chmod 700
chmod 700 sets rwx------: the owner can read, write and execute (list, modify and enter a directory), and the group and everyone else have no access at all.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | No | No | No | 0 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | No access | No access |
| Others (o) | No access | No access |
Facts
| Octal | 700 (0700) |
|---|---|
| Symbolic | rwx------ |
| ls -l, file | -rwx------ |
| ls -l, directory | drwx------ |
| Equivalent symbolic command | chmod u=rwx,go= |
| Default umask that creates it | umask 077 for new directories |
| How Git records a file with it | 100755 (executable) |
| Special bits | None |
When to use it
- ~/.ssh: the ssh(1) manual recommends read/write/execute for the user and no access for anyone else.
- ~/.gnupg: GnuPG prints a WARNING: unsafe permissions on homedir if others can access it.
- Scripts that contain credentials or that nobody else should read or run.
- It is what mkdir produces under umask 077.
When not to use it
- Any directory on the path to files a service must read. A home directory at 700 stops nginx from serving ~/public_html.
- Shared project folders: group members get nothing.
- Private data files: the file-side twin is 600, so plain files do not carry a pointless execute bit.
The usual SSH permission set
sshd checks these modes before accepting key logins when StrictModes is on, which is the default. The home directory must not be writable by group or others, and neither may ~/.ssh or authorized_keys.
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys ~/.ssh/config ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pubCommands
chmod 700 ~/.ssh
chmod u=rwx,go= ~/.ssh # same resultstat -c '%a %A %n' ~/.ssh # Linux (GNU stat): 700 drwx------
stat -f '%Lp %Sp %N' ~/.ssh # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 700 and files to 600 separately:
find ~/.ssh -type d -exec chmod 700 {} +
find ~/.ssh -type f -exec chmod 600 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rwX,go= ~/.ssh.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100755; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 700 mean?
- Owner 7 (rwx), group 0, others 0. Only the owner (and root) can do anything with it.
- What permissions should ~/.ssh have?
- 700 for the directory, 600 for private keys, authorized_keys and config, and 644 for .pub files.
- Is 700 or 600 right for a file?
- 700 for scripts and programs you run, 600 for data such as keys and config files. The only difference is the owner execute bit.
Last reviewed by Arielton Oberek.