hashicorp/vagrant · error · Vagrant::Errors::SSHKeyBadPermissions

The private key to connect to this box via SSH has invalid p

Error message

The private key to connect to this box via SSH has invalid permissions
set on it. The permissions of the private key should be set to 0600, otherwise SSH will
ignore the key. Vagrant tried to do this automatically for you but failed. Please set the
permissions on the following file to 0600 and then try running this command again:

%{key_path}

Note that this error occurs after Vagrant automatically tries to
do this for you. The likely cause of this error is a lack of filesystem
permissions or even filesystem functionality. For example, if your
Vagrant data is on a USB stick, a common case is that chmod is
not supported. The key will need to be moved to a filesystem that
supports chmod.

What it means

In check_key_permissions, when the key's octal mode is not 600 Vagrant chmods it to 0600 and re-stats; if the filesystem silently kept the old mode (chmod returned without error but changed nothing), SSHKeyBadPermissions is raised. The classic cause is a filesystem that does not implement Unix permission bits (FAT/exFAT/NTFS media, some network filesystems) — the error text itself cites the USB-stick case.

Source

Thrown at lib/vagrant/util/ssh.rb:51

        # about key permissions.
        return if Platform.windows? || Platform.wsl_windows_access_bypass?(key_path)

        LOGGER.debug("Checking key permissions: #{key_path}")
        stat = key_path.stat

        if !stat.owned? && Process.uid != 0
          # The SSH key must be owned by ourselves, unless we're root
          raise Errors::SSHKeyBadOwner, key_path: key_path
        end

        if FileMode.from_octal(stat.mode) != "600"
          LOGGER.info("Attempting to correct key permissions to 0600")
          key_path.chmod(0600)

          # Re-stat the file to get the new mode, and verify it worked
          stat = key_path.stat
          if FileMode.from_octal(stat.mode) != "600"
            raise Errors::SSHKeyBadPermissions, key_path: key_path
          end
        end
      rescue Errno::EPERM
        # This shouldn't happen since we verify we own the file, but
        # it is possible in theory, so we raise an error.
        raise Errors::SSHKeyBadPermissions, key_path: key_path
      end

      # Halts the running of this process and replaces it with a full-fledged
      # SSH shell into a remote machine.
      #
      # Note: This method NEVER returns. The process ends after this.
      #
      # @param [Hash] ssh_info This is the SSH information. For the keys
      #   required please see the documentation of {Machine#ssh_info}.
      # @param [Hash] opts These are additional options that are supported
      #   by exec.
      def self.exec(ssh_info, opts={})

View on GitHub (pinned to 35f3160f4a)

Solutions

1. Move the project/VAGRANT_HOME to a POSIX filesystem (ext4/xfs) and retry — exactly what the error text recommends
2. If the mount can enforce modes, remount with suitable options and pre-set the key to 600 manually
3. On WSL, keep keys on the Linux filesystem (~) rather than /mnt/c

Example fix

# before: VAGRANT_HOME on a FAT USB stick
$ VAGRANT_HOME=/media/usb/vagrant.d vagrant ssh   # SSHKeyBadPermissions

# after: move data to a POSIX filesystem
$ mv /media/usb/vagrant.d ~/.vagrant.d
$ vagrant ssh

require 'fileutils'

def key_mode_ok?(path)
  (File.stat(path).mode & 0o777) == 0o600
end

FileUtils.chmod(0o600, key) unless key_mode_ok?(key)
abort "filesystem ignores chmod; move the key off #{File.dirname(key)}" unless key_mode_ok?(key)

begin
  Vagrant::Util::SSH.check_key_permissions(Pathname.new(key))
rescue Vagrant::Errors::SSHKeyBadPermissions => e
  warn e.message
  raise 'move VAGRANT_HOME/project to a filesystem that honors chmod'
end

When it happens

Trigger: VAGRANT_HOME, the project, or the key directory living on vfat/exFAT/NTFS or a network mount where chmod(2) is a no-op; `vagrant ssh` fails after the automatic correction attempt verifies the mode is still not 0600.

Common situations: Vagrant data on a USB stick; Windows drives mounted into WSL/Linux; CIFS shares used as home directories.

Related errors

• The private key to connect to the machine via SSH must be ow
• Failed to create the following shared folder on the host sys
• The home directory you specified is not accessible. The home
• Vagrant attempted to clean the machine folder for the machin
• The box you're attempting to add has no available version th

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/cd52d45154b080e8. Report an issue: GitHub.