If OpenSSH inside your WSL distribution rejects a private key with a warning that its permissions are “too open,” the fix depends on where the key file lives. Microsoft documents one fix for the warning: enabling WSL automount metadata. That fix changes how Windows files appear inside WSL, so it is not a universal repair. For keys that belong to the Linux side, keeping them in the WSL home directory avoids the problem entirely. Windows OpenSSH, meaning the Windows client, agent, and server, is a separate environment with its own key files, services, and access rules.
What the permissions warning means
OpenSSH checks the file mode of a private key before it will use it. The warning Microsoft uses as its example reads:
Permissions 0777 for '/home/user/.ssh/private-key.pem' are too open.The number is a Unix file mode. 0777 means read, write, and execute for the owner, the group, and everyone else. The message is a refusal to trust the file’s permissions. It does not mean the key has been read or copied by anyone. Its real risk is that a private key with loose permissions can be exposed on a shared system, so the warning is worth fixing rather than bypassing.
The source of the open mode matters. Microsoft’s WSL troubleshooting guidance addresses this warning for keys on Windows-mounted paths. Keys stored in the WSL Linux filesystem use Linux permission bits directly, so the fix there is a normal chmod.
Recommended Free Tools
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Where the key lives changes the fix
WSL can reach two kinds of storage, and they behave differently. Microsoft’s WSL file-permissions page states that files on Windows drives are governed by Windows permissions, and WSL maps those permissions to Linux behavior. The table below summarizes the cases.
| Key location | Who controls the permissions | Typical approach | Trade-off |
|---|---|---|---|
WSL Linux home, for example ~/.ssh |
Linux permission bits inside the distribution’s filesystem | Set the directory to 700 and the key to 600 with chmod |
Keys are inside the distribution, so Windows applications cannot open them directly, and backups must include the WSL filesystem |
Windows-mounted path such as /mnt/c/Users/<name>/.ssh without metadata |
Windows ACLs; WSL presents a mapped permission value | Move or copy the key into the WSL home directory | The key is then a separate copy, so you must keep the two in sync or remove the Windows copy |
Windows-mounted path with metadata enabled |
Linux permission values stored as extended attributes on the Windows NT files | Set automount options in /etc/wsl.conf |
Changes permissions for Windows files seen from WSL, not only the key |
Microsoft’s WSL FAQ addresses the confusion behind many of these problems. Its question “How do I use my Windows Git permissions in WSL?” reflects the same point: Windows files are available from WSL, and their permissions are controlled by Windows, so a chmod inside WSL does not necessarily change what Windows enforces. The FAQ on Windows Subsystem for Linux covers this behavior.
Option 1: Enable metadata for a key on a Windows-mounted path
Use this route when the key must stay on a Windows-mounted drive. The steps follow Microsoft’s example in the WSL troubleshooting article.
- Inside the distribution, find your user and group IDs. Run
id -uandid -gand note both numbers. - Open the WSL configuration file with administrator rights:
sudo nano /etc/wsl.conf. - Add an
[automount]section. Microsoft’s example is:[automount] enabled = true options = metadata,uid=1000,gid=1000,umask=0022Replace
uidandgidwith the values from step 1. The1000values are only Microsoft’s example and do not suit every user. - From Windows, open PowerShell or Command Prompt and run
wsl --shutdown. Then start your distribution again so the new options take effect. - Check the key from inside WSL with
ls -l ~/path/to/key, then set the mode if needed withchmod 600.
Before you enable metadata, consider the side effect. The documentation says that enabling this option modifies the file permissions for Windows files as seen from WSL. Other project files on the same drive can change their apparent permissions, and Windows applications that depend on those files may behave differently. If the drive holds a large working tree, test the change on a single folder first or prefer Option 2.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Option 2: Keep the key in the WSL Linux filesystem
For a key used only from WSL, the Linux home directory is the simplest place. Linux permission bits apply there directly, and the mounted-drive permission translation does not come into play. Microsoft does not prescribe this as the only correct location, so choose it when it matches your workflow and backup habits. The general OpenSSH convention is shown below.
- Create the directory and restrict it:
mkdir -p ~/.sshfollowed bychmod 700 ~/.ssh. - Copy the key into it, for example
cp /mnt/c/Users/<name>/.ssh/id_ed25519 ~/.ssh/. Replace the file name and path with your own. - Restrict the private key:
chmod 600 ~/.ssh/id_ed25519. - Test the connection with
ssh -v user@host. The verbose output shows which key file OpenSSH tries.
After copying, the Windows original and the WSL copy are two separate files. If you rotate or replace the key, update both or remove the one you no longer use. Confirm that your backup covers the WSL copy as well.
Key concepts: public keys, private keys, and passphrases
Public-key authentication uses a pair. The private key stays with the client, and the public key is installed on the server. Sharing the public key does not expose the private key. Microsoft’s Key-Based Authentication in OpenSSH for Windows page states the principle directly: “Each private key file is the equivalent of a password and should stay protected under all circumstances.”
Treat the private key file as a credential. A passphrase protects a generated private key and becomes part of the authentication process, but it does not make the file safe to disclose. If the private key is lost, the practical recovery is to generate a new key pair and update each server that trusts the old public key. Keep a secure backup of the private key so that you do not face that step.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
ssh-agent inside WSL and the Windows ssh-agent service
The OpenSSH ssh-agent holds private keys in memory for public-key authentication, and ssh-add loads a key into it. The agent is a convenience for using keys during a session. It does not replace file permissions and is not a reason to leave a key file loosely protected.
Two agents can exist on one Windows machine, and they are separate processes:
- Linux agent inside WSL: started from the distribution’s shell and reached only from that shell session. Loading a key here does not load it into the Windows agent.
- Windows
ssh-agentservice: a Windows service that Microsoft’s key-management page says can be enabled and loaded withssh-add. Keys in this agent are handled in the security context of the Windows account. The page gives PowerShell instructions for enabling the service; those steps apply to Windows, not to a Linux distribution.
When a Windows agent instruction appears in a WSL tutorial, check which environment it applies to before running it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Windows OpenSSH is a separate configuration context
The Windows OpenSSH documentation applies when the Windows machine is the SSH server, or when you deliberately use the Windows client and agent. Its rules are not the same as the rules for a WSL client. Three Windows-specific points matter:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
- Default server key file: standard users have their keys read from
.ssh/authorized_keysin their profile. - Administrator-group keys: administrator-group accounts use
%programdata%/ssh/administrators_authorized_keys. The file’s ACL must restrict access to SYSTEM and BUILTINAdministrators, as Microsoft’s OpenSSH Server Configuration for Windows page documents. - Account and feature limits: key-based Windows OpenSSH authentication supports local Windows and Active Directory accounts, but not Microsoft Entra ID accounts. Windows OpenSSH also does not support
AuthorizedKeysCommandorAuthorizedKeysCommandUser.
A Windows ACL change does not fix Linux permissions inside a WSL distribution, and a chmod inside WSL does not change the ACL on a Windows server’s administrators_authorized_keys. Each environment needs its own fix.
Version applicability is also Windows-specific. Microsoft’s OpenSSH overview, last updated 2025-02-20, lists Windows 10, Windows 11, and Windows Server releases. The key-management page, last updated 2025-10-03, covers the same Windows families. WSL distributions can package their own OpenSSH version and configuration, so the Windows documentation may not describe a given distribution’s behavior exactly.
Troubleshooting checklist
Connection failures have several possible causes. Work through them in this order before you change WSL settings.
- Identify the roles. Note which machine is the SSH client, which is the server, and which OpenSSH implementation each one runs.
- Identify the account. Confirm the username used to log in and whether that account is a standard user or in the administrator group on a Windows server.
- Check the server’s
authorized_keysfile. Microsoft’s troubleshooting article on OpenSSH client connections lists a missing or incorrectauthorized_keysfile and improper permissions as common causes of authentication failure. - Check the client’s private key mode. If OpenSSH prints the
too openwarning, use Option 1 or Option 2 above. - Check the actual path and mode or ACL. Record the exact path and the output of
ls -linside WSL, or the ACL on the Windows server file, before changing anything.
Keep the Windows and WSL checks separate. A permission fix that works on a WSL key is not evidence that the Windows server file is correct, and the reverse holds too.
For WSL-specific troubleshooting, the Troubleshooting Windows Subsystem for Linux page provides the documented permission example and the automount settings used above.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
