Reading and setting file permissions on your VPS correctly
Every file and folder on your VPS has an owner, a group and permissions. If they're too loose, a hacked website or service can write anywhere. If they're too strict, you'll get errors like "Permission denied" or a 403 on your website. Here you'll learn how to read permissions and set them correctly. If you have a hosting package with DirectAdmin, take a look at Forbidden (403): You don't have permission to access / on this server.
Reading permissions with ls -l
ls -l /var/www/example.com -rw-r--r-- 1 anna www-data 1520 index.html -rw-r----- 1 anna www-data 412 config.php drwxr-xr-x 2 anna www-data 4096 images drwxrwxr-x 2 www-data www-data 4096 uploads
The first character is the type: - is a file, d a folder, l a symbolic link. Then come three groups of three characters: what the owner can do, what the group can do and what everyone else can do. After that you'll see the owner (anna) and the group (www-data).
| Letter | On a file | On a folder |
|---|---|---|
r | Read | List the names in the folder |
w | Modify | Create, rename and delete files |
x | Run as a program | Enter the folder and open files in it |
Keep two things in mind. Without x on a folder, you can't get to the files inside it, even if they're readable. And anyone with w on a folder can delete files in it, even if they belong to someone else.
Permissions as a number
Permissions are often written as three digits: r counts as 4, w as 2 and x as 1, added up per group.
| Number | Permissions | Use |
|---|---|---|
| 644 | rw-r--r-- | Regular file, for example a web page or image |
| 755 | rwxr-xr-x | Folder, or a program everyone is allowed to use |
| 640 | rw-r----- | Configuration containing a password, readable by the web server through the group |
| 600 | rw------- | Secret file, such as authorized_keys, a private key or a .env file |
| 700 | rwx------ | Private folder, such as ~/.ssh |
Changing permissions and owner
chmod 640 /var/www/example.com/config.php chmod g+w /var/www/example.com/uploads sudo chown anna:www-data /var/www/example.com/config.php
chmod changes the permissions, using a number or letters (u, g, o for owner, group and others, with + or -). chown owner:group changes the owner and group; only root can do that, so use sudo.
For an entire folder, chmod -R 644 is a well-known mistake: all subfolders lose their x and become unusable. Set folders and files separately with find:
sudo find /var/www/example.com -type d -exec chmod 755 {} +
sudo find /var/www/example.com -type f -exec chmod 644 {} +
The web server through the group
On Debian and Ubuntu, nginx and PHP-FPM run as the user www-data by default. A clean setup: you own the files, and the group is www-data. The web server can then read through the group, and write only in the folder where it really needs to, such as uploads (chmod g+w or owner www-data on just that folder). Don't give the web server write access to your PHP files.
777. That lets everyone on the server read, modify and run the file or folder. If a single website or service is ever compromised, the intruder can write anywhere 777 is set. The real problem is almost always the owner or the group: fix that instead of opening everything up.Permissions for SSH
The SSH server checks the permissions on your keys. If others can write to your .ssh folder or your home folder, it ignores your key and you'll get a password prompt again, without a clear error message. Set it like this:
chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys
If you created the folder as root for another user, also set the owner correctly, as described in Your own user with sudo. On AlmaLinux and Rocky Linux, SELinux can also block a file that has the correct permissions; for a manually created .ssh folder, restorecon -Rv ~/.ssh helps.
s instead of an x somewhere, such as on /usr/bin/passwd? That's the setuid bit: the program then runs with the owner's permissions. A few system programs need it, but never set it on a script yourself. An unexpected setuid file can point to a break-in, see Hacked? The first steps.Want to learn more? Take the free course VPS and Linux server management, lesson 3.1 Users, groups and file permissions.