When encountering permission denied errors (403 Forbidden on Nginx or EACCES: permission denied on Node.js), developers are often tempted to run chmod -R 777 /var/www.
While 777 makes the error vanish immediately, it also allows any local process, compromised daemon, or unauthorized user to overwrite scripts, inject webshells, or read database credentials.
Here is a practical breakdown of how Linux permissions work, how to calculate octal numbers with the 4-2-1 rule, and the standard permission configurations for production web servers.
The 4-2-1 Octal Calculation Rule
Every Linux file and folder has three security tiers:
- User (Owner): The account that owns the file.
- Group: Other accounts belonging to the owner's team/group.
- Others (World): Every other process and account on the system.
Each tier has three basic access rights represented by octal powers of two:
- Read (
r) = 4 - Write (
w) = 2 - Execute (
x) = 1 - None (
-) = 0
To determine the octal number, simply sum the numbers for each tier:
Read + Write + Execute= $4 + 2 + 1 = \mathbf$Read + Execute= $4 + 0 + 1 = \mathbf$Read + Write= $4 + 2 + 0 = \mathbf$Read Only= $4 + 0 + 0 = \mathbf$
Standard Linux Permission Matrix
| Octal | Symbolic Notation | User (Owner) | Group | Others | Standard Production Usage |
|---|---|---|---|---|---|
644 | -rw-r--r-- | Read & Write | Read Only | Read Only | Standard Web Files: HTML, CSS, JS, images, text files. |
755 | drwxr-xr-x | Read, Write, Exec | Read & Exec | Read & Exec | Standard Web Directories: Allows web server to traverse folders. |
600 | -rw------- | Read & Write | None | None | Sensitive Keys: SSH private keys (id_rsa), .env files. |
700 | drwx------ | Read, Write, Exec | None | None | Private Folders: ~/.ssh directory, root script folders. |
777 | -rwxrwxrwx | Full Access | Full Access | Full Access | DANGEROUS: Never use in production. Any process can overwrite. |
Files vs. Directories: Why Directories Need Execute (x)
A common point of confusion is why directories require the Execute (x) bit:
- On a file, execute permits the operating system to run it as a binary or shell script.
- On a directory, execute allows an account to enter (traverse) the directory via
cdand read metadata of files inside.
If you set a web root directory to 644, Nginx or Apache will throw a 403 Forbidden error because the web worker (www-data or nginx) cannot traverse through the parent directory.
The Safe Production Bulk Command
To restore broken permissions across an entire project safely:
# Set all directories to 755
find /var/www/html -type d -exec chmod 755 {} +
# Set all files to 644
find /var/www/html -type f -exec chmod 644 {} +
# Lock down sensitive environment files
chmod 600 /var/www/html/.env
Interactive Chmod Calculator
Need to visually toggle Read, Write, and Execute bits with instant symbolic and octal conversion? Use our client-side utility:
- Chmod Permissions Calculator — Visual checkbox matrix with one-click Linux terminal commands.
- Nginx Reverse Proxy Generator — Generate secure upstream and SSL Nginx server blocks.
Disclaimer: This article is for educational purposes only and does not constitute financial, legal, or medical advice. Consult a qualified professional for guidance specific to your situation.