How Linux permissions are written
Every file has three sets of permissions — for its owner, its group and everyone else — and each set is read (r), write (w) and execute (x). As a number, read is 4, write is 2 and execute is 1, added up per set: rwx is 7, r-x is 5, r-- is 4. So 755 is rwxr-xr-x: the owner can do everything, the group and others can read and execute.
On a directory the letters mean something slightly different: read lists the names inside, write creates and deletes files inside, and execute lets you enter it and reach the files. A directory without x cannot be used even if you can read it.
The modes you will actually use
| Mode | Symbolic | Use it for |
|---|---|---|
| 644 | rw-r--r-- | Ordinary files: web content, config without secrets |
| 755 | rwxr-xr-x | Directories, scripts and binaries |
| 600 | rw------- | Private keys, .env files, credentials |
| 700 | rwx------ | ~/.ssh and other private directories |
| 640 | rw-r----- | Config a service's group must read |
| 775 | rwxrwxr-x | Directories a team shares |
| 400 | r-------- | A key that should never change, such as a .pem |
SSH is strict about permissions
OpenSSH refuses keys and config that others can read or write. If ssh -i key.pem fails with "UNPROTECTED PRIVATE KEY FILE", run chmod 600 key.pem (or 400). On the server, ~/.ssh should be 700 and ~/.ssh/authorized_keys 600, owned by the user — otherwise key login silently falls back to a password or fails.
Special bits
- setuid (4 in the first digit) — the program runs as its owner, not as whoever starts it.
passwduses it to edit/etc/shadow. - setgid (2) — on a directory, new files inherit the directory's group. Useful for a shared folder.
- sticky (1) — on a directory, only a file's owner can delete it.
/tmpis1777.
In ls -l output these replace the execute letter: s or t when execute is also set, S or T when it is not.
Avoid chmod 777
777 lets every user and every process on the server change the file. It "fixes" a permission error by removing the protection that caused it. Find out which user the process runs as — ps -o user= -p <pid> — and give that user, or its group, the access it needs with chown and a narrower mode.
Recursive changes
chmod -R 755 dir makes every file executable too. To set directories and files separately:
find /var/www/site -type d -exec chmod 755 {} +
find /var/www/site -type f -exec chmod 644 {} +Change permissions from Shipown
The file manager in Shipown browses a server, uploads and edits files, and shows what is there without leaving the app; its deploy users feature sets up keys and scoped sudo rules for a non-root account.
Frequently asked questions
What does chmod 755 mean?
The owner can read, write and execute; the group and everyone else can read and execute but not change the file. It is the usual mode for directories and scripts.
What does chmod 644 mean?
The owner can read and write; the group and everyone else can only read. It is the usual mode for ordinary files.
What permissions should an SSH private key have?
600 or 400, owned by you. OpenSSH refuses to use a private key that other users can read.
Is chmod 777 safe?
Almost never. It lets every user and process on the server modify the file. Give the specific user or group that needs access the permission instead.
What is the difference between chmod and chown?
chmod changes what the owner, the group and others may do with a file. chown changes who the owner and the group are.