Unix file permissions explained — chmod, octal, ls -l & umask

The problem

Permissions only come up when something is already broken.

Nobody studies file modes for fun. You meet them at the worst moment: a deploy script that won't run, a web server throwing 403 Forbidden, or SSH slamming the door on the key you've used for months. The terminal answers in a code you half-remember — and the top search result cheerfully suggests chmod 777, which “fixes” it by handing write access to every user and process on the machine.

$ ssh -i ~/.ssh/id_ed25519 deploy@server
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@   WARNING: UNPROTECTED PRIVATE KEY FILE!      @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '~/.ssh/id_ed25519' are too open.
It is required that your private key files are
NOT accessible by others.

The message even names the culprit — 0644 — but only helps if you can read it. That's the whole gap this page closes.

The core idea

It's just nine switches. Each row of three is one octal digit.

A classic mode is a 3×3 grid: rows for owner, group and others; columns for read, write and execute. Weight the columns 4, 2, 1 and add up each row — that sum is the digit. Three rows, three digits: a mode.

• Owner rwx 4 + 2 + 1 7 Owner: read, write and execute all set — 4 plus 2 plus 1 equals 7.
• Group rwx 4 + 0 + 1 5 Group: read and execute set, write withheld — 4 plus 0 plus 1 equals 5.
• Others rwx 4 + 0 + 1 5 Others: read and execute set, write withheld — 4 plus 0 plus 1 equals 5.

= 755 rwxr-xr-x

One honest wrinkle: on a directory, x doesn't mean “run it” — it means enter and traverse it. permbits has a file / directory switch precisely because the plain-English meaning changes.

Reading the wire format

An ls -l mode field, pulled apart character by character.

The cryptic 10-or-11 character string at the start of every ls -l line is the same grid again, flattened — plus a type character in front and, sometimes, extra letters. Here's a spicy one: a shared project directory.

Paste any such line — or a whole ls -l row — into permbits and it renders the grid, the octal, the special bits (s/S/t/T) and a plain-English sentence per class.

Back to that SSH key

The fix is two switches. Watch 644 → 600.

0644 means group and others can read your private key. OpenSSH refuses to use it until they can't. So: flip off the two read switches that don't belong to you.

chmod 600 ~/.ssh/id_ed25519

Animation: on the 644 grid, the group-read and others-read switches turn off, leaving 600 — owner read and write only.

Where defaults come from

umask: the bits your system withholds from every new file.

New files don't get their mode by magic. The system starts from 666 for files and 777 for directories, then subtracts whatever your umask lists. That's the whole trick:

022 withholds write from group and others — the everyday default. 077 withholds everything from everyone but you. permbits has a umask panel with the arithmetic spelled out and one-tap 022/002/077.