diff --git a/CHANGES.rst b/CHANGES.rst
index b289720..5b0ba33 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -1,6 +1,7 @@
 UNRELEASED
 ----------
 
+- Log error when OnionBalance does not have permission to read a private key. #34
 - Fix bug loading descriptors when an address with .onion extension is listed
   in the configuration file. #37
 - Add support for connecting to the Tor control port over a unix domain socket.
diff --git a/onionbalance/settings.py b/onionbalance/settings.py
index 9bfd327..c1735e3 100644
--- a/onionbalance/settings.py
+++ b/onionbalance/settings.py
@@ -59,13 +59,17 @@ def initialize_services(controller, services_config):
     for service in services_config:
         try:
             service_key = util.key_decrypt_prompt(service.get("key"))
-        except OSError as e:
+        except (IOError, OSError) as e:
             if e.errno == errno.ENOENT:
                 logger.error("Private key file %s could not be found. "
                              "Relative paths in the config file are loaded "
                              "relative to the config file directory.",
                              service.get("key"))
                 sys.exit(1)
+            elif e.errno == errno.EACCES:
+                logger.error("Permission denied to private key %s.",
+                             service.get("key"))
+                sys.exit(1)
             else:
                 raise
         # Key file was read but a valid private key was not found.