.password file needs chmod o-rwx