Britixo CRMBritixo CRMEnterprise Help Centre
Ctrl K
Shared server guidance · Question & answer

How do I inspect and tighten a private SSH key’s Windows permissions?

A private key should be readable only by the authorised Windows identity and any required trusted system principals. Inspect the ACL first. Fix the individual key file rather than changing permissions across your profile or drive.

IntermediateWindows 11 with Microsoft OpenSSH Client; Windows PowerShell 5.1 or PowerShell 7 as labelledLinux VPS and dedicated servers where a remote Linux command is shown

Britixo Help Centre · Updated

Go to the answer

Instructions

1. Inspect the key and current owner identity

Use the private-key path, but do not print the key contents.

Local Windows PowerShell
$KeyFile = "$env:USERPROFILE\.ssh\server_ed25519"
icacls.exe $KeyFile
(Get-Acl -LiteralPath $KeyFile).Owner
$KeyOwnerSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value

Compare the displayed file owner with the intended current user before proceeding. The ACL shows grants; the SID identifies the current account independently of display language.

2. Remove inherited grants only when appropriate

After confirming ownership, replace the current user’s grant with read access and remove inherited grants from this file.

Local Windows PowerShell
icacls.exe $KeyFile /inheritance:r /grant:r ('*' + $KeyOwnerSid + ':R')

This affects the named key file. Explicit grants for other accounts remain and must be reviewed individually; this command is not a complete ACL reset.

3. Reinspect and test

Remove any remaining unauthorised explicit grants only after identifying their purpose. Preserve required system policy and check that SSH can still read the key.

Local Windows PowerShell
icacls.exe $KeyFile
ssh -o IdentitiesOnly=yes -i $KeyFile adminuser@203.0.113.10

Confirm both the resulting ACL and the real authentication outcome.

Check the result

  • No unintended account retains read access to the private-key file.
  • The intended Windows user can still authenticate with it.

Troubleshooting

Access denied while changing the ACL
Check the file owner and use an authorised administrator if needed.
SSH still reports bad permissions
Inspect remaining explicit grants and confirm that SSH is using this exact key path.

Official references

Use the documentation for your installed version when a flag, service name or platform feature differs.