Set Proper File Permissions

File permissions control who can read, write, or execute files on your Linux server. If sensitive files, such as SSH configuration files or log files, have weak permissions, attackers or unauthorized users could modify or access critical system data.

By restricting file permissions, you prevent unauthorized access and reduce the risk of security breaches.

How to Restrict Access to Important Files

1. Secure SSH Configuration File:

   sudo chmod 600 /etc/ssh/sshd_config

   • 600 → Only the root user can read and write; no one else can access it.

2. Secure Authentication Logs:

   sudo chmod 640 /var/log/auth.log

   • 640 → The root user can read/write; the group can read; others have no access.

Additional File Security Measures:

✅ Restrict access to /etc/passwd and /etc/shadow (stores user credentials):

sudo chmod 644 /etc/passwd   # Readable by all, but only writable by root
sudo chmod 600 /etc/shadow   # Only root can access

✅ Set permissions for SSH private keys (if using key-based authentication):

sudo chmod 600 ~/.ssh/id_rsa
sudo chmod 644 ~/.ssh/id_rsa.pub

• Private keys (id_rsa) should never be world-readable.

✅ Restrict access to critical system directories:

sudo chmod 750 /etc
sudo chmod 750 /var/log

✅ Prevent unauthorized execution of scripts:

• If you have custom scripts that shouldn't be executed by unauthorized users, use:

  sudo chmod 700 /path/to/script.sh

• 700 → Only the owner can read, write, and execute; no one else has access.

Best Practices for File Permissions:

🔹 Use ls -l filename to check current permissions before changing them.
🔹 Be cautious with chmod 777—this makes a file fully accessible to everyone, creating a security risk.
🔹 Regularly review file permissions to ensure only necessary access is granted.
🔹 Use chown to assign correct ownership:

sudo chown root:root /etc/ssh/sshd_config

(Ensures only the root user owns critical configuration files.)

By setting proper file permissions, you prevent unauthorized access, protect sensitive data, and reduce the risk of system compromise, keeping your Linux server secure and controlled.