What it means
chmod 700 gives the owner read, write and execute permission, and the group and others nothing at all. It's the standard mode for a private directory. In ls -l it shows as drwx------ for a directory or -rwx------ for a file.
| Who | Digit | Read | Write | Execute | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | yes | yes | yes | rwx |
| Group (g) | 0 | no | no | no | --- |
| Others (o) | 0 | no | no | no | --- |
7 is read (4) + write (2) + execute (1). The symbolic equivalent:
chmod u=rwx,go= ~/.ssh
On a directory
For a directory, the three bits mean:
- r: list the names inside (
ls). - w: create, delete and rename entries (needs
xtoo). - x: enter the directory and reach files inside by name.
So 700 means only the owner can list, enter or change the directory. Other users can't see what's in it or open any file inside, whatever the files' own modes are. A file at 644 inside a 700 directory is still unreachable to others, because they can't get through the directory.
On a file
On a file, 700 means only the owner can read, edit and run it. It suits personal scripts, especially ones that contain credentials or paths you don't want others to see. Note that a script needs read as well as execute, since the interpreter reads it; 700 has both.
Typical uses
| Path | Why 700 |
|---|---|
~/.ssh |
sshd's StrictModes rejects keys in a directory group or others can write; 700 is the conventional mode |
~/.gnupg |
GnuPG warns about "unsafe permissions" if others can access it |
| Home directories | Some distributions create them as 700 so users can't browse each other's files |
| Private script folders, backups | Keeps the contents away from other accounts |
| A service's state directory | e.g. a database data directory owned by the database user |
PostgreSQL, for example, refuses to start if its data directory is accessible to others; it requires 700 (or 750 when group access is enabled at initdb).
The full SSH fix looks like this:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys ~/.ssh/id_ed25519
Recursive pitfalls
chmod -R 700 dir works, but it makes every file executable, which is noisy and sometimes risky (a data file with execute set can be run by mistake). The tidier version:
find dir -type d -exec chmod 700 {} +
find dir -type f -exec chmod 600 {} +
Or with the symbolic X, which adds execute only to directories and files that already have it:
chmod -R u=rwX,go= dir
700 and web servers
A home directory at 700 blocks the web server too. If nginx serves files from /home/deploy/site and /home/deploy is 700, every request gets 403 Forbidden, even if the site files are 644. Either move the site under /var/www, or let the server through the home directory with chmod 711 or chmod 750 plus group membership. You can test with sudo -u www-data ls /home/deploy/site.
Security notes
700 keeps other users out, but root can still read everything, and so can any process running as the owner. It doesn't encrypt anything. For stronger isolation, use separate accounts per service, so a compromised web app can't read the deploy user's ~/.ssh.
Related modes
- chmod 600: the mode for private files inside a 700 directory.
- chmod 711: others can pass through but not list.
- chmod 750: the group can also enter and list.
- chmod 755: everyone can enter and list.
Compare it with other modes in the chmod calculator.