chmod 400: Read Only Keys and Downloaded PEM Files

400 is the mode people are told to apply to a downloaded key pair, and it is a good instruction. A cloud provider hands you a PEM file once, you will never legitimately edit it, and SSH will refuse to use it if anyone but the owner can read it. Removing the owner's write bit as well means an editor or a careless redirect cannot damage the only copy you have.

The difference from 600 is only that write bit, and it decides how the file is meant to be used. 600 is for a secret that changes: an environment file, a credentials file that a tool rewrites, a token that rotates. 400 is for a secret that is written once and read forever, where any write at all would be a mistake.

SSH is satisfied by either. Its check is that group and others have no access to the private key, so 400 and 600 both pass and 640 or 644 both fail with the unprotected private key warning. Choosing 400 adds protection against yourself rather than against another account.

The friction appears at rotation time. Replacing a 400 key means changing the mode first or removing the file and writing a new one, and scripts that expect to overwrite it in place will fail. That is a reasonable trade for a file whose whole security value is that it is never modified, but it should be a deliberate choice rather than a surprise.

As always, this is not encryption. Root reads it, your own account reads it, and any program running as you reads it. If the key needs to survive a stolen laptop, protect it with a passphrase when it is generated, or keep it in an agent or a hardware token rather than relying on a mode.