diff --git a/README.md b/README.md
index 7dbf537e..06c133f2 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,7 @@ sshpiper reads `workingdir/github/sshpiper_upstream` and the connect to the upst
 
 #### User files
 
-*These file MUST be in mode 400*
+*These file MUST NOT be accessible to group or other. (chmod og-rwx filename)*
 
  * sshpiper_upstream
  
diff --git a/sshpiperd/workingdir.go b/sshpiperd/workingdir.go
index 22ae0a99..00b4fd96 100644
--- a/sshpiperd/workingdir.go
+++ b/sshpiperd/workingdir.go
@@ -35,7 +35,7 @@ func (file userFile) realPath(user string) string {
 	return userSpecFile(user, string(file))
 }
 
-// return error if not 400, nil if 400 and no err occurs
+// return error if other and group have access right
 func (file userFile) checkPerm(user string) error {
 	filename := userSpecFile(user, string(file))
 	f, err := os.Open(filename)
@@ -49,8 +49,8 @@ func (file userFile) checkPerm(user string) error {
 		return err
 	}
 
-	if fi.Mode().Perm() != 0400 {
-		return fmt.Errorf("%v's perm is too open, change it to 400", filename)
+	if fi.Mode().Perm()&0077 != 0 {
+		return fmt.Errorf("%v's perm is too open", filename)
 	}
 
 	return nil
diff --git a/sshpiperd/workingdir_test.go b/sshpiperd/workingdir_test.go
index 919486a3..2f5e5685 100644
--- a/sshpiperd/workingdir_test.go
+++ b/sshpiperd/workingdir_test.go
@@ -100,14 +100,14 @@ func TestCheckPerm(t *testing.T) {
 		t.Fatalf("should fail when read 0777 user file")
 	}
 
-	err = os.Chmod(f.realPath(user), 0400)
+	err = os.Chmod(f.realPath(user), 0600)
 	if err != nil {
 		t.Fatalf("cant change file mode %v", err)
 	}
 
 	err = f.checkPerm(user)
 	if err != nil {
-		t.Fatalf("fail when read 0400 user file", err)
+		t.Fatalf("fail when read 0600 user file", err)
 	}
 }
 
@@ -221,7 +221,7 @@ func TestMapPublicKeyFromUserfile(t *testing.T) {
 		t.Fatalf("should return err when file too open")
 	}
 
-	err = os.Chmod(UserAuthorizedKeysFile.realPath(user), 0400)
+	err = os.Chmod(UserAuthorizedKeysFile.realPath(user), 0600)
 	if err != nil {
 		t.Fatalf("cant change file mode %v", err)
 	}
@@ -232,7 +232,7 @@ func TestMapPublicKeyFromUserfile(t *testing.T) {
 		t.Fatalf("should return err when file too open")
 	}
 
-	err = os.Chmod(UserKeyFile.realPath(user), 0400)
+	err = os.Chmod(UserKeyFile.realPath(user), 0600)
 	if err != nil {
 		t.Fatalf("cant change file mode %v", err)
 	}
@@ -255,23 +255,12 @@ func TestMapPublicKeyFromUserfile(t *testing.T) {
 
 	t.Logf("testing not in UserAuthorizedKeysFile")
 
-	// TODO 0400 might be too close, not easy for changing. openssh use og-rw
-	err = os.Chmod(UserAuthorizedKeysFile.realPath(user), 0777)
-	if err != nil {
-		t.Fatalf("cant change file mode %v", err)
-	}
-
 	authKeys = ssh.MarshalAuthorizedKey(privateKey2.PublicKey())
-	err = ioutil.WriteFile(UserAuthorizedKeysFile.realPath(user), authKeys, 0400)
+	err = ioutil.WriteFile(UserAuthorizedKeysFile.realPath(user), authKeys, 0600)
 	if err != nil {
 		t.Fatalf("cant create file: %v", err)
 	}
 
-	err = os.Chmod(UserAuthorizedKeysFile.realPath(user), 0400)
-	if err != nil {
-		t.Fatalf("cant change file mode %v", err)
-	}
-
 	signer, err = mapPublicKeyFromUserfile(stubConnMetadata{user}, privateKey.PublicKey())
 	if signer != nil {
 		t.Fatalf("should not map private key when public key not in UserAuthorizedKeysFile")