chmod 400 (r--------)
chmod 400 sets r--------: the owner can read the file but not change it, and nobody else has any access. It is often used for SSH private keys, such as the .pem key downloaded for an EC2 instance.
chmod 400 = r--------: owner read, everyone else nothing.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 4 | |||
| Group | 0 | |||
| Others | 0 | |||
| Special | 0 |
4Owner (user): 4 = 4 read0Group: 0 = no permissions0Others: 0 = no permissions
On a file
- Owner (user) read it
- Group no access
- Others no access
On a directory
- Owner (user) list the names inside (names only: without x the files cannot be opened or even stat'ed)
- Group no access
- Others no access
chmod 400 filechmod u=r,go= filels -l → -r--------
What to know
OpenSSH's rule for private keys is that the key file must not be accessible by group or others; any mode where the last two digits are 0 passes. So 400 and 600 both work. 400 adds protection against overwriting the key by accident.
The rules for the other files are looser. With StrictModes (the default), sshd ignores authorized_keys if that file, ~/.ssh or the home directory is writable by group or others, or owned by someone other than you or root. Read access for others is allowed there; 700 for ~/.ssh and 600 for authorized_keys are the recommended values.
Where it fits
- SSH private keys you never edit, such as a cloud provider's
.pemkey - Certificates, license files or exported secrets that should not change
- Files you want to guard against an accidental overwrite
Gotchas
- 400 does not stop the owner from deleting the file: deleting depends on write permission on the directory, not on the file. The owner can also
chmodit back at any time. - Root ignores these bits, and some editors offer to override a read-only file. 400 is a guard against mistakes, not a security boundary against yourself.
- Tools that rewrite their own files (for example
ssh-keygen -pto change a passphrase) may fail until you restore write permission withchmod u+w.
Related explainers
- chmod 600 (rw-------)chmod 600 makes a file readable and writable by its owner only. The right mode for SSH private keys, .env...
- chmod 700 (rwx------)chmod 700 gives the owner full access and everyone else none. The usual mode for ~/.ssh, ~/.gnupg and...
- 600 vs 644600 makes a file readable by its owner only; 644 lets every user read it. Which to use for SSH keys, .env...