/lib/vagrant/util/ssh.rb#L33-L69","documentation":"In check_key_permissions, when the key's octal mode is not 600 Vagrant chmods it to 0600 and re-stats; if the filesystem silently kept the old mode (chmod returned without error but changed nothing), SSHKeyBadPermissions is raised. The classic cause is a filesystem that does not implement Unix permission bits (FAT/exFAT/NTFS media, some network filesystems) — the error text itself cites the USB-stick case.","triggerScenarios":"VAGRANT_HOME, the project, or the key directory living on vfat/exFAT/NTFS or a network mount where chmod(2) is a no-op; `vagrant ssh` fails after the automatic correction attempt verifies the mode is still not 0600.","commonSituations":"Vagrant data on a USB stick; Windows drives mounted into WSL/Linux; CIFS shares used as home directories.","solutions":["Move the project/VAGRANT_HOME to a POSIX filesystem (ext4/xfs) and retry — exactly what the error text recommends","If the mount can enforce modes, remount with suitable options and pre-set the key to 600 manually","On WSL, keep keys on the Linux filesystem (~) rather than /mnt/c"],"exampleFix":"# before: VAGRANT_HOME on a FAT USB stick\n$ VAGRANT_HOME=/media/usb/vagrant.d vagrant ssh   # SSHKeyBadPermissions\n\n# after: move data to a POSIX filesystem\n$ mv /media/usb/vagrant.d ~/.vagrant.d\n$ vagrant ssh","handlingStrategy":"validation","validationCode":"require 'fileutils'\n\ndef key_mode_ok?(path)\n  (File.stat(path).mode & 0o777) == 0o600\nend\n\nFileUtils.chmod(0o600, key) unless key_mode_ok?(key)\nabort \"filesystem ignores chmod; move the key off #{File.dirname(key)}\" unless key_mode_ok?(key)","typeGuard":null,"tryCatchPattern":"begin\n  Vagrant::Util::SSH.check_key_permissions(Pathname.new(key))\nrescue Vagrant::Errors::SSHKeyBadPermissions => e\n  warn e.message\n  raise 'move VAGRANT_HOME/project to a filesystem that honors chmod'\nend","preventionTips":["Never place .vagrant.d or projects on FAT/NTFS media on Unix hosts","Pre-set 0600 on keys as part of provisioning","On unusual mounts, re-check with `stat -c %a` after chmod"],"tags":["ssh","private-key","permissions","chmod","filesystem"],"backgroundTag":"ssh-key-permissions","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}