I spent a genuinely stupid ten minutes at my own desk re-typing an SSH passphrase I was certain I knew, getting bounced every single time, convinced I'd somehow forgotten a key I'd used that morning. I hadn't. The key file had ended up at mode 0644 — readable by every account on the box — and ssh was refusing to touch it. That's the part that fooled me: SSH treats a private key the group or world can read as compromised and ignores it outright, and depending on the client the rejection can look like an ordinary auth failure, so you blame your fingers instead of the permission bits.
Once I went looking, the key wasn't the only thing I'd left careless. A scan turned up files sitting world-writable that I'd chmod 777'd at some point to make a problem go away and never tightened back. On my own single-user box the blast radius was small, but the habit is the kind that quietly becomes a hole the moment anything else can run code as another user. The script below is the audit I now run against a directory to surface world-writable files before they surface as an incident — and to remind me what the correct modes actually are, which was the part I wasn't willing to keep guessing at.
The permission audit I run on my own files now
Paste this into a file called permissions-audit.sh. It scans a target directory for world-writable files and saves a report when it finds them.
What this script checks
find "$SCAN_DIR" -perm "$DANGEROUS_PERMS" -type f searches for files with exact 777 permissions. Those files are world-writable, which means any user or compromised process can overwrite them.
Running the audit
Step 1 — Create the script file
Paste the script above, then press Ctrl+X → Y → Enter to save.
Step 2 — Set your scan directory
The script accepts a directory as an argument. No editing required — just pass the path when you run it:
| Target directory | What it scans |
|---|---|
/var/www | Web server files — the most common audit target |
/home | All user home directories |
/etc | System config files — should never be world-writable |
/srv | Hosted application data |
Step 3 — Make it executable and run the audit
If any 777 files are found, you will see:
If nothing is found, you get a clean result:
Step 4 — Fix flagged files
For each file in the report, apply the correct permission based on its type:
Run the audit again after fixing to confirm the report is clean:
chmod Basics
Octal mode
7 = rwx (read+write+execute) 6 = rw- (read+write) 5 = r-x (read+execute) 4 = r-- (read only) 0 = --- (no permissions)
Format: chmod [owner][group][other] file
Symbolic mode
Common Permission Patterns
| Pattern | Octal | Use Case |
|---|---|---|
| rw-r--r-- | 644 | Regular files, configs, web assets |
| rwxr-xr-x | 755 | Directories, executables, scripts |
| rw------- | 600 | SSH private keys, secrets |
| rwx------ | 700 | Private directories |
| rw-rw-r-- | 664 | Shared group files |
Recursive Changes
Recursive permission changes are where people usually break deploys. Directories need the execute bit so users and processes can enter them.
Never use chmod -R 777
chmod -R 777 makes everything world-writable. On a shared server or web host, that means anyone who can run code as another user can overwrite your files, plant backdoors, or break your app.
Auditing with find
find is the permission audit tool you already have installed. These searches help you spot dangerous files before they become incidents.
chown — Changing Ownership
Permissions decide what the owner, group, and everyone else can do. chown changes who the owner and group are.
The permission traps that bite hardest
Never use chmod -R 777
chmod -R 777 makes everything world-writable. On a shared server or web host, that means anyone who can run code as another user can overwrite your files, plant backdoors, or break your app.
Safe permissions to memorize
SSH private keys must be 600 — SSH will refuse to use them otherwise. Web files: 644 for files, 755 for directories. Use find + -exec instead of chmod -R to avoid breaking directory execute bits. Audit world-writable files on new servers immediately.
Frequently Asked Questions
How do I find world-writable files in Linux?
Run: find / -perm -o+w -type f 2>/dev/null. The -o+w flag matches any file where the "other" category has write permission. On a web server, scope it to the web root: find /var/www -perm -o+w -type f.
What file permissions should a web server use?
Files should be 644 (owner can read/write, everyone else read-only). Directories should be 755 (owner can enter and write, others can only enter and read). Never use 777 on a shared or internet-facing server.
How do I fix file permissions recursively without breaking directories?
Use two find commands — one for files, one for directories:
chmod -R 644 breaks directories by removing their execute bit, which prevents anyone from entering them.
What is a SUID file and why is it a security risk?
SUID (Set User ID) means the file runs as its owner's permissions rather than the caller's. On a root-owned binary, that means any user who can run it gets root-level access for that execution. Find them with: find / -perm -4000 -type f 2>/dev/null.
What does chmod 600 do?
chmod 600 gives the file owner read and write permission, and removes all access from the group and others. It is the required permission for SSH private keys — SSH will refuse to use a key with looser permissions. After setting correct key permissions, the SSH key setup script handles generating the key pair and copying the public key to remote servers.
Part of the Linux Security collection
