chmod 750: Owner Writes, Group Reads, Others Shut Out

750 is the mode that makes the two account model work: a deploy user owns the tree and can change it, a service group can read and traverse it to run the application, and no other local account can even list what is there. It is the natural pair to a directory owned by something like deploy:www-data.

The zero for others is doing real work. Without the execute bit, an account outside the group cannot traverse into the directory even to open a file whose exact name it already knows, so 750 stops path guessing dead. That is a meaningfully stronger position than 755, where any account can read every file it can name.

The failure mode is specific and common: the service is not actually in the group. A web server running as one user against a tree owned by deploy:deploy gets a forbidden response, and because the request never reaches the application, the application logs show nothing at all. Check the group membership of the running process before touching the mode again.

Every parent directory matters here too. A 750 directory inside a 755 tree is private; a 755 directory inside a 750 tree is not reachable by anyone outside the group, no matter how open the inner directory is. Permissions are evaluated at every step of the path, and the tightest step wins.

For files inside such a tree, 640 is the matching mode: owner read and write, group read, others nothing. Keeping directories at 750 and files at 640 is a clean and defensible layout for an application that holds configuration with credentials in it.