File Ownership & Permissions (chown, chmod)

In Linux operating systems, security and access control are anchored in a strict file ownership and permission model. This chapter covers how Linux governs access across different user categories, explaining why restricting file permissions is mandatory for critical operations like SSH key authentication (.pem files), and demonstrating practical commands including chmod, chown, echo, and mkdir when working with remote servers.

1. Why Do We Need File Permissions?

In a multi-user environment or cloud server setup (such as an AWS EC2 Ubuntu instance), multiple processes and users interact with the same file system. Without strict access boundaries, any unauthorized user or rogue background process could read sensitive passwords, overwrite critical system binaries, or execute malicious scripts.

The Cloud & SSH Security Context

When connecting to a remote Linux instance via Secure Shell (SSH), authentication relies on a private key file (e.g., key.pem). SSH client binaries strictly enforce permission security policies: if a private key file is readable or writable by anyone other than the owner, SSH deliberately aborts the connection to prevent key theft.

Real-Life Analogy

Analogy: Think of a private .pem file like the key to a bank safety deposit box. If you leave a duplicate key sitting publicly on a reception desk where anyone in the building can copy it, the bank system refuses to let you open the vault until you secure the key in your personal pocket.

2. The Linux Ownership & Access Structure

Every file and directory in Linux is assigned an Owner (User) and a Group, and access privileges are evaluated across three distinct scopes:

Permission Types & Bit Values

Linux permissions consist of three primary operations: Read, Write, and Execute. Each operation maps directly to a binary bit and an integer score:

3. Decoding File Permission Strings (ls -l)

When you inspect a directory listing using ls -l, Linux outputs a detailed 10-character string representing file type and permission flags:

ls -l my_key.pem
# Output: -rw-r--r-- 1 ubuntu ubuntu 1678 Oct 24 10:00 my_key.pem

Breakdown of the 10-Character Permission String

Note: If the first character is d, it represents a directory; if -, it is a standard file; if l, it is a symbolic link.

4. Modifying File Permissions using chmod

The chmod (Change Mode) command alters access permissions for a file or directory. It supports two notation styles: Numeric (Octal) Mode and Symbolic Mode.

1. Numeric (Octal) Mode

In octal mode, you calculate the sum of values for User, Group, and Others.

# Example 1: Full owner control, read-only for group/others (644)
chmod 644 script.sh

# Example 2: Read, write, execute for owner; read & execute for group/others (755)
chmod 755 deploy.sh

# Example 3: Read-only for owner, zero access for group and others (400)
chmod 400 my_key.pem

Common Octal Configurations

2. Symbolic Mode

Symbolic mode uses letter notation to modify individual permissions dynamically without replacing the entire bitmask:

# Grant execute permission to the owner (u)
chmod u+x script.sh

# Remove write permission from group (g) and others (o)
chmod go-w document.txt

# Grant read and execute to all scopes (user, group, others)
chmod a+rx application.sh

5. Connecting to AWS Ubuntu via SSH with Secured .pem Key

When connecting to a cloud instance using an SSH key, open permissions trigger an authentication error. The key file must be restricted to read-only access for the owner before establishing the connection.

The Workflow: Fixing Pem Permissions & Connecting

Complete Terminal Execution Walkthrough

# Step 1: Restrict permissions on the private key file
chmod 400 server_key.pem

# Step 2: Initiate SSH connection to the remote server
ssh -i "server_key.pem" ubuntu@ec2-54-210-45-12.compute-1.amazonaws.com

# Step 3: Confirm authenticity prompt
# The authenticity of host 'ec2-54-210-45-12 (54.210.45.12)' can't be established.
# Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

# Output upon successful authentication:
# Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-1045-aws x86_64)
# ubuntu@ip-172-31-32-15:~$

6. Managing Ownership with chown and chgrp

While chmod manages access modes, chown (Change Owner) and chgrp (Change Group) modify the underlying identity assignments of files and directories.

Modifying User and Group Ownership (chown)

# Syntax: chown [USER]:[GROUP] filename

# Change file owner to 'ubuntu'
sudo chown ubuntu application.log

# Change both owner and group to 'ubuntu'
sudo chown ubuntu:ubuntu application.log

# Recursively change ownership for an entire directory tree
sudo chown -R ubuntu:www-data /var/www/html

Modifying Group Ownership (chgrp)

# Change group assignment to 'devs'
sudo chgrp devs script.sh

7. Basic Remote Shell Execution (echo, mkdir)

Once connected to the remote Ubuntu environment, basic Linux shell commands allow system interaction, script generation, and folder creation.

1. The echo Command

The echo command prints text strings to stdout or redirects data into files.

# Print a simple message to the console
echo "Hello World"
# Output: Hello World

# Redirect text output to create or overwrite a file
echo "server_name=production" > config.env

# Append text to an existing file without overwriting
echo "PORT=8080" >> config.env

2. The mkdir Command

The mkdir command creates new directories within the file system.

# Create a single directory
mkdir projects

# Create nested directory structures automatically
mkdir -p projects/devops/live_project

8. Summary and Key Takeaways

• Three Ownership Levels: Linux evaluates access control across User (u), Group (g), and Others (o).
• Permission Bit Values: Read (r) = 4, Write (w) = 2, Execute (x) = 1. The total octal score determines combined permissions.
• SSH Key Requirement: AWS and Linux SSH daemons require .pem key files to have strict read-only owner permissions (chmod 400) to prevent unauthorized access.
• chmod Functionality: Alters permission masks using either octal integers (chmod 755 script.sh) or symbolic operators (chmod u+x script.sh).
• chown Functionality: Updates user and group ownership assignments on files and directories (sudo chown user:group file).
• Directory Execution Bit: The execute permission (x) on a directory is required for a user to traverse into it using cd.
• Basic Shell Interaction: Commands like echo output strings and write configuration data, while mkdir establishes directory structures on remote systems.