# chmod go-rwx: Remove Group and Other Permissions

> Removes all permissions for group and others, keeping the owner's.

`chmod go-rwx path` takes read, write and execute away from the group and everyone else, and doesn't touch the owner's bits.

That makes it work on files and directories alike: a 644 file becomes 600, and a 755 directory becomes 700.

## What it changes

`-rw-r--r--` → `-rw-------` (a 644 file becomes 600)

## Examples

```
chmod go-rwx ~/.ssh/id_ed25519
```

make a private key private

```
chmod -R go-rwx ~/.ssh
```

the whole directory: keys become 600, the directory 700

```
chmod o-rwx report.pdf
```

others only; the group keeps its access

```
chmod go= secrets.env
```

the same as go-rwx, written as "set to nothing"

## Good to know

- OpenSSH refuses private keys that group or others can read, with "UNPROTECTED PRIVATE KEY FILE" and "Permissions 0644 … are too open". This fixes it.
- Unlike `chmod 600`, it doesn't add or remove anything for the owner, so it's safe on directories and on files the owner needs to execute.
- To keep new files private from the start, set `umask 077` in the shell or service that creates them.

## FAQ

### What does chmod go-rwx mean?

`g` (group) and `o` (others), `-` (remove), `rwx` (read, write and execute). It strips every permission from everyone except the owner.

### Is chmod go-rwx the same as chmod 600?

Only for a file whose owner has rw-. `chmod 600` sets the whole mode; `go-rwx` keeps whatever the owner had, so a 755 directory becomes 700 instead of an unusable 600.

## Related

- [chmod 600](https://www.devkult.com/chmod/600.md)
- [chmod 700](https://www.devkult.com/chmod/700.md)
- [chmod 640](https://www.devkult.com/chmod/640.md)
- [chmod -R](https://www.devkult.com/chmod/recursive.md)
- [chmod +x](https://www.devkult.com/chmod/plus-x.md)

Open the interactive page: https://www.devkult.com/chmod/go-minus-rwx