chmod 600
chmod 600 sets rw-------: the owner can read and write the file, and the group and every other account can neither read, write nor execute it.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | No | 6 |
| Group (g) | No | No | No | 0 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read and modify | List names only; write does nothing without execute |
| Group (g) | No access | No access |
| Others (o) | No access | No access |
Facts
| Octal | 600 (0600) |
|---|---|
| Symbolic | rw------- |
| ls -l, file | -rw------- |
| ls -l, directory | drw------- |
| Equivalent symbolic command | chmod u=rw,go= |
| Default umask that creates it | umask 077 for new files |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- SSH private keys, ~/.ssh/authorized_keys and ~/.ssh/config: the ssh(1) manual says private keys must not be accessible by others, or ssh ignores them.
- Credential files that clients check: PostgreSQL ignores ~/.pgpass unless it denies all access to group and others, and curl and ftp read ~/.netrc, which should be 600.
- It is what new files get under umask 077.
When not to use it
- Files a service must read under a different account: nginx cannot read a 600 certificate or config owned by your user. Use 640 with the service group.
- Scripts you run: 600 has no execute bit, so ./script fails. Use 700.
Commands
chmod 600 ~/.ssh/id_ed25519
chmod u=rw,go= ~/.ssh/id_ed25519 # same resultstat -c '%a %A %n' ~/.ssh/id_ed25519 # Linux (GNU stat): 600 -rw-------
stat -f '%Lp %Sp %N' ~/.ssh/id_ed25519 # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 700 and files to 600 separately:
find . -type d -exec chmod 700 {} +
find . -type f -exec chmod 600 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rwX,go= ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 600 mean?
- Owner 6 (read 4 + write 2), group 0, others 0. Only the owner can open the file.
- Should an SSH key be 600 or 400?
- Both are accepted by ssh. 600 lets you edit the key (for example ssh-keygen -p to change its passphrase); 400 also guards against your own accidental writes.
- How do I fix "Permissions are too open" for my key?
- Run chmod 600 ~/.ssh/id_ed25519 (use your key file name). If the key is on a Windows or FAT-formatted drive where modes cannot be stored, copy it into ~/.ssh first.
Last reviewed by Arielton Oberek.