Skip to content

Chapter 4 of 6

SSH, Immutable Files, and Sensitive Data

A handful of well-known system files have modes that look surprising on first contact, but each has a clear reason. SSH is the strictest case: the ~/.ssh directory must be 700 and the private key (typically id_ed25519) must be 600, otherwise the SSH client refuses to use the key — a deliberate security check. The matching public key is 644, and authorized_keys is normally 600 as well. These defaults protect the cryptographic material from any user who happens to share the machine.

Password storage follows the same idea. /etc/passwd is world-readable (644) because countless utilities need to map numeric UIDs to usernames; only the password hashes live elsewhere, in /etc/shadow at 640 owned by root:shadow. This split lets the system identify users while keeping the actual secrets locked away. The general rule is that things everyone needs to read stay readable, while secrets get a restrictive mode.

Beyond traditional Unix permissions, two extended attributes provide stronger protection. chattr +i file marks a file as immutable, so even root cannot modify or delete it until chattr -i reverses the bit; root can normally do anything filesystem-wise, but immutable files remain out of reach. chattr +a logfile sets the append-only flag, allowing data to be added to the end of a file but preventing truncation or rewriting — ideal for tamper-evident log files. Both flags can be inspected with lsattr file. When a permission error says "Operation not permitted" on a file the user clearly owns, the immutable attribute, a read-only mount, or a MAC policy such as SELinux or AppArmor is usually the culprit rather than the Unix mode itself.

All chapters
  1. 1Reading and Converting Permission Modes
  2. 2Special Permission Bits and chmod Patterns
  3. 3Ownership, chown, and Recursive Patterns
  4. 4SSH, Immutable Files, and Sensitive Data
  5. 5POSIX ACLs, Filesystem Attributes, and Capabilities
  6. 6Diagnostics, Mounts, and Mandatory Access Control

Drill it

Reading is not remembering. These come from the Linux File Permissions And Chmod Patterns deck:

Q

What does <code>rwxr-xr--</code> mean?

Owner: rwx (7).Group: r-x (5).Other: r-- (4).Octal: 754.

Q

Convert <b>644</b> to symbolic.

rw-r--r-- — owner read+write, group read, others read.

Q

Convert <b>755</b> to symbolic.

rwxr-xr-x — typical for executables and directories.

Q

Convert <b>600</b> to symbolic.

rw------- — typical for private files like ~/.ssh/id_ed25519.