DEV Community: Abdullah Al Jahid

Stop Using chmod 777: A Developer's Guide to Linux File Permissions

Abdullah Al Jahid — Sat, 09 May 2026 16:59:36 +0000

Last month, a friend's side project got hacked. The attacker uploaded a PHP shell through a file upload form and executed it. The root cause? Every directory on the server was set to chmod 777.

He told me:

"I kept getting permission denied errors during deployment, so I just 777'd everything."

Sound familiar? Let's fix that.

What chmod Actually Does

chmod (change mode) controls who can read, write, and execute files on Linux. Every file has three permission sets:

Owner — the user who created the file
Group — users in the file's group
Others — everyone else

Each gets a combination of:

Permission	Symbol	Value	Meaning
Read	`r`	4	View contents
Write	`w`	2	Modify/delete
Execute	`x`	1	Run as program
None	`-`	0	No access

Add the values to get each digit. So 7 = 4+2+1 (rwx), 5 = 4+1 (r-x), 4 = 4 (r--).

Three digits = owner, group, others. That's it. That's the whole system.

The chmod Cheat Sheet You'll Actually Use

Here's what you need 90% of the time:

chmod 755 script.sh        # Scripts & directories
chmod 644 index.html       # Regular files (HTML, CSS, images)
chmod 600 .env             # Secrets (SSH keys, credentials)
chmod 700 ~/.ssh/          # Private directories

What each one means:

755 (rwxr-xr-x) - Owner can do everything. Everyone else can read and execute but not modify. Use for:

Shell scripts
Directories
Application binaries

644 (rw-r--r--) - Owner can read/write. Everyone else read-only. Use for:

HTML, CSS, JS files
Configuration files (non-secret)
Images and static assets

600 (rw-------) - Owner only. Nobody else can even read the file. Use for:

.env files
SSH private keys (~/.ssh/id_rsa)
Database credentials
API tokens

700 (rwx------) - Like 600 but with execute (for directories). Use for:

~/.ssh/ directory
Home directories
Private application folders

I built a free interactive chmod calculator that lets you toggle permissions visually and see the numeric + symbolic notation in real time. Useful when you can't remember if you need 644 or 755.

Why chmod 777 Is Dangerous

777 means everyone can read, write, and execute. Here's why that's a problem:

chmod 777 /var/www/html/

What you think happens: "My deployment script stops getting permission errors."

What actually happens:

Any user on the system can modify your files
A web server vulnerability lets attackers write to your directories
Uploaded files can be executed as code
Attackers can replace your files with malicious versions

Real-world attack flow:

1. Attacker finds file upload endpoint
2. Uploads malicious.php (or .sh, .py, etc.)
3. Because directory is 777, the file is writable AND executable
4. Attacker visits malicious.php → full server access
5. Game over

If the directory was 755, the uploaded file would be owned by the web server user but not executable by default. The attack chain breaks.

Symbolic Mode: The Safer Way to Change Permissions

Instead of setting all permissions at once (numeric), you can add/remove specific ones:

# Add execute permission for owner only
chmod u+x deploy.sh

# Remove write from group and others
chmod go-w config.yml

# Add read for everyone
chmod a+r README.md

# Remove all permissions from others
chmod o-rwx secret.key

Why this is safer: chmod u+x script.sh only adds execute for the owner. It doesn't touch group or others permissions. With numeric mode, you have to know and set ALL permissions at once.

# These do the same thing, but symbolic is clearer:
chmod 755 script.sh          # What was it before? Who knows.
chmod u+x script.sh          # Just adding execute for owner. Clear.

Common Scenarios with Exact Commands

Deploying a web app

# Set directory permissions
find /var/www/myapp -type d -exec chmod 755 {} \;

# Set file permissions
find /var/www/myapp -type f -exec chmod 644 {} \;

# Make scripts executable
chmod 755 /var/www/myapp/scripts/*.sh

# Lock down .env
chmod 600 /var/www/myapp/.env

Setting up SSH keys

chmod 700 ~/.ssh/
chmod 600 ~/.ssh/id_rsa          # Private key (SSH REQUIRES this)
chmod 644 ~/.ssh/id_rsa.pub      # Public key
chmod 600 ~/.ssh/authorized_keys
chmod 644 ~/.ssh/known_hosts

SSH will refuse to use your key if the private key has permissions looser than 600. This is intentional - it's protecting you.

Not sure what your current numeric permission translates to?
Paste the number into the ToolZip Chmod Calculator to see
the exact read/write/execute breakdown.

Docker volumes

# Container needs read/execute on the mounted directory
chmod -R 755 ./docker-data/

# But secrets inside should be locked down
chmod 600 ./docker-data/certs/*.pem

CI/CD pipeline

# Make all scripts in your pipeline executable
chmod +x ./scripts/*.sh
chmod +x ./hooks/pre-commit

Quick Security Audit

Run these commands on your server right now:

# Find all 777 files (fix every single one)
find / -perm -777 -type f 2>/dev/null

# Find all 777 directories
find / -perm -777 -type d 2>/dev/null

# Find SUID files (programs that run as root)
find / -perm -4000 -ls 2>/dev/null

# Check your web root specifically
ls -la /var/www/

If find / -perm -777 returns anything in your web root, fix it immediately.

The Permission Decision Flowchart

When you're not sure what permission to use:

Is it a secret (passwords, keys, tokens)?
  → 600

Is it a directory?
  → 755 (or 700 if private)

Is it an executable script?
  → 755

Is it a regular file?
  → 644

Should nobody but the owner access it?
  → 600 (file) or 700 (directory)

Are you tempted to use 777?
  → Stop. Use 755 and fix the actual problem.

Tools That Help

ToolZip Chmod Calculator - Toggle permissions visually, see numeric + symbolic notation, common presets for quick reference
ToolZip Hash Generator - Verify file integrity after permission changes with MD5/SHA-256 checksums
ToolZip Cron Expression Generator - Schedule automated permission audits with cron jobs
ls -la - Your best friend for checking current permissions
stat filename - Detailed file information including permissions in octal

TL;DR

Use Case	Permission	Command
Regular files	644	`chmod 644 file.html`
Scripts & directories	755	`chmod 755 script.sh`
Secrets & credentials	600	`chmod 600 .env`
Private directories	700	`chmod 700 ~/.ssh/`
Never in production	~~777~~	Don't.

What To Do Right Now

If you're running a Linux server, SSH into it and run this:

find / -perm -777 -type f 2>/dev/null | head -20

If that returns anything — especially in /var/www/ — you have a
problem. Fix it with the permission values from the cheat sheet
above before someone else finds it first.

Stop chmod 777-ing everything. Use 755 for scripts and directories, 644 for files, 600 for secrets. That covers 95% of cases.

If you want to play around with permissions without risk, try the chmod calculator - toggle checkboxes and see exactly what each number means.

Originally published at toolzip.xyz/blog/chmod-permissions-explained

MUST USE VSCODE EXTENSIONS

Abdullah Al Jahid — Tue, 31 May 2022 19:05:36 +0000

What is VS Code Extensions?

Extensions are add-ons that allow you to customize and enhance your experience in Visual Studio by adding new features or integrating existing tools. An extension can range in all levels of complexity, but its main purpose is to boost your productivity and cater to your workflow.

VS Code extensions let you add languages, debuggers, and tools to your installation to support your development workflow.

How to install extensions in VS Code?

You can browse and install extensions from within VS Code. Bring up the Extensions view by clicking on the Extensions icon in the Activity Bar on the side of VS Code or use the View: Extensions command (Ctrl+Shift+X) to bring up the Extensions view.
This will show you a list of the most popular VS Code extensions on the VS Code Marketplace.

Installation of Extensions

To install an extension, select the Install button. Once the installation is complete, the Install button will change to the Manage gear button.You can also add the extensions from command line terminal.

Note: Sometimes you may need to restart your VS Code finish the installation process.

Let's have a look on some must use VS Code extensions.

Each extension in the list includes a brief description, the publisher, the download count, and a five star rating. You can select the extension item to display the extension's details page where you can learn more.

Prettier

Go to extensions view page and search for Prettier and install it.
Command for installing it from terminal:

code --install-extension esbenp.prettier-vscode

ESLint

Go to extensions view page and search for ESLint and install it.
Command for installing it from terminal:

code --install-extension dbaeumer.vscode-eslint

TSLint

Go to extensions view page and search for TSLint and install it.
Command for installing it from terminal:

code --install-extension ms-vscode.vscode-typescript-tslint-plugin

Code Spell Checker

Go to extensions view page and search for Code Spell Checker and install it.
Command for installing it from terminal:

code --install-extension streetsidesoftware.code-spell-checker

GitLens — Git supercharged

Go to extensions view page and search for GitLens — Git supercharged and install it.
Command for installing it from terminal:

code --install-extension eamodio.gitlens

TODO Highlight

Go to extensions view page and search for TODO Highlight and install it.
Command for installing it from terminal:

code --install-extension wayou.vscode-todo-highlight

Color Highlight

Go to extensions view page and search for Color Highlight and install it.
Command for installing it from terminal:

code --install-extension naumovs.color-highlight

NPM Intellisense

Go to extensions view page and search for npm Intellisense and install it.
Command for installing it from terminal:

code --install-extension christian-kohler.npm-intellisense

Path Intellisense

Go to extensions view page and search for Path Intellisense and install it.
Command for installing it from terminal:

code --install-extension christian-kohler.path-intellisense

IntelliCode

Go to extensions view page and search for IntelliCode and install it.
Command for installing it from terminal:

code --install-extension visualstudioexptteam.vscodeintellicode

GitHub Copilot

Go to extensions view page and search for GitHub Copilot and install it.
Command for installing it from terminal:

code --install-extension github.copilot

Thanks

Markdown Cheat Sheet

Abdullah Al Jahid — Sat, 19 Jun 2021 10:15:46 +0000

What is Markdown?

Markdown is a lightweight markup language with a plain text formatting syntax. It can be converted into HTML/XHTML and others formats. It's main purpose is readability and ease of use.

What It Is Used For?

README files (Github , etc.)
Forum and Blog Posts (dev.to, Medium etc)
Many static site generators.

Now let's have a look what can we do using markdown and how can we use it.

Headings

For Heading1

For Heading2

For Heading3

For Heading4

For Heading5

For Heading6

Alternatively, you can use an underline-ish style for H1 and H2:

For H1

For H2

Italic

Use single *asterisks* or _underscores_ for Italic.

Use single asterisks or underscores for Italic.

Bold/Strong

Use double **asterisks** or __underscores__ for Bold/Strong.

Use double asterisks or underscores for Bold/Strong.

Combined

**Bold and *Italic1* & _Italic2_**

Bold and Italic1 & Italic2

Strikethrough

Use two tildes ~~to scratch/strikethrough this.~~

Use two tildes ~~to scratch/strikethrough this.~~

Horizontal Rule

You can use any of the following...
Using Hyphens

---

Using Asterisks

***

Using Underscores

___

Using three Hyphens

Using three Asterisks

Using three Underscores

Blockquotes

> This line is quoted.
> This line is part of the same quote.

Paragraph:
> You can write a paragraph inside a blockquote. You can also use different markdown here. Such as *itlic*, **bold**, ~~strike~~ etc.

This line is quoted.
This line is part of the same quote.

Paragraph:

You can write a paragraph inside a blockquote. You can also use different markdown here. Such as itlic, bold, ~~strike~~ etc.

Links

There are two ways to create links.
1. Inline Link

[Abdulah Al Jahid](https://username.medium.com/)

Abdulah Al Jahid

1. Inline Link With a Title

[Abdulah Al Jahid](https://github.com/username "My Github Account")

Abdulah Al Jahid

Tricky way to add links in a button

<a target="_blank" href=""><img src="https://img.shields.io/badge/-%23.svg?&style=plastic&logo=&logoColor=white" alt=""></a>

Github link:

Medium Blog Link

<a target="_blank" href="https://github-readme-medium-recent-article.vercel.app/medium/@username/articleId"><img src="https://github-readme-medium-recent-article.vercel.app/medium/@username/articleId" alt="Alternative text">

Youtube Video Link

<a href="http://www.youtube.com/watch?feature=player_embedded&v=YOUTUBE_VIDEO_ID" target="_blank"><img src="http://img.youtube.com/vi/YOUTUBE_VIDEO_ID/0.jpg" 
alt="Alternative text" width="240" height="180" border="10" /></a>

Images

Inline Style:
![Markdown Logo](https://markdown-here.com/img/icon256.png)

Reference Style:
![Markdown logo][logo]
`[logo]: https://markdown-here.com/img/icon256.png`

Inline Style:

Reference Style:

Inline Code Block

This is inline `code block` using `back-ticks`.

This is inline code block using back-ticks.

Code Blocks and Syntax Highlighting

Normal Code blocks

Bash:

npm install
npm run dev

Javascript:

function add(number1, number2) {
  return number1 + number2;
}

Python:

def add(number1, number2):
  return number1 + number2

List

UL
You can use */-/+ in unordered list

* Item 1
* Item 2
    * Item 2.1
    * Item 2.2
        * Item 2.2.1

Item 1
Item 2
- Item 2.1
- Item 2.2
  - Item 2.2.1

1. Item 1
2. Item 2
3. Item 3

Item 1
Item 2
Item 3

Table

| First Name    | Last Name     | Id    |
| ------------- |---------------| ------|
| Mark          | Down          |   1   |
| Abdullah Al   | Jahid         |   2   |
| Awesome       | Table         |   0   |

First Name	Last Name	Id
Mark	Down	1
Abdullah Al	Jahid	2
Awesome	Table	0