chmod 700: Private Directories Such as ~/.ssh

700 is the private directory mode. Nothing outside the owning account can list the names, traverse into it, or reach anything below it, no matter how open the contents are. That last part is the useful property: a 644 file inside a 700 directory is unreachable by other accounts, because the path cannot be resolved past the directory.

SSH depends on this. With StrictModes on, which is the default, the daemon refuses to use ~/.ssh/authorized_keys if the directory or the home directory is writable by anyone but the owner, and the client refuses to load a private key whose mode is too open. The result is a plain authentication failure on the client side and a line in the server log that people rarely think to check.

It is also the right mode for anything holding local state you would not want another account reading: ~/.gnupg, ~/.aws, ~/.kube, a directory of database dumps, a scratch area used by a cron job. Combine it with 600 on the files inside and there is no path by which another local account reaches the contents.

The catch is that 700 blocks services too. A web server that needs to read something under a 700 home directory cannot, and no mode on the inner file will change that. Either move the content somewhere the service can traverse, or open the specific directory to 711 so it can pass through without being able to list.

Directories deeper in the tree do not override a 700 parent. Permissions are checked at every component of the path, so the most restrictive step decides the outcome. When a permission denied makes no sense, run namei -l on the full path and read the modes from the root downwards.