Configure Linux file permissions and access control with umask and chmod best practices

Check current umask settings

The umask command sets default permissions for newly created files and directories. Check your current umask value and understand how it affects new file creation.

umask
umask -S
touch test-file
ls -l test-file
mkdir test-dir
ls -ld test-dir

The numeric umask subtracts from the maximum permissions (666 for files, 777 for directories). A umask of 022 creates files with 644 permissions and directories with 755 permissions.

Configure secure system-wide umask

Set a secure default umask for all users by modifying the system login configuration. This ensures new files are created with appropriate permissions.

# Set default umask for new user accounts
UMASK           022

Alternative: more restrictive for security-sensitive environments
UMASK         027

Update the profile configuration to apply umask settings for interactive shells.

# Set secure default umask
umask 022

Export for consistency
export UMASK=022

Configure user-specific umask

Individual users can override the system umask in their shell profile. Add umask settings to the user's profile for consistent permission defaults.

# Set personal umask (more restrictive)
umask 027

For shared development environments
umask 002

Apply the changes immediately without logging out.

source ~/.bashrc
umask
echo "Current umask: $(umask)"

Set secure file permissions

Configure appropriate permissions for different file types. Never use chmod 777 as it grants full access to all users on the system.

# Regular files - owner read/write, group/others read-only
chmod 644 /path/to/regular-file.txt

Executable files - owner read/write/execute, group/others read/execute
chmod 755 /path/to/script.sh

Configuration files - owner read/write, group read, others no access
chmod 640 /etc/myapp/config.conf

Set secure directory permissions

Directories require execute permission for access. Configure directory permissions to control who can enter and list contents.

# Standard directories - owner full access, group/others read/execute
chmod 755 /path/to/directory

Private directories - owner full access only
chmod 700 /path/to/private-directory

Shared group directories - owner/group full access, others read/execute
chmod 775 /path/to/shared-directory

Configure ownership for web applications

Web servers need proper ownership to read files and write logs. Set correct ownership first, then apply minimal permissions.

# Set ownership for web content
sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html
sudo find /var/www/html -type f -exec chmod 644 {} \;

# Set ownership for web content
sudo chown -R nginx:nginx /var/www/html
sudo chmod -R 755 /var/www/html
sudo find /var/www/html -type f -exec chmod 644 {} \;

Configure application log directories

Applications need write access to log directories. Create secure log directories with appropriate ownership and permissions.

# Create log directory with correct permissions
sudo mkdir -p /var/log/myapp
sudo chown myapp:myapp /var/log/myapp
sudo chmod 755 /var/log/myapp

For applications that need group write access
sudo chown myapp:adm /var/log/myapp
sudo chmod 775 /var/log/myapp

Set SSH key permissions

SSH requires specific permissions for security. Incorrect SSH key permissions will cause authentication failures.

# Set SSH directory permissions
chmod 700 ~/.ssh

Private key - owner read/write only
chmod 600 ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_ed25519

Public key - owner read/write, others read
chmod 644 ~/.ssh/id_rsa.pub
chmod 644 ~/.ssh/id_ed25519.pub

Authorized keys - owner read/write only
chmod 600 ~/.ssh/authorized_keys

Configure special permissions

Set sticky bit, setuid, and setgid permissions for specific use cases. These special permissions provide additional access control mechanisms.

# Sticky bit on directories - only owner can delete files
sudo chmod 1755 /tmp/shared
sudo chmod +t /tmp/shared

Setgid on directories - new files inherit group ownership
sudo chmod 2755 /var/shared
sudo chmod g+s /var/shared

Combined sticky bit and setgid
sudo chmod 3755 /var/collaborative

Implement access control lists (ACLs)

Use ACLs for fine-grained permission control beyond the basic owner/group/others model. Install ACL support if not already available.

sudo apt update
sudo apt install -y acl

sudo dnf install -y acl

# Grant specific user read/write access
setfacl -m u:username:rw /path/to/file

Grant group read/execute access
setfacl -m g:groupname:rx /path/to/directory

Set default ACL for directory
setfacl -d -m u:username:rw /path/to/directory

View ACL settings
getfacl /path/to/file