{"record":{"id":"e6945425394b0beb","repo":"hashicorp/vagrant","slug":"the-private-key-to-connect-to-the-machine-via-ssh","errorCode":null,"errorMessage":"The private key to connect to the machine via SSH must be owned\nby the user running Vagrant. This is a strict requirement from\nSSH itself. Please fix the following key to be owned by the user\nrunning Vagrant:\n\n%{key_path}","messagePattern":"The private key to connect to the machine via SSH must be owned\nby the user running Vagrant\\. This is a strict requirement from\nSSH itself\\. Please fix the following key to be owned by the user\nrunning Vagrant:\n\n%(.+?)","errorType":"exception","errorClass":"Vagrant::Errors::SSHKeyBadOwner","httpStatus":null,"severity":"error","filePath":"lib/vagrant/util/ssh.rb","lineNumber":41,"sourceCode":"      LOGGER = Log4r::Logger.new(\"vagrant::util::ssh\")\n\n      # Checks that the permissions for a private key are valid, and fixes\n      # them if possible. SSH requires that permissions on the private key\n      # are 0600 on POSIX based systems. This will make a best effort to\n      # fix these permissions if they are not properly set.\n      #\n      # @param [Pathname] key_path The path to the private key.\n      def self.check_key_permissions(key_path)\n        # Don't do anything if we're on Windows, since Windows doesn't worry\n        # about key permissions.\n        return if Platform.windows? || Platform.wsl_windows_access_bypass?(key_path)\n\n        LOGGER.debug(\"Checking key permissions: #{key_path}\")\n        stat = key_path.stat\n\n        if !stat.owned? && Process.uid != 0\n          # The SSH key must be owned by ourselves, unless we're root\n          raise Errors::SSHKeyBadOwner, key_path: key_path\n        end\n\n        if FileMode.from_octal(stat.mode) != \"600\"\n          LOGGER.info(\"Attempting to correct key permissions to 0600\")\n          key_path.chmod(0600)\n\n          # Re-stat the file to get the new mode, and verify it worked\n          stat = key_path.stat\n          if FileMode.from_octal(stat.mode) != \"600\"\n            raise Errors::SSHKeyBadPermissions, key_path: key_path\n          end\n        end\n      rescue Errno::EPERM\n        # This shouldn't happen since we verify we own the file, but\n        # it is possible in theory, so we raise an error.\n        raise Errors::SSHKeyBadPermissions, key_path: key_path\n      end\n","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/lib/vagrant/util/ssh.rb#L23-L59","documentation":"Vagrant::Util::SSH.check_key_permissions stats the private key and raises SSHKeyBadOwner when the file is not owned by the current user and the process is not root — mirroring OpenSSH's strict ownership rule for identity files. Windows hosts and WSL windows-access bypass paths return before the check.","triggerScenarios":"The private key (e.g. .vagrant/machines/<name>/virtualbox/private_key) is owned by another user — files created under sudo, projects restored from a backup as root, or a workspace shared between users — while vagrant runs as the non-owner, non-root user.","commonSituations":"Running vagrant under sudo once (keys become root-owned); cloning/restoring projects under a different uid; multi-user hosts sharing one directory.","solutions":["chown the listed key back to the running user: `sudo chown $USER <key_path>` and `chmod 600 <key_path>`","Or delete the key file so Vagrant regenerates a fresh keypair on the next up/ssh","Run vagrant consistently as the user who owns the project and .vagrant tree"],"exampleFix":"# before\n$ vagrant ssh   # SSHKeyBadOwner: .vagrant/machines/default/virtualbox/private_key\n\n# after\n$ sudo chown $USER .vagrant/machines/default/virtualbox/private_key\n$ chmod 600 .vagrant/machines/default/virtualbox/private_key\n$ vagrant ssh","handlingStrategy":"validation","validationCode":"st = File.stat(key_path)\nunless st.owned? || Process.uid == 0\n  abort \"#{key_path} is owned by uid #{st.uid}; run: sudo chown #{Process.uid} #{key_path}\"\nend","typeGuard":null,"tryCatchPattern":"begin\n  Vagrant::Util::SSH.check_key_permissions(Pathname.new(key))\nrescue Vagrant::Errors::SSHKeyBadOwner\n  require 'etc'\n  system('sudo', 'chown', Etc.getlogin, key) or raise\n  retry\nend","preventionTips":["Never run vagrant under sudo","After restoring projects from backup, fix ownership of the whole .vagrant tree","Keep one project per user; avoid shared .vagrant.d directories"],"tags":["ssh","private-key","ownership","permissions"],"backgroundTag":"ssh-key-permissions","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}