What does chmod 600 mean? Private key permissions, SSH, and secure file practices
600 is the correct permission for any file containing credentials, keys, or secrets. Make it a habit: whenever you create a SSH key, a .env file with passwords, or a database config, chmod 600 immediately.
chmod 600 sets permissions to rw-------: only the owner can read and write the file. The group and everyone else get no access at all. This is the required permission for SSH private keys, and SSH will refuse to use a key file with broader permissions as a security measure.
By TechCompare · Updated
How this is calculated
In octal, 6 = 4+2+0 (read+write) for the owner, and the zeroes for group and others mean no permissions whatsoever. 600 is the standard for anything containing secrets: SSH keys, GPG private keys, database credential files, API token files. The principle is least privilege: if only one user needs access, only that user should have access. Many applications will warn or refuse to run if their config files are world-readable and contain passwords.
Verdict
The octal 600 sets the owner bits to 6 (4+2, read+write) and zeroes out group and others, which is the literal least-privilege setting for a single-user secret file: nothing but the owner can read or modify it. SSH enforces this on private keys ('UNPROTECTED PRIVATE KEY FILE' errors) precisely because a key readable by group or others could just be copied off the box by any other account. The same principle applies to other credential stores: .env files with API tokens, AWS credentials under ~/.aws/, kubeconfig under ~/.kube/, and GPG secret keys, all of which should drop to 600 the moment they're created. The operational lift is a single chmod, the security downside of leaving them broader is a real breach path.