TechCompare LogoTechCompare
Showing centimeters. Press to switch to inches.Showing inches. Press to switch to centimeters.

What does chmod 640 mean? Config files a service reads through its group

By TechCompare · Updated · How we check

chmod 640 sets rw-r-----: the owner reads and writes, the group reads, and others get no access. Use it for a file one account edits and one group only reads.

In ls -l, the file shows as -rw-r-----. Picture a config file with a database password in it. One account edits the file, a service reads it, and outsiders never see the password. That's the job this mode does, and it's a job that 644 and 600 each miss.

Octal
640
chmod 640
Symbolic
rw-r-----
Owner / Group / Others
Category
Group Access
Shared with one group
chmod 640 set on the configurator, pre-loaded. Flip individual permission bits or try a sibling mode.
Edit in the full tool

How this is calculated

Each digit adds up its bits. The owner's 6 is 4+2, read and write. The group's 4 means read only, so group members can open the file but can't change it. Others get 0, which is no bits at all. Put simply, 640 is 600 with read added for the group.

The names in this example are made up. Say a config file at /etc/myapp/app.conf belongs to root, and the group is appgroup. Run chown root:appgroup /etc/myapp/app.conf, then chmod 640 /etc/myapp/app.conf. The service runs as a user in appgroup, so it can read the file, and accounts outside the owner and the group can't.

Why not chmod 644? Under 644, every account on the system can read the file, so a password stored there is visible to all of them. Why not chmod 600? Under 600, only the owner can read it, so a service running as a different account can't open the file at all.

Verdict

Use 640 for a config file the owner edits and one service group reads. Don't use it for an SSH private key. ssh(1) says a private key should be readable by the user but not accessible by others, and ssh will simply ignore a private key file if it is accessible by others. Group read counts as access, so keys belong at 600 or 400. If a program in the group must write the file, check 660 instead.

More CHMOD scenarios

chmod 755
chmod 755 sets permissions to rwxr-xr-x: the owner can read, write, and execute, while the group and everyone else can read and execute but not modify.
View details
chmod 644
chmod 644 sets permissions to rw-r--r--: the owner can read and write, and the group and everyone else can only read.
View details
chmod 777
chmod 777 sets permissions to rwxrwxrwx: every user on the system can read, write, and execute the file or directory.
View details

Related guides

chmod 644: standard file permissions
The common file mode that every account can read, so it's too open for secrets.
View guide
chmod 600: SSH key permissions
Owner-only read and write, for files that no group should open.
View guide
chmod 750: group read, others none
The folder version of group access, where others get nothing.
View guide

Frequently asked questions

What does chmod 640 mean?
The owner can read and write, the group can read, and others can't open the file. In ls -l it shows as -rw-r-----. The group can read the file but can't edit it, since the group has no write bit.
What's the difference between chmod 640 and 644?
644 lets every account on the system read the file. 640 keeps that read to the owner and the file's group. Use 640 when the contents, such as a password, should stay away from other accounts, and 644 for files that are fine to share.
What's the difference between chmod 640 and 600?
600 gives the group nothing. 640 adds read for the group, so a service running in the file's group can read it. Pick 600 when only the owner reads the file, and 640 when a service reads it through a group.
Is chmod 640 safe for a config file with passwords?
It's safer than 644, because outsiders can't read it. The risk is the group: anyone who joins the file's group can read the passwords. Keep the group small, with only the service's account in it. If the service runs as the file's owner, 600 keeps the file to that account alone.

Related tools

Subnet Calculator

Calculate network address, broadcast address, and usable IP ranges for IPv4/IPv6.

Use tool

JSON Formatter

Validate, format, and minify JSON. Browse it as a tree, run JSONPath queries, compare two documents, or validate against a JSON Schema.

Use tool

Unix Timestamp

Convert between Unix timestamps and human-readable dates.

Use tool