.bash* can be 600, but
chmod -R 600 is dangerous.
You can make your home directory accessible to only you:
chmod 700 ~
This doesn't need to be recursive. It's impossible to access a file without accessing a directory that it's in. For a directory, this means that it's impossible to access a directory without accessing its parent directory. So making a directory inaccessible (no
x permission) makes everything under it inaccessible.
(There is one way to bypass the need to access the containing directory, which is to already have access: if a process already has a file open, it stays open, even if something changes that would now make it impossible for the process to open the file. Here “open file” includes having a directory as the process's working directory. The something that changes can be, for example, a permission change, or a move to a different directory, or the process reducing its privileges.)
There are a few circumstances in which you may need to keep parts of your home directory accessible to other users or to system services (e.g. making
.plan accessible to
httpd). They're uncommon nowadays when most people use individual machines which don't run any public services. In such a case:
- Make your home directory traversable by everyone, but only readable and writable by you:
chmod 711 ~
- Make the content of your home directory private:
chmod go= ~/* ~/.[!.]* ~/..?* (non-hidden files, hidden files except
..*, and hidden files starting with
.. other than
.. itself — ignore the error if one of these patterns doesn't match anything)
- Allow read (
r) access, plus execute/traverse (
x) access for directories, to the specific files and directories that need it.
These permissions allow any local user to check whether a file by a given name exists (whether
ls ~jerzy/somefile fails with “permission denied” or “no such file or directory”) but not to list the files in your home directory.
Configuration files for programs that you use, such as bash, don't need to be public. The only processes that need to access them run on your account. You can
chmod 600 ~/.bash* if you like. It won't make any practical difference if your home directory is only accessible to you anyway, but it won't hurt.
If you set your umask to 077, all your new files will be only accessible to you.
Do not run
chmod -R 600. As root, this can make your system so hard to restore that reinstalling is easier. As a non-privileged user, it's easier to recover from, but still painful.
chmod -R 600 removes execute permission from directories, and for a directory, the “execute” permission (the
x in chmod, bit 1 in numerical values) means the ability to access file in that directory. The “read” (
r, 4) permission only allows listing files in the directory. So
chmod -R 600 ~ forbids everyone, even you, from accessing files in your home directory. Then
chmod -R u+X ~ restores execute permissions for directories, but only if the system hasn't crashed in between.
Furthermore the sequence removes execute permission from all regular files. Some regular files need execute permission. This obviously includes any independent software that you may have installed in your home directory, and personal scripts or other programs. This can also include files that aren't generally thought of as directly executable; for example, older versions of Ubuntu used the execute permission to indicate that certain kinds of files were trusted, including
.desktop files (though newer versions don't use this mechanism anymore).
The sequence also makes all files writable. It can be useful to make some files read-only, for example important files that you wanted to avoid overwriting or deleting accidentally. Many version control programs make certain files read-only because they're internal state files that normally never change, or to indicate that users aren't supposed to change them directly, or to indicate that a file is locked. However, this is rarely critical.
(Incidentally, there are a few files that must be private, such as SSH keys. A recursive chmod in your home directory that adds non-user permissions would break this, and in particular could make it impossible to log into your account over SSH.)
If you want to make all your files private individually, don't change the permissions that apply to you.
chmod -R go= ~