Owner can read and write. Group can do nothing. Others can do nothing.
| Read | Write | Execute | |
|---|---|---|---|
| Owner | ✓ | ✓ | – |
| Group | – | – | – |
| Others | – | – | – |
Typical use
Private files such as SSH keys and .env files.
Good to know
600 (rw-------) gives the owner read and write and nobody else anything. It is the expected mode for SSH private keys: OpenSSH refuses a key that group or others can access, printing “UNPROTECTED PRIVATE KEY FILE” and “bad permissions”, because any local user could copy a readable key. Fix it with chmod 600 ~/.ssh/id_ed25519; 400 works too.
Use 600 for .env files, ~/.netrc, ~/.pgpass (psql ignores it when group or others can read it), cloud credentials and other secrets read only by their owner. If a service runs as another user, 600 locks it out, so use 640 with a shared group instead. Setting umask 077 in a shell or script makes new files come out as 600 by default.
Commands
| Set the mode | chmod 600 file |
|---|---|
| The same with letters | chmod u=rw,g=,o= file |
| A folder and everything in it | chmod -R 600 folder |
| Only the folders inside | find folder -type d -exec chmod 600 {} + |
| How ls -l shows it | -rw------- |