Configure Linux file permissions and access control with umask and chmod best practices

Check current umask settings

The umask command sets default permissions for newly created files and directories. Check your current umask value and understand how it affects new file creation.

umask
umask -S
touch test-file
ls -l test-file
mkdir test-dir
ls -ld test-dir

The numeric umask subtracts from the maximum permissions (666 for files, 777 for directories). A umask of 022 creates files with 644 permissions and directories with 755 permissions.

Configure secure system-wide umask

Set a secure default umask for all users by modifying the system login configuration. This ensures new files are created with appropriate permissions.

# Set default umask for new user accounts
UMASK           022

# Alternative: more restrictive for security-sensitive environments
</code><h2><code>UMASK         027</code></h2></pre>
<p>Update the profile configuration to apply umask settings for interactive shells.</p>
<pre class="terminal"><code># Set secure default umask
umask 022

# Export for consistency
export UMASK=022

Configure user-specific umask

Individual users can override the system umask in their shell profile. Add umask settings to the user's profile for consistent permission defaults.

# Set personal umask (more restrictive)
umask 027

# For shared development environments
</code><h2><code>umask 002</code></h2></pre>
<p>Apply the changes immediately without logging out.</p>
<pre class="terminal"><code>source ~/.bashrc
umask
echo "Current umask: $(umask)"

Set secure file permissions

Configure appropriate permissions for different file types. Never use chmod 777 as it grants full access to all users on the system.

# Regular files - owner read/write, group/others read-only
chmod 644 /path/to/regular-file.txt

# Executable files - owner read/write/execute, group/others read/execute
chmod 755 /path/to/script.sh

# Configuration files - owner read/write, group read, others no access
chmod 640 /etc/myapp/config.conf

Set secure directory permissions

Directories require execute permission for access. Configure directory permissions to control who can enter and list contents.

# Standard directories - owner full access, group/others read/execute
chmod 755 /path/to/directory

# Private directories - owner full access only
chmod 700 /path/to/private-directory

# Shared group directories - owner/group full access, others read/execute
chmod 775 /path/to/shared-directory

Configure ownership for web applications

Web servers need proper ownership to read files and write logs. Set correct ownership first, then apply minimal permissions.

# Set ownership for web content
sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html
sudo find /var/www/html -type f -exec chmod 644 {} \;

# Set ownership for web content
sudo chown -R nginx:nginx /var/www/html
sudo chmod -R 755 /var/www/html
sudo find /var/www/html -type f -exec chmod 644 {} \;

Configure application log directories

Applications need write access to log directories. Create secure log directories with appropriate ownership and permissions.

# Create log directory with correct permissions
sudo mkdir -p /var/log/myapp
sudo chown myapp:myapp /var/log/myapp
sudo chmod 755 /var/log/myapp

# For applications that need group write access
sudo chown myapp:adm /var/log/myapp
sudo chmod 775 /var/log/myapp

Set SSH key permissions

SSH requires specific permissions for security. Incorrect SSH key permissions will cause authentication failures.

# Set SSH directory permissions
chmod 700 ~/.ssh

# Private key - owner read/write only
chmod 600 ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_ed25519

# Public key - owner read/write, others read
chmod 644 ~/.ssh/id_rsa.pub
chmod 644 ~/.ssh/id_ed25519.pub

# Authorized keys - owner read/write only
chmod 600 ~/.ssh/authorized_keys

Configure special permissions

Set sticky bit, setuid, and setgid permissions for specific use cases. These special permissions provide additional access control mechanisms.

# Sticky bit on directories - only owner can delete files
sudo chmod 1755 /tmp/shared
sudo chmod +t /tmp/shared

# Setgid on directories - new files inherit group ownership
sudo chmod 2755 /var/shared
sudo chmod g+s /var/shared

# Combined sticky bit and setgid
sudo chmod 3755 /var/collaborative

Implement access control lists (ACLs)

Use ACLs for fine-grained permission control beyond the basic owner/group/others model. Install ACL support if not already available.

sudo apt update
sudo apt install -y acl

sudo dnf install -y acl

# Grant specific user read/write access
setfacl -m u:username:rw /path/to/file

# Grant group read/execute access
setfacl -m g:groupname:rx /path/to/directory

# Set default ACL for directory
setfacl -d -m u:username:rw /path/to/directory

# View ACL settings
getfacl /path/to/file