chmod go-rwx
Removes all permissions for group and others, keeping the owner's.
chmod go-rwx path takes read, write and execute away from the group and everyone else, and doesn't touch the owner's bits.
That makes it work on files and directories alike: a 644 file becomes 600, and a 755 directory becomes 700.
What it changes
-rw-r--r-- (644)-rw------- (600)a 644 file becomes 600
Examples
chmod go-rwx ~/.ssh/id_ed25519
make a private key private
chmod -R go-rwx ~/.ssh
the whole directory: keys become 600, the directory 700
chmod o-rwx report.pdf
others only; the group keeps its access
chmod go= secrets.env
the same as go-rwx, written as "set to nothing"
Good to know
- OpenSSH refuses private keys that group or others can read, with "UNPROTECTED PRIVATE KEY FILE" and "Permissions 0644 … are too open". This fixes it.
- Unlike
chmod 600, it doesn't add or remove anything for the owner, so it's safe on directories and on files the owner needs to execute. - To keep new files private from the start, set
umask 077in the shell or service that creates them.
Frequently asked questions
What does chmod go-rwx mean?
g (group) and o (others), - (remove), rwx (read, write and execute). It strips every permission from everyone except the owner.
Is chmod go-rwx the same as chmod 600?
Only for a file whose owner has rw-. chmod 600 sets the whole mode; go-rwx keeps whatever the owner had, so a 755 directory becomes 700 instead of an unusable 600.