Lab — Permission Challenge

chmod 600 means only the owner reads and writes: the pattern for SSH private keys, API tokens, and .env files. chmod 644 means the owner writes and everyone may read: the pattern for public notes, web HTML, or a README. chmod 777 means everyone may read, write, and execute: the pattern attackers search for with find … -perm -0002, because they can inject content that a privileged user or cron will later trust.

Your eyes must connect ls -l to the octal. -rw------- is 600. -rw-r--r-- is 644. -rwxrwxrwx is 777. If you cannot translate both ways, you will mis-set a key file and still feel safe because "I ran chmod." The lab forces the translation on files you own, where mistakes are cheap and reversible.

Directories need a separate mental model: execute on a directory is "traverse," not "run as a program." For this lab you focus on regular files first. When you mkdir under cyberlium-lab, leave directory modes sensible (755 or 700). Do not chmod 777 the directory just because a tutorial waved at it — that invites any local user to drop or delete names inside.

Create $HOME/cyberlium-lab/perm-lab if needed. Write secret-practice.txt with a non-secret phrase (never a real password). chmod 600 it, ls -l, confirm -rw-------. Then chmod 644, ls -l, confirm group/other read bits. Then chmod 777 briefly, ls -l, observe the carnival of rwx, and immediately chmod 600 again. The restore step is the security lesson — demos that leave 777 behind train the wrong muscle.

Optional: create public-notes.txt as 644 and compare side by side with ls -l. Read both with cat as yourself — you are the owner, so both work. Understanding "others" requires either another account on a machine you own or simply trusting the mode bits as the kernel's rulebook. Do not create accounts on a shared school server without admin approval just to "test."

chown is out of band for the core challenge unless you administer the box and understand useradd. Wrong chown on system files breaks packages. Stay with chmod on your files. If a command asks for sudo to chmod your own file under $HOME, stop — something else is wrong (path, immutable attribute, or you are not where you think).

World-writable files and directories are persistence candy: drop a cron script fragment, rewrite a config a service reloads, or poison a shared upload directory. Defenders hunt -perm -0002 and sticky-bit exceptions on purpose. Your lab 777 file is a controlled sighting so you recognize the ls -l pattern later without practicing on /var/www.

600 is not paranoia theater for keys — it is the expected mode. sshd may refuse a private key that is group- or world-readable. Learning that in a lab with a fake file is cheaper than debugging a production login failure after you "fixed" permissions with 777.

Scope reminder: only your VM/WSL/spare machine; only files you create under $HOME/cyberlium-lab; no chmod on /, /etc, or other users' homes; no privilege escalation against shared hosts. Permissions are power — keep the blast radius inside your playground.

Copy the commands into your own shell. After each chmod, read ls -l before the next change. End with a locked file or a deleted throwaway. Write one line in a notes file: "777 was a demo; 600 is for secrets."

mkdir -p "$HOME/cyberlium-lab/perm-lab"
cd "$HOME/cyberlium-lab/perm-lab" || exit 1

echo "practice secret — NOT a real password" > secret-practice.txt
chmod 600 secret-practice.txt
ls -l secret-practice.txt    # expect -rw-------

chmod 644 secret-practice.txt
ls -l secret-practice.txt    # expect -rw-r--r--

chmod 777 secret-practice.txt
ls -l secret-practice.txt    # expect -rwxrwxrwx — DEMO ONLY

chmod 600 secret-practice.txt
ls -l secret-practice.txt    # locked down again

echo "public note" > public-notes.txt
chmod 644 public-notes.txt
ls -l

chmod -R 777 /
chmod 777 ~/.ssh/id_rsa
chmod 777 /etc

You have now felt 600, 644, and 777 on disk and restored a safe ending state. That loop — change, verify, restore — is how professionals touch permissions without turning a fix into an incident. Next up — Quiz — Permissions — checks the translations without your terminal scrollback.