chmod 400: read-only for the owner, nothing for anyone else

What chmod 400 means

In 400 the first digit is the owner, the second the group and the third everyone else: the owner gets read only, the group gets no access at all, and others get no access at all.

ls -l shows -r--------. The 4 is read alone and the two zeros remove every bit from the group and others. Compared with 600, the only change is that the owner loses write, so an accidental redirect or an editor save fails instead of silently replacing the contents.

SSH keys and AWS .pem files

The OpenSSH client refuses a private key you own if group or others have any permission bit on it, and prints "UNPROTECTED PRIVATE KEY FILE". Both 400 and 600 satisfy that check, because the rule is about the group and other digits, not the owner's write bit. AWS's EC2 instructions use chmod 400 key.pem for the key pair you download, which is why so many guides repeat that number.

Choose 400 for a key that should never change once written, and 600 when a tool needs to rewrite the file in place, for example a credentials file a CLI refreshes. Either is a correct answer for an SSH key.

Other secrets that suit 400

TLS private keys, API tokens written once by a provisioning script, and recovery codes are all good candidates. Configuration-management tools often deploy them at 400 owned by the service account, so the service can read the secret but a bug in it cannot overwrite it.

Limits and pitfalls

400 is not a lock. The owner can run chmod u+w at any time, root ignores the bits, and rm only needs write on the directory, so the file can still be deleted. A key copied with scp or extracted from an archive may arrive at 644, so check the mode after moving it. If a service in another account must read the secret, 400 is too strict; use 440 or 640 with a shared group rather than making it world-readable.