gitpod-io / gitpod-io/gitpod

Unprotected private key file

Open
#6,615 8 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

component: local app editor: code (desktop) meta: never-stale team: IDE type: bug
Dominant language
TypeScript
Stars
13.8k
Forks
1.4k
Avg merge
17h 58m
Merged PRs (30d)
5

Description

Does this issue occur when all extensions are disabled?: Yes

  • VS Code Version: 1.61.2
  • OS Version: Windows 10

I'm seeing the following error when trying to open with VSCode

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> Permissions for 'c:\\tmp\\gitpod_01460b4a-fe2a-4d71-8fee-f0d065765c8a_id_rsa' ar
> e too open.
> It is required that your private key files are NOT accessible by others.        
> This private key will be ignored.
> Load key "c:\\tmp\\gitpod_01460b4a-fe2a-4d71-8fee-f0d065765c8a_id_rsa": bad perm
> issions
> gitpod@127.0.0.1: Permission denied (publickey).

The problem is with the permissions of the file gitpod_01460b4a-fe2a-4d71-8fee-f0d065765c8a_id_rsa. As the error says, permissions are too open:

image
(sorry for the spanish texts in the screenshot)

Changing the permission of the file so that only my user can access to it works, but I have to do that every time a new rsa file is being created, which is inconvenient.

Is there any other, more permanent, solution?

Thanks!!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by reproducing the SSH failure with VS Code 1.61.2 on Windows 10 and trace where the gitpod-generated RSA file is created. Done means newly created private keys are accessible only by the user and Git can connect without manual permission changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, vscode
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.