Protect Alice's ~/.ssh/id_rsa.
Allow only the owner to read and write it; grant no group or other permissions.
Which mode is appropriate?
SSH private keys should not be readable by other users. Mode 600 gives the owner read/write and no group or other permissions.
Detailed explanation
chmod 644 ~/.ssh/id_rsaIncorrect. 644 allows group and other users to read the private key.
chmod 755 ~/.ssh/id_rsaIncorrect. 755 grants broad read and execute permissions.
chmod 666 ~/.ssh/id_rsaIncorrect. 666 allows every user to read and write the key.
chmod 600 ~/.ssh/id_rsaCorrect. chmod 600 ~/.ssh/id_rsa protects the key from group and others.
Try it yourself
An example you can run in a temporary verification environment.
stat -c '%a %n' ~/.ssh/id_rsaExpected result
鍵が存在すれば数値モード。変更は行わないKey points
- Mode 600
- Owner only
- Private-key protection
Notes
- Environment: OpenSSH 9.x／GNU coreutils 9.x
- Use a disposable VM or test account when validating installation and SSH behavior.
- Exact command output can vary slightly by distribution and OpenSSH version.
Foundation review
Identify the scope
Modes such as 644, 755, and 666 expose progressively broader access than a private key should have.
Check the side effect
Inspect both the key file and its parent SSH directory, then let the SSH client validate the permissions.