Paths/DevOps Engineer/Security & Hardening / Secrets & Credentials
Keep a Credentials File Private
Application secrets belong in one file with owner-only permissions. Create ~/app/.env with an API key and lock it down to mode 600 so no other account on the machine can read it.
Validator
IDLE — checks run live as you type commands; submit when done
01Requirements
live checks- Directory ~/app exists○
- File ~/app/.env exists and holds the API key○
- Permissions on ~/app/.env are 600 (owner read/write only)○
02Walkthrough
6 steps- 01
Create the application directory
One folder per service keeps configuration next to the code that reads it.
mkdir ~/app - 02
Write the environment file
The dot prefix is a convention: it signals to other engineers that the file holds secrets. KEY=value pairs, one per line, no spaces around the equals sign.
echo 'API_KEY=sk-live-9f2b7c41ae' > ~/app/.env - 03
Check the default permissions
ls -l prints the mode in the first column. A new file is usually -rw-r--r-- (644): readable by every account on the box.
ls -l ~/app - 04
Restrict it to the owner
chmod 600 gives the owner read and write and everybody else nothing. This is the same mode SSH expects for a private key.
chmod 600 ~/app/.env - 05
Verify the new mode
The listing now starts with -rw-------.
ls -l ~/app - 06
Submit for validation
The validator checks the directory, the file, its contents and its mode.
03Stuck?
0 of 3 revealedTake a hint without losing the lab — each one points at the thing to look at, not at the answer.
04AI Tutor
guides, never solvesTell me what you're stuck on — I'll nudge, not solve. Which requirement are you looking at?
04Notebook
saved locally in this browserlearner@lab — ubuntu:24.04
Session is disposable
↑/↓ recalls commands · Ctrl+Enter submits · type help for the command list