How to Use the ‘chown’ and ‘chmod’ Commands to Secure File Permissions

The Core of Linux Security

In the Linux operating system, absolute security is maintained by a strict hierarchy of ownership and permissions. Every single file and directory on the system is owned by a specific User and a specific Group. Furthermore, every file has three distinct permissions: Read, Write, and Execute.

If you create a shell script to automate database backups, but you forget to grant the system the “Execute” permission, the script will simply crash with a “Permission Denied” error.

To manipulate this security architecture from the terminal, administrators use two fundamental commands: chown (Change Owner) and chmod (Change Mode/Permissions).

1. Changing Ownership (chown)

If you upload a website’s files to your /var/www/html directory using your personal user account (e.g., jsmith), the web server software (Nginx or Apache) usually will not be able to read them, because the web server runs under its own user account (usually www-data).

You must transfer ownership of the files to the web server.

sudo chown www-data:www-data /var/www/html/index.html

Breaking down the syntax:

• www-data:www-data: The first word is the new User. The second word (after the colon) is the new Group.

Recursive Ownership

If you uploaded an entire website with 5,000 files, you don’t want to type that command 5,000 times. You use the capital -R (Recursive) flag to apply the ownership change to the folder and every single file hidden inside it.

sudo chown -R www-data:www-data /var/www/html/

2. Changing Permissions (chmod)

Once the web server owns the files, you need to ensure the permissions are safe. You want the web server to be able to Read the files, but you don’t want random visitors on the internet to be able to Write (modify) them.

Permissions are usually represented by a three-digit mathematical code (e.g., 644 or 755).

• 4 = Read
• 2 = Write
• 1 = Execute
• 0 = No Access

You add these numbers together to grant combinations. (e.g., 4 + 2 = 6, which means Read + Write). The three digits represent the Owner, the Group, and Everyone Else (Public).

Securing a Document (644)

The absolute standard permission for a basic text file or HTML document is 644.

• 6 (Owner): Can Read and Write.
• 4 (Group): Can only Read.
• 4 (Public): Can only Read.

chmod 644 /var/www/html/index.html

Making a Script Executable (755)

If you wrote a bash script named backup.sh, you must grant it Execute permissions so the system can run it. The standard executable permission is 755 (4+2+1 = 7).

• 7 (Owner): Can Read, Write, and Execute.
• 5 (Group): Can Read and Execute.
• 5 (Public): Can Read and Execute.

chmod 755 backup.sh

3. The “Human Readable” Syntax (chmod +x)

If the math is confusing, chmod offers a symbolic syntax.

To simply add the Execute (x) permission to a script for whoever currently owns it, without doing any math, you can use the +x flag.

chmod +x backup.sh

To aggressively remove Write (w) access from a critical configuration file so no one can alter it:

chmod -w config.php

Conclusion

Mastering chown and chmod is mandatory for Linux administration. By strictly isolating user ownership and locking down executable math codes, administrators can create impenetrable server environments where rogue scripts and unauthorized users cannot modify critical system data.