chmod 700

chmod 700 sets the mode to rwx------: the owner can read, write and execute (7), and the group and everyone else get nothing (0). On a directory, only the owner can list it, enter it or add and remove files; nobody else can reach anything inside, whatever the files’ own modes say. That’s why one 700 directory protects everything under it.

Where it’s required

• ~/.ssh. OpenSSH’s manual recommends read, write and execute for the user and no access for others. sshd’s StrictModes, on by default, refuses key logins when ~/.ssh or the home directory is writable by group or others and logs Authentication refused: bad ownership or modes for directory.
• ~/.gnupg. gpg warns unsafe permissions on homedir when others have access.
• $XDG_RUNTIME_DIR (/run/user/1000): the XDG Base Directory spec requires 0700.
• PostgreSQL’s data directory. The server won’t start unless it’s 0700 or, since PostgreSQL 11, 0750, which initdb --allow-group-access creates.

Setting up ~/.ssh

mkdir -p ~/.ssh && chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519 ~/.ssh/authorized_keys ~/.ssh/config
chmod 644 ~/.ssh/id_ed25519.pub
stat -c '%a %n' ~/.ssh   # 700 /home/alice/.ssh

Don’t chmod -R 700 ~/.ssh: it gives every key an execute bit it doesn’t need. Files that aren’t programs want 600, the file equivalent of 700. mkdir -p -m 700 isn’t a substitute for the chmod: it sets nothing when the directory already exists.

Directories created private

mkdir -m 700 dir creates the directory with that mode, so there’s no moment when others can read it. A whole session can work that way with umask 077, which turns 777 into 700 for directories and 666 into 600 for files. install -d -m 700 -o app -g app /home/app/.ssh also sets the owner in one step, which suits a Dockerfile.

What 700 doesn’t do

• Root reads it anyway. Permission bits don’t bind root, or anyone who can use sudo.
• A web server can’t serve below it. A site kept in a 700 home directory gets (13: Permission denied) from nginx; the server’s user needs execute on every directory on the path.
• It doesn’t survive git. Git stores 100755 or 100644 and has no mode for directories, so a clone gives 755 and 644 under umask 022. Set the mode in the deploy step.