chmod go-w
chmod go-w removes the write bit from the group (g) and others (o) and leaves the owner's bits and all read and execute bits untouched, so 777 becomes 755 and 666 becomes 644.
Results on common starting modes
| Before | After |
|---|---|
777 rwxrwxrwx | 755 rwxr-xr-x |
775 rwxrwxr-x | 755 rwxr-xr-x |
666 rw-rw-rw- | 644 rw-r--r-- |
664 rw-rw-r-- | 644 rw-r--r-- |
1777 rwxrwxrwt | 1755 rwxr-xr-t |
Fixing SSH key logins
With StrictModes on (the default), sshd refuses public key authentication when your home directory, ~/.ssh or authorized_keys is writable by group or others, and logs "Authentication refused: bad ownership or modes". Removing that write access is the whole fix; you do not need to change read bits.
chmod go-w ~ ~/.ssh ~/.ssh/authorized_keys
# stricter, as ssh(1) recommends:
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keysCleaning up after 777
go-w is the least disruptive way to undo a chmod -R 777 or files extracted with world-writable modes: it removes the dangerous part and keeps execute on the scripts and directories that had it, which a blanket 755 or 644 would get wrong. Directories with the sticky bit keep it.
chmod -R go-w /var/www/site
find /var/www/site -perm -o+w # anything still world-writable?Frequently asked questions
- What does chmod go-w mean?
- g is the group, o is others, - removes, w is write: take write permission away from everyone except the owner.
- Is chmod go-w the same as chmod 755?
- On a 777 directory, yes. On other modes it differs: go-w keeps the current read and execute bits, while 755 sets them all.
- How do I find world-writable files?
- find /path -type f -perm -o+w lists files others can write; use -type d for directories, and add ! -perm -1000 to skip sticky directories like /tmp.
Last reviewed by Arielton Oberek.