--- title: "Linux permissions: chmod, chown and the Permission denied error | StreetHosting" description: "Learn to read ls -l, rwx and octal notation (644, 755, 600), use chmod and chown, why 777 is a mistake and how to fix Permission denied with Nginx and PHP." url: "https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown" type: "page" language: "en-US" --- VPS · 7 min · Beginner Published on Nov 13, 2026 · Updated on Nov 13, 2026 # Linux permissions in practice: chmod, chown and how to fix Permission denied Every file on Linux has an owner, a group and three kinds of permission. Understanding that fixes most access denied errors on sites, bots and SSH keys, without resorting to chmod 777. By [Equipe StreetHosting](https://streethosting.com.br/en/autores#equipe-streethosting) · StreetHosting infrastructure and support team [Errors and diagnostics](https://streethosting.com.br/en/guides/topics/troubleshooting) [Linux administration](https://streethosting.com.br/en/guides/topics/linux) [Network, DNS and domains](https://streethosting.com.br/en/guides/topics/networking) Summarize with: [](https://chat.openai.com/?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "ChatGPT") [](https://claude.ai/new?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Claude") [](https://www.google.com/search?udm=50&aep=11&q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Google AI Mode") [](https://x.com/i/grok?text=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Grok") [](https://www.perplexity.ai/search/new?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Perplexity") Share: [](https://x.com/intent/tweet?text=Linux%20permissions%3A%20chmod%2C%20chown%20and%20the%20Permission%20denied%20error&url=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown "Share on X") [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown "Share on Facebook") [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown "Share on LinkedIn") [](https://wa.me/?text=Linux%20permissions%3A%20chmod%2C%20chown%20and%20the%20Permission%20denied%20error%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Fvps%2Flinux-permissions-chmod-chown "Share on WhatsApp") For agents: Copy as Markdown [.md](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown.md) In this guide 9 sections * [How to read ls -l](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#ler-ls) * [Read, write and execute](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#rwx) * [Octal notation: 644, 755 and 600](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#octal) * [chmod and chown](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#chmod-chown) * [Why 777 is a mistake](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#777) * [www-data on Nginx and PHP](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#www-data) * [umask and the permissions of new files](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#umask) * [Diagnosing Permission denied](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#diagnosticar) * [Where to apply it](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#onde-rodar) Quick answer Every file on Linux has an **owner**, a **group** and **read (r)**, **write (w)** and **execute (x)** permissions for owner, group and others. In octal, r is 4, w is 2 and x is 1, and the common values are `644` for files, `755` for folders and programs and `600` for the SSH key. `chmod` changes the permissions and `chown` changes the owner. Never fix an access error with `chmod 777`: correct the owner with `chown`. ## How to read ls -l[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#ler-ls) The `ls -l` command lists files with their permissions. If you are still getting used to the terminal, start with the [basic Linux commands for the VPS](https://streethosting.com.br/en/guides/vps/basic-linux-commands-vps). A typical output looks like this: `$ ls -l -rw-r--r-- 1 ana ana 2048 nov 13 10:02 index.html drwxr-xr-x 2 ana ana 4096 nov 13 10:00 imagens -rwxr-x--- 1 root deploy 512 nov 12 18:30 deploy.sh` Each line starts with ten characters. The first is the type: `-` for a file, `d` for a folder and `l` for a symbolic link. The next nine are three blocks of three: permissions for the owner, the group and others. Then come the link count, the owner, the group, the size, the date and the name. In the example, `index.html` belongs to user ana and group ana, and `deploy.sh` belongs to root and group deploy. ## Read, write and execute[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#rwx) The three kinds of permission mean different things on a file and on a folder: | Letter | On a file | On a folder | | ----------- | ----------------------------- | ----------------------------------------- | | r (read) | Read the contents | List the names inside it | | w (write) | Change the contents | Create, delete and rename items inside it | | x (execute) | Run it as a program or script | Enter the folder and reach what is inside | The detail that confuses people most: to reach a file, you need **x permission on every folder in the path**, not just permission on the file. A folder without x blocks access to everything inside it, even if the files are readable. And deleting a file depends on the w permission of the folder that contains it, not on the file itself. ## Octal notation: 644, 755 and 600[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#octal) Instead of writing rwx, chmod accepts three digits. Each digit is the sum of the values r = 4, w = 2 and x = 1, in the order owner, group and others. So 6 is 4 plus 2 (rw), 5 is 4 plus 1 (rx) and 7 is 4 plus 2 plus 1 (rwx). | Octal | Symbols | When to use | | ----- | --------- | ----------------------------------------------------------- | | 644 | rw-r--r-- | Regular files: the owner edits, everyone reads | | 755 | rwxr-xr-x | Folders, programs and executable scripts | | 600 | rw------- | Only the owner reads and writes: private SSH key, .env file | | 700 | rwx------ | Private folder of the owner, like \~/.ssh | | 640 | rw-r----- | Owner edits, group reads, others get nothing | | 777 | rwxrwxrwx | Avoid: anyone can do anything | For the SSH key, the client is strict: the private key must be `600` and the `~/.ssh` folder `700`. On the server, the `~/.ssh/authorized_keys` file must not be writable by the group or others (600 is the safest), and the same goes for the `~/.ssh` folder and your home folder. If anyone besides the owner can change those paths, the SSH server ignores the key and asks for a password. The step by step for the key is in [setting up a passwordless SSH key on the VPS](https://streethosting.com.br/en/guides/vps/passwordless-ssh-login-vps). ## chmod and chown[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#chmod-chown) `chmod` changes permissions, in octal or in symbols. `chown` changes owner and group. The `-R` option applies the change recursively, to the whole folder and everything inside it. `# octal chmod 644 index.html chmod 600 ~/.ssh/id_ed25519 chmod 700 ~/.ssh # symbols: u owner, g group, o others, a all chmod +x deploy.sh # gives execute permission chmod g+w arquivo # the group can now write chmod o-rwx segredo.txt # removes everything from others # owner and group sudo chown ana arquivo sudo chown ana:ana arquivo # owner and group sudo chown -R www-data:www-data /var/www/meusite` Changing the owner requires sudo, because only root can give a file to another user. When you need different permissions for folders and for files inside a tree, do not use a single `chmod -R`, because it treats everything the same: with 755 it makes every file executable, and with 644 it removes the x from the folders and blocks access to them. Split it with `find`: `sudo find /var/www/meusite -type d -exec chmod 755 {} + sudo find /var/www/meusite -type f -exec chmod 644 {} +` With `-R` the damage is big if the path is wrong. A `sudo chown -R www-data /` or a `chmod -R` on the wrong folder can break the whole system, SSH access included. Check the path with `pwd` and `ls` before running it. ## Why 777 is a mistake[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#777) `chmod 777` is the most common answer on the internet for an access error, and the worst one. It works because it opens everything, and that is exactly why it is dangerous: * **Any process can write:** a vulnerable plugin, another site on the same machine or a regular user can now change or create files there. * **Executable by everyone:** a malicious upload in a 777 folder becomes a program ready to run. * **It hides the real problem:** the error is almost always the wrong owner or group, and 777 only masks it until the next change. * **Some programs refuse overly open permissions:** the SSH client refuses a private key that other users can read, and the server ignores an authorized\_keys file that others can change. The practical rule: nobody needs 777 on a server. If a folder must be writable by the site, give it the right owner or group and allow writing only for it, as in the next section. ## www-data on Nginx and PHP[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#www-data) On Ubuntu and Debian, Nginx and PHP FPM run as the `www-data` user. That user needs to read the site files and write to the upload and cache folders. A common and safe arrangement: 1. Keep the site files owned by your user, so you can edit and deploy: `sudo chown -R ana:www-data /var/www/meusite`. 2. Give the group read access and others nothing: folders at `750` and files at `640`, with the `find` shown above, swapping the values. www-data reads through the group. 3. On the folders where the site needs to write, such as `wp-content/uploads` on WordPress or `storage` on Laravel, give the group write access: `sudo chmod -R g+w storage`. If you prefer the direct way, giving everything to www-data with `chown -R www-data:www-data` also works and is what many tutorials do. The cost is that you then need sudo to edit the files. For the full WordPress install with these permissions, see [hosting WordPress on a VPS with Nginx](https://streethosting.com.br/en/guides/vps/host-wordpress-on-vps-nginx). ## umask and the permissions of new files[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#umask) `umask` is the mask that removes bits from the permissions of every file or folder created from then on. With`022`, the default for root and for services on Ubuntu, new files are born 644 and new folders 755. In regular user sessions Ubuntu usually applies`002`, which lets the group write too (664 and 775), since each user has a group of their own. To see the value for your session, run `umask`. ## Diagnosing Permission denied[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#diagnosticar) When _Permission denied_ shows up, do not guess values. Follow the order: `id namei -l /var/www/meusite/storage/app.log ls -ld /var/www/meusite /var/www/meusite/storage sudo -u www-data cat /var/www/meusite/storage/app.log` 1. **Find out who you are and who needs access.** `id` shows your user and groups. If the access comes from Nginx or PHP, the user is www-data. 2. **Look at the permissions of the file and of every folder in the path.** `namei -l` shows each level at once, and `ls -ld` shows the folder itself, without listing its contents. 3. **Test as the other user.** `sudo -u www-data cat`reproduces the site's error in your terminal and confirms the problem is permissions. 4. **Fix the cause:** a wrong owner is fixed with `chown`, a missing x on a folder with `chmod`, and a missing group access with `chmod g+r` or `g+w`. 5. **Check the service log.** Nginx's real error lives in `/var/log/nginx/error.log`, and when it comes with a 502, the trail continues in [the 502 Bad Gateway error on Nginx](https://streethosting.com.br/en/guides/vps/nginx-502-bad-gateway-error). If the command works with sudo and fails without it, the problem is your user. Check that it makes sense for it to reach that file and, if it does, put the user in the right group with `sudo usermod -aG nomedogrupo seuusuario`. The change takes effect after you log out and back in. To create a regular user with sudo, see [creating a sudo user on the VPS](https://streethosting.com.br/en/guides/vps/create-sudo-user-linux-vps). ## Where to apply it[](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#onde-rodar) Permissions are the daily bread of anyone who runs their own server, and for that you need root access and the freedom to create users and groups. On [StreetHosting VPS](https://streethosting.com.br/en/vps) you get root access, KVM virtualization and a dedicated IPv4. The Xeon VPS, from R$ 26.00 per month, with 2 vCPU, 2 GB of DDR4 and 20 GB of NVMe, is good for practicing and for hosting a site with Nginx and PHP. All of them are in São Paulo, with AntiDDoS included, up to 5 TB of traffic per month and activation in about 60 seconds after payment by Pix or card. In this guide * [How to read ls -l](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#ler-ls) * [Read, write and execute](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#rwx) * [Octal notation: 644, 755 and 600](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#octal) * [chmod and chown](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#chmod-chown) * [Why 777 is a mistake](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#777) * [www-data on Nginx and PHP](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#www-data) * [umask and the permissions of new files](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#umask) * [Diagnosing Permission denied](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#diagnosticar) * [Where to apply it](https://streethosting.com.br/en/guides/vps/linux-permissions-chmod-chown#onde-rodar) ## Frequently asked questions What does chmod 755 mean? The owner can read, write and execute (7), and the group and others can read and execute (5), but not write. It is the standard for folders and for programs and scripts that everyone needs to run. What permission should the SSH private key have? 600 on the key file, meaning only the owner reads and writes. The \~/.ssh folder should be 700. The SSH client refuses private keys with overly open permissions and shows the UNPROTECTED PRIVATE KEY FILE warning. What is the difference between chmod and chown? chmod changes what each category can do with the file (read, write, execute). chown changes who owns the file and which group it belongs to. The two are often used together to set up a site folder. Why should I not use chmod 777? Because it gives full permission to every user and every process on the server. If a site is compromised, the attacker can change or drop files across the whole folder. A permission error is almost always fixed by correcting the owner, not by opening everything. Which user do Nginx and PHP use on Ubuntu? www-data. Nginx and PHP FPM run as that user on Ubuntu and Debian, so the site folder must be readable by it, and upload folders writable by it. Next step See VPS plans Root VPS in Brazil with NVMe and Anti-DDoS. [See VPS plans](https://streethosting.com.br/en/vps) ## Related guides [VPS Beginner Basic Linux commands to use on your VPS A VPS has no windows and no mouse, just a terminal. These are the commands that handle 90% of daily work: moving around folders, handling files, reading logs, seeing what eats resources and controlling services. 6 min Read guide](https://streethosting.com.br/en/guides/vps/basic-linux-commands-vps) [VPS Intermediate How to create a sudo user on a Linux VPS Running as root all the time is risky: one wrong command affects everything. The best practice is to create a regular user with sudo and keep root for when you really need it. 3 min Read guide](https://streethosting.com.br/en/guides/vps/create-sudo-user-linux-vps) [VPS Intermediate How to set up passwordless SSH key login on a VPS Key-based login is safer and easier than a password. You generate a key pair, copy the public key to the server, and log in without typing anything. Here is how, in a few steps. 3 min Read guide](https://streethosting.com.br/en/guides/vps/passwordless-ssh-login-vps) [← Back to the Guide Center](https://streethosting.com.br/en/guides)