Fix permission denied errors

"Permission denied" means Linux checked who you are and what the file allows, and the answer was no. Every file has an owner, a group, and three sets of permissions (read, write, execute) for the owner, the group, and everyone else. This guide shows you how to see those settings, understand them, and fix them without opening everything up.

Before you begin

• SSH access to your VPS as a user with sudo rights, such as alex.
• The exact path and command that produced the error. Copy the message word for word.

Step 1: Find out who you are

Before you touch any permissions, confirm which account is running your command. The whoami command prints your user name, and id also lists the groups you belong to.

whoami
id

alex
uid=1000(alex) gid=1000(alex) groups=1000(alex),27(sudo),33(www-data)

Groups matter. In this example, alex belongs to the sudo group, which allows admin commands, and to www-data, the account nginx uses.

Step 2: Read the permissions

The ls -l command shows the permission string for each file. The first character is the file type, then come three groups of three letters: owner, group, and others. A letter means the permission is granted, and a dash means it is not.

ls -l /var/www/site

-rw-r--r-- 1 alex     alex     612 Oct 31 09:10 index.html
-rw------- 1 root     root     218 Oct 31 09:12 private.conf
drwxr-xr-x 2 www-data www-data 4096 Oct 31 09:14 uploads

The string rw-r--r-- means the owner can read and write, and everyone else can only read. For the folder uploads, the leading d marks it as a directory. To check one path precisely, use stat, which prints the octal mode such as 644:

stat -c '%a %U:%G %n' /var/www/site/index.html

644 alex:alex /var/www/site/index.html

Step 3: Fix ownership

If the service or user that needs access is not the owner, change the owner with chown. The -R flag applies the change to a folder and everything inside it. Use the account your web server or app runs as, not your personal account.

sudo chown -R www-data:www-data /var/www/site/uploads

Only change ownership on folders your service must write to. Files that only need to be read should stay owned by you.

Step 4: Fix the mode with precise permissions

Numeric modes are the clearest way to set permissions. Each digit adds up the read (4), write (2), and execute (1) bits. Typical values are 644 for files that anyone may read but only the owner may change, and 755 for folders and programs.

sudo chmod 644 /var/www/site/index.html
sudo chmod 755 /var/www/site/uploads

For files that hold secrets, such as the private.conf file above, keep everyone except the owner out:

sudo chmod 600 /var/www/site/private.conf

Step 5: Fix SSH key permissions

SSH refuses to use keys that other people can read or write. This is one of the most common causes of "Permission denied (publickey)". Lock down your key folder and key file:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Run this on the server, where your public key lives in authorized_keys. If you use a private key on your computer, its file should also be 600.

Step 6: Use sudo for admin tasks, not for everything

Run a single command as an administrator with sudo, rather than working as root all day. That keeps accidents small. If you need to edit a protected file, open it with sudo, and let sudo ask for your password:

sudo nano /etc/nginx/sites-available/default

To check that a user has sudo rights, run sudo -l. It lists the commands you are allowed to run.

Troubleshooting

• "Permission denied (publickey)" when you connect. The server's ~/.ssh folder or authorized_keys file has the wrong mode. Apply the commands in Step 5, then try again.
• "alex is not in the sudoers file". Your account has no sudo rights. Ask the account owner to add you, or use the provider's console as the root account to fix it. Never edit /etc/sudoers directly; use sudo visudo, which checks the syntax before saving.
• The web server returns 403 Forbidden. nginx cannot read the files. Check that the directories above the site folder, such as /var/www, are executable (x) for others, and that the files are readable.
• "Operation not permitted" even with sudo. The file may have the immutable flag set. Check with lsattr file, and remove it with sudo chattr -i file only if you know why it was set.

Next steps

Now that you can read permissions, you can keep your server tidy. Learn how to find the largest files filling your disk in the guide on freeing up disk space, and look at who is listening on your network in the guide on open ports.