Users, permissions and who sees what

16 min · 12 sections

A home NAS is used by several people, and not all of them need to see the same things. This guide explains the four layers that decide who sees what, why there are four, and which one to change in each case.

The underlying rule, which answers half the questions: the NAS decides, not the icon. Hiding an app does not protect it; the permission is checked on the server every time.

1. The four layers

They are independent on purpose. Taking the Files app away from someone does not close the folder over SMB: those are two different doors, and a real household uses both.

2. The account

Creating an account creates up to three things at once: the panel one, the system one (SSH/SFTP) and the SMB one. The password is set once and goes to all three.

It is changed in the panel, in Control Panel → Your account, and the new one reaches all three at once. It cannot be done from Windows, neither with Ctrl+Alt+Del → "Change a password" nor when Windows says it has expired: it will answer that the new one does not meet the length or complexity requirements, however long it is. That is not the reason: that change would only reach the folders and leave them with a different password from the panel and SFTP. If it has expired, sign in to the panel: it asks for the new one, and with it the folders and SFTP open again.

Each person also gets their own folder — "My Drive" — with their Photos, Music, Videos, Documents and Downloads folders already made: Gallery, Music, Movies and Downloads use them on their own. There is nothing to create: it exists as long as the account does, and it is private — nobody else gets in except into what its owner shares (Sharing your things). Which services take it out onto the network is decided in Household folders (section 6).

Panel roles

• Administrator. Everything, including creating accounts and touching the system.
• Normal. Whatever has been granted, no more and no less.

There is no middle role, and that is deliberate: what other systems solve by inventing roles is solved here by granting individual screens (section 4).

The first time they sign in, each account sees a three-screen welcome that tells them, in short, what this section says: what their My Drive is, what "Shared with me" is and what "Household" is.

See everything in every account

Whoever administers also sees only their own things out of the box: their My Drive, what others share with them and the household folders. Other people's photos, music or documents do not show up.

If seeing everyone's things is needed — to help someone, or to tidy up the NAS — switch it on in Control Panel → Your account → "See everything in every account". When it is on, an "Everyone's" tab appears in Files, Gallery, Music and Movies, view only, and every other account sees a notice saying the administrator can see it. It is a setting of each administrator: one switching it on does not switch it on for the others.

3. Apps: three levels

Each app is shared out with one of these:

• No access — the icon does not even appear.
• View — it opens and can be looked at; the buttons that write are not there.
• Use — look and touch.

This is what a brand-new account gets, with nothing changed:

Cameras, Backups and Storage cannot be granted in full: they only accept "View". With "View", Cameras shows the live view and the recordings of the cameras they are allowed to see (each camera says who sees it: Cameras); adding a camera, moving it or keeping a recording so the cleanup does not delete it is for whoever administers. Touching the other two means creating and destroying volumes, or changing where the whole household's backup goes: that is administering the machine too. Offering a "Use" that did not actually let you touch anything would be lying on screen.

With View, no app shows buttons that the NAS would then refuse; what is your own — your favourites, your lists, where you are in a movie — is still saved.

⚠️ Three apps hand over the machine through another door. Package Centre, Docker and Virtual machines can be granted — that is what this is for — but an app, a container or a machine works with the folders it is given. Someone who does not administer can only give them their own folders or the ones they are allowed to change, and the NAS checks again every time they start; the NAS network, the graphics card and USB devices always belong to whoever administers. Even so, the screen warns you before you save: grant them to people who know what they are doing. Apps and containers belong to the whole household. Virtual machines, on the other hand, belong to whoever creates them, who can share them with "Can view" or "Can use it"; the ones that already existed stay within reach of whoever had the app.

Profiles: Family, Child and Guest

When adding someone there is no need to go app by app: pick a profile and the NAS ticks the boxes.

"Adjust by hand" is still there for anyone who wants to choose box by box. Each account's card says which profile it has; if someone changes a single box, it says "Custom", which is the truth. Choosing a profile again puts it back.

4. The Control Panel, screen by screen

The Control Panel is not all-or-nothing. Each screen is a permission, with the same three levels, and the Control Panel icon appears if any of them is granted.

A new account starts with its own things and the harmless ones open, and everything that administers the machine closed:

The rest, in the same groups and with the same names as the Control Panel home page, so you know what you are granting:

• File sharing — Household folders, File services.
• Users and permissions — Users and groups ⚠️, Your account, Directory service ⚠️.
• Network — Network ⚠️, Addresses, DNS ⚠️, DHCP ⚠️, SSH ⚠️, SNMP, Smart home.
• Access from outside — External access, VPN ⚠️.
• NAS services — Calendar and contacts, Printer.
• Security — Security advisor, Firewall ⚠️, Passwords, Country blocking, Report and trap, Antivirus, IP blocking.
• System — System information, Licence, Region and language, Display, Login portal, Space report, UPS, Shut down and restart ⚠️.
• Administration — System check, Log center, Scheduled tasks ⚠️, Alerts, Bring over your old NAS data ⚠️.

Update LGM-OS, Configuration backup, Graphics and Factory reset are not on the list: they belong to administrators only and cannot be granted to anyone else.

⚠️ The marked ones, granted with Use, hand over the machine through another door: whoever touches the network can leave the NAS unreachable, and whoever has scheduled tasks can make the NAS run whatever they want. The panel warns you before saving.

What always belongs to whoever administers

Granting a screen opens the everyday things, not what could leave the NAS unreachable, open to the internet or in someone else's hands. Even if someone has the screen with Use, this stays with whoever administers only:

• In Users and groups: setting or changing another person's password, second factor, passkeys or SSH keys; changing their role; deleting accounts; closing other people's sessions; creating administrators or touching someone with more permissions than yourself; taking someone out of a group with permissions or deleting that group. Someone who manages accounts without administering adds people by invitation link, and cannot change their own limits (space, schedule, end date).
• In network and security: the network, the firewall, switching SSH on or giving an account the console, access from the internet (name, certificates, tunnel, ports), the VPN, country blocking, and joining or leaving a domain.
• On the machine: shutting down and restarting, cancelling other people's print jobs and deleting duplicate files across the whole household.

If someone tries, the NAS tells them why they cannot and to ask whoever administers.

Approval by a second administrator

Business edition only. Control Panel → Users and groups → Approvals.

With "Destructive actions need approval from another administrator" turned on, nobody can, on their own, wipe out something whole or release what protects it. These stay pending:

• deleting a volume, a shared folder, an account or a snapshot;
• removing the lock from a snapshot or a folder's deletion lock;
• making an account an administrator, taking that away, or changing the password (or sign-in link) of another account that administers: otherwise you could simply make yourself a second administrator;
• restoring the configuration from a backup, which brings back every account;
• and turning the rule itself off.

Whoever asks is told it is pending, and the other administrators get a notification (in the bell and through the Alerts channels). One of them approves or rejects it in Approvals; never the same person who asked. Once approved, whoever asked does it again and it goes through: it is good once, only for that account and for that exact thing. Anything nobody approves expires after 24 hours. Everything (asking, approving, rejecting and doing it) is recorded in the Log centre.

With only one administrator it cannot be turned on: there would be nobody to approve anything. If the rule is ever on with a single administrator left, the only thing allowed without approval is turning it off.

5. Groups: the rule you only write once

All of the above can be granted to a group instead of a person. "Cameras, for everyone at home" is one rule, not seven.

When there are group and personal rules on the same app:

• The personal one wins, even if it is more restrictive. That is what makes "the whole group except so-and-so" possible, which is the exception you always end up needing.
• Between two groups the most permissive wins, which is what anyone in both expects.

In practice: build groups around how the house works (adults, guests, the kids), not around apps. One group per app is the list nobody maintains.

6. Household folders

Sharing a folder and giving someone access are two separate steps, and that is where almost everyone gets stuck:

1. Create the folder in Control Panel → Household folders.
2. Say how it is published: SMB, NFS, WebDAV — each is ticked on that folder, and the protocol also has to be switched on in File services.
3. Say who gets in: in that folder's permissions, person by person or group by group, with no access / read only / read and write.

Without step 3 the folder exists and nobody sees it. That is the right order: a new folder is born closed.

That same card has a switch, Empties itself, for the there-and-back folder — the one you swap things through with the household, the one phone uploads land in: every day it takes out whatever has been untouched for more than N days, instead of letting it grow until it fills the volume. It comes switched off, and it is covered in Files.

My Drive has its own row in Household folders, above the others: a main switch and the same SMB, NFS and WebDAV badges. There are no permissions to hand out here: each account gets into its own and only its own, through any of the three. As with the other folders, each service also has to be switched on in File services.

• SMB comes on: in Windows it is \\NAS\home (or the account's name).
• NFS asks for no password, so it does not turn on without a list of machines allowed to mount it —their IP or their network—, and only those mount it.
• WebDAV puts it at https://<NAS>:8081/~<account> for the accounts that have **Web access to the files** on their record. It is what LGM Connect uses to open it from outside the house.

Switched off, My Drive does not go out onto the network, but the files are not touched and it still shows in Files. SFTP is separate: it is granted on each account's record and always lands in their My Drive.

Sharing your things with someone at home

You share what is in your My Drive yourself, without asking anyone. There is a "Share" button, the same in Files, Gallery, Music, Movies, Cameras and Virtual machines: a window opens with the people at home (and the groups, if there are any), you tick whoever you want and choose "Can view" or "Can change" (on a virtual machine, "Can use it").

• Whoever receives it gets a notice with "Open", and finds it in that app's **"Shared with me"** tab.
• In Control Panel → Your account there is "What you share", to stop sharing with one tap, and "Shared with me", to open it or "Stop receiving".
• To gather several people's photos there is the shared gallery: it is an invitation, and only those who accept get in (Gallery).
• Household folders are still handed out as before, with their permission list in Household folders.

In the apps, all this shows in the same tabs: Mine, Shared with me and Household (and Everyone's, only for an administrator with "See everything in every account" on). Each app remembers which one you left it on.

7. How much space each person gets

Each account's card can carry a quota. With no quota, everyone shares the whole volume and the first person to download a season in 4K takes it.

The quota applies on write, wherever it comes from — panel, SMB or SFTP — and whoever hits it gets a normal "no space left" on their machine.

When someone reaches 90 % of their limit, the panel warns the administrator —with where to raise it— and the person, if they use the panel, so they can make room. Once per scare: if they drop below 85 % and fill it again, it warns again.

8. Removing someone

Deleting an account closes everything of theirs at once: the panel login, the system account, SMB, their open sessions, their public links and file requests, their row in every folder's permissions and their app rules.

Along with them go what they shared and what was shared with them, their desktop wallpaper, their Gallery searches, their notices and their "See everything in every account".

That last one matters more than it seems: if it were left behind, creating another person with the same name would inherit the previous one's access. In a household that happens — you delete "guest" and create it again months later.

What is not deleted are their files. Their "My Drive" stays on the volume. That is deliberate: deleting an account is one click, and deleting someone's data should not be.

The accounts and groups the NAS itself uses (those of its services and the administrators' group) cannot be deleted: their row says so and explains why.

9. API keys

For scripts and home automation that talk to the NAS without a password or a browser. Each account creates its own in Control Panel → Your account → API keys: a key is shown only once, expires when you say and can be limited to some apps. Use it as Authorization: Bearer lgm_… on any API route, with whatever its owner can do. A key never changes the password or the account: that is done in the panel, with the password. It does not open the panel's live connections either (the monitor, the console, the camera live view: they go over WebSocket and need the browser session), nor does it download the support report; and a key limited to some apps does not reach the document editor or anything that does not belong to those apps. When an account is removed, its keys go with it.

10. SSH keys

So that a laptop can run rsync backups, or an SFTP client can get in, without typing the password. Each account pastes its machine's public key (the one ending in .pub) under Control panel → Your account → SSH keys, and the administrator can add one to any user's card («Users and groups → the account → Access»). A key opens nothing the account does not already have: it needs an SSH console or SFTP. When an account is removed, its keys go with it.

See also

• Files — download links, file requests and the recycle bin.
• Connecting your devices — SMB, SFTP and WebDAV on each device.
• When something is not working — "I get in but cannot see this".

11. Duplicating an account and inviting by link

Duplicate (in the users list) creates an account with the same apps, folders, groups, space limit, panel access and doors as another one; the password is a new one. And instead of typing the password yourself, tick “Let them set it with a link”: the account is born closed and you get a single-use link, valid for 48 hours, for that person to set their password from their phone. The link is shown once; if it gets lost, generate another one from “Edit” and the previous one stops working. Only for people's accounts: neither system nor domain ones.

The link carries the address the NAS is reached at from outside the house (the one you are using, or the NAS one), so it also opens on a phone using mobile data. And it is the only way to add people for someone who manages accounts without administering: the password is always set by the person themselves.