permissions should be 600