chmod 400
r--------Safe when used as intended
Only the owner can read; nobody can write or execute.
400 is the strictest useful mode: the owner can read the file, and nobody — the owner included — can write to it or execute it.
AWS's EC2 guides tell you to run chmod 400 key.pem before connecting, because ssh refuses private keys that others can read.
Permission by permission
| Who | Read | Write | Execute | Digit | Means |
|---|---|---|---|---|---|
| owner | ✓ | — | — | 4 | read only |
| group | — | — | — | 0 | no permissions |
| others | — | — | — | 0 | no permissions |
- In
ls -l:-r--------for a file,dr--------for a directory. - Symbolic form:
u=r,g=,o= - New files get this mode when the umask is
266.
Use it for
- SSH and EC2
.pemprivate keys. - Certificates' private keys and other secrets that never change.
Avoid it for
- Files you update — you'll need to chmod them first. Use
600. - Files a service must read when running as another user.
Commands
chmod 400 path
set this mode on a file or directory
chmod u=r,g=,o= path
the same, written symbolically
find path -type f -exec chmod 400 {} +apply it to every file in a tree, leaving the directories alone
stat -c '%a %A %n' path
check the current mode on Linux (macOS: stat -f '%Lp %Sp %N' path)
Try variations
| Who | read | write | execute | Digit |
|---|---|---|---|---|
| owner | 4 | |||
| group | 0 | |||
| others | 0 |
The owner can read only; the group can do nothing; everyone else can do nothing.
chmod 400 file
chmod u=r,g=,o= file
Frequently asked questions
Why does AWS say to chmod 400 my .pem file?
ssh refuses to use private keys that other users can read. 400 makes the key readable only by you, and read-only so it can't be changed by accident.