Users, permissions and who sees what

6 min · 9 sections

A home NAS is used by several people, and not all of them need to see the same things. This guide explains the four layers that decide who sees what, why there are four, and which one to change in each case.

The underlying rule, which answers half the questions: the NAS decides, not the icon. Hiding an app does not protect it; the permission is checked on the server every time.

1. The four layers

Layer	Decides	Where you change it
The account	Whether that person exists and can log in	`Control Panel → Users and groups`
The apps	Which apps they see on the desktop, and at what level	That account's card → Apps
The folders	Which shared folders they enter, and whether they can write	`Control Panel → Shared folders → Permissions`
The protocols	How they can reach it: panel, SMB, SFTP, WebDAV	That account's card

They are independent on purpose. Taking the Files app away from someone does not close the folder over SMB: those are two different doors, and a real household uses both.

2. The account

Creating an account creates up to three things at once: the panel one, the system one (SSH/SFTP) and the SMB one. The password is set once and goes to all three.

From then on they are separate. Changing the panel password does not change the SMB one. It is what confuses people most at first, and it has a reason: they are different password systems and the NAS cannot know the SMB one once it is stored.

Each person also gets their own folder — "My drive" — that only they see. There is nothing to create or share: it exists as long as the account does.

Panel roles

Administrator. Everything, including creating accounts and touching the system.
Normal. Whatever has been granted, no more and no less.

There is no middle role, and that is deliberate: what other systems solve by inventing roles is solved here by granting individual screens (section 4).

3. Apps: three levels

Each app is shared out with one of these:

No access — the icon does not even appear.
View — it opens and can be looked at; the buttons that write are not there.
Use — look and touch.

This is what a brand-new account gets, with nothing changed:

App	Out of the box	Why
Files	Use	Their "My drive" and whatever is shared with them
Gallery	Use	Their photos
Notepad	Use	Their notes
Downloads	Use	Fetching things with the NAS
Calendar and contacts	Use	Their calendar is theirs
Overview	View	How the machine is doing, without touching it
Monitor	View	CPU, memory, network and disk usage
Cameras	No access	Watching the house is not for everyone
Backups	No access	And only View can be granted
Storage	No access	And only View can be granted
Package Centre	No access	⚠️ See the warning below
Docker	No access	⚠️ See the warning below
Virtual machines	No access	⚠️ See the warning below
Terminal	No access	Administrators only

Two apps cannot be granted in full. Backups and Storage only accept "View". Touching them means creating and destroying volumes, or changing where the whole household's backup goes: that is administering the machine. Offering a "Use" that did not actually let you touch anything would be lying on screen.

⚠️ Three apps hand over the machine through another door. Package Centre, Docker and Virtual machines can be granted — that is what this is for — but whoever installs an app, starts a container or brings up a machine can mount system folders inside it. The screen warns you before you save. Grant them only to people who really administer.

4. The Control Panel, screen by screen

The Control Panel is not all-or-nothing. Each screen is a permission, with the same three levels, and the Control Panel icon appears if any of them is granted.

A new account starts with its own things and the harmless ones open, and everything that administers the machine closed:

Out of the box	Screens
Use	Account security (their password and 2FA)
View	How to get in · Machine information · Language and time
No access	All the rest

The rest, by group, so you know what you are granting:

Sharing — Shared folders, File services.
People — Users and groups ⚠️, Account security, Directory ⚠️.
Connectivity — How to get in, External access, VPN ⚠️, DNS ⚠️, DHCP ⚠️, SSH console ⚠️, Calendar and contacts, Printer, SNMP.
Security — Security adviser, Firewall ⚠️, Password policy, Country blocking, Ransomware watch, Antivirus, Automatic blocking.
Machine — Machine information, Licence, Network ⚠️, Language and time, Portal, USB devices, Space usage, UPS, Power on and off ⚠️.
Maintenance — Diagnostics, Logs, Updates ⚠️, Scheduled tasks ⚠️, Alerts, Configuration backup ⚠️.

⚠️ The marked ones, granted with Use, hand over the machine through another door: whoever manages users can make themselves an administrator, whoever touches the network can leave the NAS unreachable, and whoever has scheduled tasks can make the NAS run whatever they want. The panel warns you before saving.

5. Groups: the rule you only write once

All of the above can be granted to a group instead of a person. "Cameras, for everyone at home" is one rule, not seven.

When there are group and personal rules on the same app:

The personal one wins, even if it is more restrictive. That is what makes "the whole group except so-and-so" possible, which is the exception you always end up needing.
Between two groups the most permissive wins, which is what anyone in both expects.

In practice: build groups around how the house works (adults, guests, the kids), not around apps. One group per app is the list nobody maintains.

6. Shared folders

Sharing a folder and giving someone access are two separate steps, and that is where almost everyone gets stuck:

Create the folder in Control Panel → Shared folders.
Say how it is published: SMB, NFS, WebDAV — each is ticked on that folder, and the protocol also has to be switched on in File services.
Say who gets in: in that folder's permissions, person by person or group by group, with no access / read only / read and write.

Without step 3 the folder exists and nobody sees it. That is the right order: a new folder is born closed.

7. How much space each person gets

Each account's card can carry a quota. With no quota, everyone shares the whole volume and the first person to download a season in 4K takes it.

The quota applies on write, wherever it comes from — panel, SMB or SFTP — and whoever hits it gets a normal "no space left" on their machine.

8. Removing someone

Deleting an account closes everything of theirs at once: the panel login, the system account, SMB, their open sessions, their public links and file requests, their row in every folder's permissions and their app rules.

That last one matters more than it seems: if it were left behind, creating another person with the same name would inherit the previous one's access. In a household that happens — you delete "guest" and create it again months later.

What is not deleted are their files. Their "My drive" stays on the volume. That is deliberate: deleting an account is one click, and deleting someone's data should not be.