Permissions decide who can read, change, or run each file. Wrong permissions are one of the most common weaknesses you will fix in a hardening exercise. Practice these commands only on your own VM, from a snapshot.

Reading a permission string

Run ls -l and you will see something like this:

-rw-r----- 1 alex staff 2048 Nov 9 10:00 notes.txt
drwxr-xr-x 2 root root  4096 Nov 9 10:00 shared

The first character is the type (- file, d directory). The next nine characters are three groups of three: owner, group, and others. In each group:

  • r = read (value 4)
  • w = write (value 2)
  • x = execute, or enter for a directory (value 1)

So rw-r----- means the owner can read and write, the group can read, and everyone else gets nothing. Adding the values gives the octal form: rw- is 6, r-- is 4, --- is 0, so this file is mode 640.

Changing permissions with chmod

chmod 640 notes.txt        # numeric mode
chmod u+x script.sh        # symbolic: give the owner execute
chmod go-w shared/         # remove write from group and others
chmod -R 750 /srv/project  # recursive, use carefully

Common safe modes: 644 for ordinary files, 755 for programs and directories, 600 for private files like SSH keys, and 700 for private directories. Avoid 777 (everyone can do everything) unless a scenario explicitly requires it; it is almost always a finding to fix.

Changing ownership with chown and chgrp

sudo chown alex notes.txt            # change the owner
sudo chown alex:staff notes.txt      # change owner and group
sudo chgrp developers shared/        # change the group only
sudo chown -R www-data:www-data /var/www/html

Only root can give a file away to another owner. Files that should belong to root, such as /etc/shadow, must not be owned by a normal user.

Files worth auditing

  • /etc/shadow should be 640 or tighter, owned by root (group shadow on Debian and Ubuntu).
  • /etc/passwd should be 644, owned by root.
  • ~/.ssh should be 700 and private keys 600.
  • World-writable files and directories are risky:
find / -xdev -type f -perm -0002 2>/dev/null     # world-writable files
find / -xdev -type d -perm -0002 ! -perm -1000 2>/dev/null

Directories like /tmp use the sticky bit (1777, shown as t), which stops users from deleting each other’s files.

The setuid bit (4xxx) makes a program run as its owner. A few are normal, such as passwd, but an unexpected setuid file is suspicious. List them with find / -perm -4000 -type f 2>/dev/null and research anything you do not recognize before changing it.

Check your understanding

What octal mode equals rwxr-xr–?

  • 754
  • 644
  • 775
  • 700

Answer: 754 Owner rwx is 7, group r-x is 5, others r– is 4.

Which command makes a private SSH key readable and writable only by its owner?

  • chmod 777 id_rsa
  • chmod 600 id_rsa
  • chmod 644 id_rsa
  • chown 600 id_rsa

Answer: chmod 600 id_rsa Mode 600 gives the owner read and write and gives everyone else nothing.

What does sudo chown alex:staff notes.txt do?

  • Changes the file mode
  • Sets the owner to alex and the group to staff
  • Deletes notes.txt
  • Adds alex to staff

Answer: Sets the owner to alex and the group to staff The part before the colon is the user and the part after is the group.

Why is a world-writable file a hardening concern?

  • It uses more disk space
  • Any user on the system can modify it
  • It cannot be read
  • It is always a virus

Answer: Any user on the system can modify it If any user can change a file, an attacker or mistake can alter configuration or data.

PreviousNext