Ravindra BagaleCourses & study guides मराठी Track your progress

Chapter 3: Linux Basic Commands

3.5 Permissions

By Last updated:

Friends, most "403 Forbidden" and "Permission denied" problems come from this very topic, so pay attention. Once r, w and x are clear, half of your troubleshooting is already done.

Every file has an owner (u), a group (g) and others (o). Each can have read (r), write (w) and execute (x) permission.

Permission On a file On a directory Value
r (read) View contents List files (ls) 4
w (write) Modify contents Create/delete files inside 2
x (execute) Run as program/script Enter the directory (cd) 1

Numeric (octal) notation — add the values for each of user, group, others:

Octal Symbolic Meaning Typical use
777 rwxrwxrwx Everyone everything Avoid — insecure
755 rwxr-xr-x Owner full, others read+enter Directories, scripts, web folders
750 rwxr-x--- Owner full, group read, others nothing Private app directories
700 rwx------ Only owner ~/.ssh directory
644 rw-r--r-- Owner write, others read Web files (HTML, CSS), configs
640 rw-r----- Owner write, group read Config with passwords (wp-config.php)
600 rw------- Only owner read/write ~/.​ssh/​authorized_​keys
400 r-------- Only owner read .pem private key 
chmod 755 deploy.sh           # numeric
chmod u+x deploy.sh           # symbolic: add execute for user
chmod go-w file.txt           # remove write from group and others
chmod -R 755 /var/www/html    # recursive
chmod 400 mykey.pem           # required before using an SSH key

sudo chown nginx:nginx /usr/share/nginx/html/index.html        # owner:group
sudo chown -R www-data:www-data /var/www/html                   # Ubuntu web user
sudo chown -R apache:apache /var/www/html                       # AL2023/CentOS Apache user

Safe web permissions

A common, safe pattern: directories 755, files 644, owned by your login user or the web-server user. Set them in one go: sudo find /var/www/html -type d -exec chmod 755 {} \; and sudo find /var/www/html -type f -exec chmod 644 {} \;

For the Mauli Dairy website you need these three numbers every day: 755 for folders, 644 for HTML and CSS files, and, for the key on your laptop, .pem gets 400. All other numbers are just variations around these.

Ravindra Bagale's Tip

Before changing permissions on a live server, always run ls -l first and note down the original values. And please, never use chmod -R 777 to "fix" an error – it only hides the real problem and opens a security hole. Find out which user needs access, and give only that much access. That's all.

Ravindra Bagale's Tip

A common mistake is giving a folder 644 – then you cannot cd into it and Nginx returns 403. Remember: entering a directory needs x, so folders get 755 and files 644. After that, check the owner with ls -l.

Lab

Chala, ~/labs/mauli madhe deploy.sh banva, ls -l ne tyache permissions liha, mag chmod 755 deploy.sh aani chmod u-x deploy.sh karun pratyek veli ls -l madhe badal bagha. Shevti rwxr-x--- cha numeric value swatah kadha aani chmod ne lavun check kara.

Got it? r=4, w=2, x=1 – once you can read these three numbers and the output of ls -l, most permission problems get solved. Now let's move on to users and sudo.