Learn NAS - Users, Groups & Permissions

#Introduction

With storage neatly organized in episode 6, the next question is: who can access what? Episode 7 answers this by covering users, groups, and permissions — the foundation of access control on a NAS.

A healthy NAS rarely shares a single account among everyone. With clear users, auditing becomes possible, per-person quotas can be applied, and the risk of misused accounts drops drastically. Clean permissions are also a pre-requisite before shares are opened to the wider network in episode 8.

By the end of this episode you'll be able to create users and groups, connect the NAS to LDAP or Active Directory, apply POSIX permissions and ACLs, and set per-dataset and per-user quotas.

#Local Users and Groups

#Creating Users and Groups

Both TrueNAS SCALE and OpenMediaVault provide user management through the Web UI, backed by local storage on the system. The first step is to design groups for grouping roles, then place users inside them.

groupadd data-teams
useradd -m -G data-teams -s /usr/sbin/nologin devnull
passwd devnull

The useradd command creates the devnull user and adds them to the data-teams group. The nologin shell restricts interactive login access, a pattern recommended for storage accounts.

#The Group-Based Approach

Manage permissions through groups, not per user. A common mapping:

• data-teams for internal teams allowed to read and write.
• data-auditor for users who only need read access.
• nas-admin for storage administrators.

With this pattern, adding a new user just means putting them into the right group without touching per-file permissions.

#LDAP and Active Directory Integration

#When to Use a Directory Service

When the number of users reaches the dozens, managing local users on every machine becomes unsustainable. LDAP and Active Directory (AD) centralize identity so the NAS simply becomes a client of that directory. In TrueNAS SCALE, this feature is available under the Directory Services menu; in OpenMediaVault, through the LDAP/AD plugin.

#Joining Active Directory

To join AD, you need to provide the domain name, a domain account authorized to join, and correct DNS addresses. After joining, AD users can be used directly on SMB shares.

midclt call directoryservices.get_state

The midclt call directoryservices.get_state command shows the synchronization status with the domain. If the status is HEALTHY, domain users can already be used.

#POSIX Permissions

#Basic Modes and Owner

Linux uses POSIX permissions with three actions (read, write, execute) for three classes (owner, group, other). When a share is created, these permissions define the base access before the ACL layer takes over.

ls -l /tank/data/dokumen
chmod 2770 /tank/data/dokumen
chown :data-teams /tank/data/dokumen

The chmod 2770 command enables setgid and gives read-write-execute to the owner and group. Setgid makes new files inherit the directory's group, which is very helpful for collaboration folders.

#ACLs: NFSv4 and SMB ACLs

#What Are ACLs

An ACL (Access Control List) extends POSIX permissions with rules for specific users or groups. On ZFS, the two common ACL styles are NFSv4 ACL and SMB ACL. NFSv4 ACLs are used for Unix-like clients and NFS; SMB ACLs are used for Windows integration through Samba.

chmod A+user:auditor:r-x:allow /tank/data/dokumen
chmod A+user:devnull:rwx:allow /tank/data/dokumen

The chmod A+...:allow command adds explicit NFSv4 ACL rules. This format is hard to memorize, which is why most people manage ACLs through the Web UI's graphical editor.

#POSIX and ACL Interaction

When ACLs are active, basic permissions still act as a safety net. Make sure the owner and group are correct before adding ACL rules. In TrueNAS SCALE, every dataset has an acltype setting that determines whether it uses NFSv4 or POSIX.

#Quotas and Usage Monitoring

#Dataset and Per-User Quotas

Quotas limit storage so one user can't consume the pool's entire capacity. There are two types: dataset quotas that limit a dataset's size, and user quotas that limit storage per user within a dataset.

zfs set userquota@devnull=500g tank/data
zfs userspace tank/data

The zfs set userquota@devnull=500g command caps the devnull user at 500 gigabytes in the dataset. The zfs userspace output shows per-user usage in real time.

#Monitoring Usage

Monitor usage regularly so quotas don't surprise anyone:

zfs list
df -h

The zfs list command shows each dataset's capacity, while df -h shows availability from the mount side. Together they're your daily monitoring instruments, before we cover full monitoring in episode 16.

#Closing

In this episode 7 you built identity and access control: local users and groups, LDAP and Active Directory integration, POSIX permissions, NFSv4 and SMB ACLs, and per-dataset and per-user quotas with usage monitoring.

Key takeaways:

• Manage permissions through groups, not per user.
• Use LDAP/AD when the user count is already large.
• Setgid on collaboration directories inherits the group automatically.
• NFSv4 and SMB ACLs extend control above POSIX permissions.
• Per-user quotas prevent a single account from consuming all capacity.

In the next episode, episode 8, we'll cover networking and basic access — from static IP configuration, bonding/LAG, VLANs and jumbo frames, to mounting SMB and NFS from Windows, macOS, and Linux along with connection troubleshooting. Users and permissions are ready; now it's time to connect the NAS to the network.