Chapter 3: Linux Basic Commands
3.5 Permissions
This is the topic where most "403 Forbidden" and "Permission denied" problems come from, so dhyan do. Once you understand r, w and x properly, half of your troubleshooting is already done.
Every file has an owner (u), a group (g) and others (o). Each can have read (r), write (w) and execute (x) permission.
| Permission | On a file | On a directory | Value |
|---|---|---|---|
| r (read) | View contents | List files (ls) |
4 |
| w (write) | Modify contents | Create/delete files inside | 2 |
| x (execute) | Run as program/script | Enter the directory (cd) |
1 |
Numeric (octal) notation — add the values for each of user, group, others:
| Octal | Symbolic | Meaning | Typical use |
|---|---|---|---|
| 777 | rwxrwxrwx |
Everyone everything | Avoid — insecure |
| 755 | rwxr-xr-x |
Owner full, others read+enter | Directories, scripts, web folders |
| 750 | rwxr-x--- |
Owner full, group read, others nothing | Private app directories |
| 700 | rwx------ |
Only owner | ~/.ssh directory |
| 644 | rw-r--r-- |
Owner write, others read | Web files (HTML, CSS), configs |
| 640 | rw-r----- |
Owner write, group read | Config with passwords (wp-config.php) |
| 600 | rw------- |
Only owner read/write | ~/.ssh/authorized_keys |
| 400 | r-------- |
Only owner read | .pem private key |
chmod 755 deploy.sh # numeric
chmod u+x deploy.sh # symbolic: add execute for user
chmod go-w file.txt # remove write from group and others
chmod -R 755 /var/www/html # recursive
chmod 400 mykey.pem # required before using an SSH key
sudo chown nginx:nginx /usr/share/nginx/html/index.html # owner:group
sudo chown -R www-data:www-data /var/www/html # Ubuntu web user
sudo chown -R apache:apache /var/www/html # AL2023/CentOS Apache user
Safe web permissions
A common, safe pattern: directories 755, files 644, owned by your login user or the web-server user. Set them in one go:
sudo find /var/www/html -type d -exec chmod 755 {} \; and sudo find /var/www/html -type f -exec chmod 644 {} \;
Ravindra Bagale's Tip
Before changing permissions on a live server, always run ls -l first and note the original values. And please, never use chmod -R 777 to "fix" an error — it only hides the real problem and opens a security hole. Find which user needs access, then give exactly that access. Bas itna hi.