diff --git a/telegraf/agent.sls b/telegraf/agent.sls
index 34a28eb..76d23b1 100644
--- a/telegraf/agent.sls
+++ b/telegraf/agent.sls
@@ -12,7 +12,7 @@
     - source: salt://telegraf/files/telegraf.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - require:
       - pkg: telegraf_packages_agent
@@ -23,7 +23,7 @@
   file.directory:
     - name: {{agent.dir.config_d}}
     - makedirs: True
-    - mode: 755
+    - mode: 640
     - require:
       - pkg: telegraf_packages_agent
 
@@ -48,7 +48,7 @@
       - salt://telegraf/files/input/generic.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - require:
       - pkg: telegraf_packages_agent
@@ -87,7 +87,7 @@
     - source: salt://telegraf/files/output/{{ name }}.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - require:
       - pkg: telegraf_packages_agent
@@ -118,7 +118,7 @@
       - salt://telegraf/files/processor/{{ name }}.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - require:
       - pkg: telegraf_packages_agent
diff --git a/telegraf/remote_agent.sls b/telegraf/remote_agent.sls
index d12ee94..7085fa3 100644
--- a/telegraf/remote_agent.sls
+++ b/telegraf/remote_agent.sls
@@ -10,13 +10,13 @@
   file.directory:
     - name: {{remote_agent.dir.config}}
     - makedirs: True
-    - mode: 755
+    - mode: 640
 
 config_d_dir_remote_agent:
   file.directory:
     - name: {{remote_agent.dir.config_d}}
     - makedirs: True
-    - mode: 755
+    - mode: 640
     - require:
       - file: config_dir_remote_agent
 
@@ -35,7 +35,7 @@
     - source: salt://telegraf/files/telegraf.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - onchanges_in:
 {%- for docker_id in docker_ids.split() %}
@@ -69,7 +69,7 @@
       - salt://telegraf/files/input/generic.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - onchanges_in:
 {%- for docker_id in docker_ids.split() %}
@@ -113,7 +113,7 @@
       - salt://telegraf/files/output/generic.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - onchanges_in:
 {%- for docker_id in docker_ids.split() %}
@@ -154,7 +154,7 @@
       - salt://telegraf/files/processor/{{ name }}.conf
     - user: root
     - group: root
-    - mode: 644
+    - mode: 640
     - template: jinja
     - onchanges_in:
 {%- for docker_id in docker_ids.split() %}
diff --git a/telegraf/script.sls b/telegraf/script.sls
index 5424a8f..cb72478 100644
--- a/telegraf/script.sls
+++ b/telegraf/script.sls
@@ -5,7 +5,7 @@
   - name: /usr/local/bin/ovs_parse_bridge.py
   - source: salt://telegraf/files/script/ovs_parse_bridge.py
   - template: jinja
-  - mode: 755
+  - mode: 750
 
     {%- if pillar.neutron.get('gateway', {}).get('enabled', False) == True or pillar.neutron.get('compute',{}).get('dhcp_agent_enabled', False) == True %}
 ovs_arping_check_telegraf_script:
@@ -13,7 +13,7 @@
   - name: /usr/local/bin/check_ovs_arping.py
   - source: salt://telegraf/files/script/check_ovs_arping.py
   - template: jinja
-  - mode: 755
+  - mode: 750
 
     {%- endif %}
   {%- endif %}
@@ -28,7 +28,7 @@
   - name: /usr/local/bin/check_opencontrail_ping.py
   - source: salt://telegraf/files/script/check_opencontrail_ping.py
   - template: jinja
-  - mode: 755
+  - mode: 750
 
   {%- endif %}
 {%- endif %}