Anyone who has worked with SSH private keys has run into an instruction to "set it to 600." Config files, by contrast, often get 644, and executable scripts get
755.
What do these three-digit numbers actually mean, and why does the right number depend on what kind of file you're dealing with?
This post starts from the mechanics of Unix-style (Mac/Linux) file permissions and works up to the design principle behind them: least privilege.
Permissions as a 2D grid of who and what Unix-family operating systems express file access as a grid: three kinds of "who" crossed with three kinds of "what." "Who" breaks down into the file's owner, the group the owner belongs to, and everyone else ("other"). "What" breaks down into read, write, and execute.
Each cell in that 3×3 grid is either granted or not, and that's exactly what a listing like from is showing you.
Strip the leading character and the remaining nine characters are three groups of three — owner, group, other — each rendered as r/w/x when granted or when not.
Why a single digit can represent read/write/execute Numeric notation like compresses that rwx combination into a single octal digit.
Read is worth 4, write is worth 2, execute is worth 1 — powers of two — and you sum whichever bits are set.
Note: powers of two are used here because each of read/write/execute is tracked as an independent bit (on or off), and any sum of a subset of {4, 2, 1} maps back to exactly one combination of bits.
There's no ambiguity — for example, 6 can only mean read+write (4+2), never any other combination.
Read and write, no execute (): 4 + 2 = 6 Read only (): 4 Read, write, and execute (): 4 + 2 + 1 = 7 No access at all (): 0 A three-digit number like lines up these single digits for owner, group, and other, left to right. means "owner gets read+write, group and other get nothing." What the common numbers actually mean Reading the numbers mentioned at the top through this lens: Number owner group other Typical use 600 rw- --- --- Private keys, config files holding secrets 644 rw- r-- r-- Ordinary config files, data safe to expose 700 rwx --- --- Personal directories (e.g. ) 755 rwx r-x r-x Executable scripts, programs anyone may run The pattern is consistent: the owner always gets whatever access the file actually requires (read/write, sometimes execute), and group/other get either "read-only" or "nothing at all" — never write access.
Combinations that grant group or other write access (666, 777) don't show up as defaults, because that means "anyone on the system can modify this file," and there are very few legitimate reasons to want that.
The principle of least privilege, enforced as a number The pattern above is a filesystem-level embodiment of a broader security concept: the principle of least privilege.
Note: least privilege means granting a user or process only the minimum access actually required to do its job — nothing more.
The more access something has, the larger the blast radius when a mistake happens or an account gets compromised.
Requiring 600 on a private key rests on the assumption that only the key's owner has any legitimate reason to read it.
On a machine shared by multiple people (a shared on a multi-user server, for instance), leaving read access open to group or other means any other user on that machine can read the key's contents.
SSH client libraries — both OpenSSH and paramiko — refuse to load a key in that state.
The mere possibility of being read by someone else is treated as unsafe, regardless of whether it's ever actually read.
Config files, by contrast, are commonly left at 644 (read-only for group/other) precisely because there's no harm in another user seeing their contents.
The same logic explains 755 on executable scripts: anyone may run it, but only the owner should be able to modify it.
These numbers aren't arbitrary convention — they're a direct encoding of "who should be able to touch this file, and how." A real example: the group/other bitmask check in Thi