# Guided Exercise: Pick the Minimal Permission, Not the Easy One

This is a paper exercise — commit to an answer before checking it in the Lab.

## Your task

For each situation, write the exact `chmod` octal value that grants the MINIMUM permission
actually needed:

1. A private SSH key file — only the owner should ever read or write it, nobody else, no
   execute for anyone.
2. A shared script every user on the system should be able to run, but only the owner should be
   able to edit.
3. A log file every user should be able to read (for troubleshooting), but only a logging
   service (the owner) should write to it.

## A worked shape to check yourself against

1. `600` — owner read+write (6), nothing for group or other (0, 0). This is the real, standard
   permission for private SSH keys — SSH itself refuses to use a key file that's more open than
   this.
2. `755` — owner read+write+execute (7), group and other read+execute (5, 5) so they can run it
   but not modify it.
3. `644` — owner read+write (6), group and other read-only (4, 4).

## Instructor Notes

**Facilitation:** Item 1 is a good moment to mention that this isn't a hypothetical rule — SSH
genuinely refuses to use an overly-permissive private key file, a real-world consequence of
exactly this principle.

**Approximate timing:** 8-10 minutes live discussion; 5 minutes self-paced.