User Accounts, Groups, and Permissions in DSM

I've cleaned up the same mess on a few small-office NAS boxes now: rights handed out user by user, and nobody can say who sees what. That works for two people. With ten users and eight shared folders it falls apart. DSM's model is decent (shared folder permissions, application permissions, optional Windows-style ACLs), and it stays manageable once groups sit in the middle of all three.

This is the layout I use on DSM 6.1.

Plan the groups on paper first

Before clicking anything, write down the groups you need. Mine typically look like this:

# Group          Purpose
administrators   built-in, DSM admins only
staff            everybody who logs in
accounting       read/write on the finance share
media-ro         read-only access to media
backup-agents    machines that push backups

Keep group names lowercase and without spaces. I learned that one after fighting with quoting in shell scripts.

Create the groups

Control Panel → Group → Create. Give each group a name and description. On the Permissions page of the wizard you can already assign shared folder access; I usually leave it at No access here and set it per folder in the next step so it is visible in one place.

On the Applications page decide which packages the group may open. For staff I allow File Station and Universal Search only; DSM Desktop login is fine, but they do not need Control Panel or Hyper Backup.

Create the users

Control Panel → User → Create. Fill in the name, description and password, and on the Join groups page tick users and staff plus whatever the person needs. Leave every shared folder at the default (which is inherited from the groups) unless you need an exception. On the Quota page set a home folder quota if the volume is Btrfs; on ext4 quotas are per volume only.

If you have more than a handful of people, use Control Panel → User → Create → Import users. The file is plain text, one user per line:

# username  password  description  email  quota_MB
jsmith  Tmp-Passw0rd!  John Smith  jsmith@example.com  20480
akim    Tmp-Passw0rd!  Anna Kim    akim@example.com    20480

Tick "Send a notification mail to the newly created user" so they get their temporary password, and force a change on first login from Control Panel → User → Advanced.

Shared folder permissions go on groups

Control Panel → Shared Folder → select a folder → Edit → Permissions. Switch the dropdown from Local users to Local groups and set Read/Write or Read only per group. Tick No access for users if the share is confidential, because otherwise membership in the default users group might grant more than you expect.

The effective rule is: No access beats everything, then Read/Write beats Read only. A user in accounting (Read/Write) and media-ro (Read only) on the same share gets Read/Write.

ACLs inside a share

When a single share needs subfolders with different rights, use File Station. I avoid this where I can, since every exception is something I'll forget about. Right-click a folder → Properties → Permission. Untick "Apply to this folder, sub-folders and files" only when you know what you are doing; the default inheritance is what you want most of the time.

From SSH you can inspect the result with Synology's ACL tool:

sudo synoacltool -get /volume1/finance/payroll

Output lists entries like group:accounting:allow:rwxpdDaARWc--:fd--, which is Synology's notation for the Windows ACL bits.

Home folders and application privileges

Enable Control Panel → User → Advanced → Enable user home service. Every user gets /volume1/homes/<username>, mapped to \\nas\home for them. This is also where Cloud Station and Photo Station store personal data.

Application privileges live under Control Panel → Privileges (Control Panel → Application Privileges on some builds). Here you can allow or deny each package per group, and even restrict by IP range, which is useful for allowing DSM login only from the office subnet.

Test with a throwaway user

I always log in as a test user from Windows and try both an allowed and a denied folder:

net use \\nas\finance /user:nas\jsmith
dir \\nas\finance\payroll

The denied path should return "Access is denied". In DSM, Control Panel → Shared Folder → Edit → Permissions has a Preview mode that shows the effective permission for any chosen user; use it whenever the result surprises you.

When it goes wrong

• A user is in the right group but still gets "Access is denied": the group has Read/Write on the share but a folder underneath carries an explicit ACL. Check File Station → Properties → Permission on the subfolder.
• Windows says "Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed": the PC already has a session as another account. Run net use * /delete and reconnect.
• synoacltool -get returns ACL not found: the folder uses classic POSIX mode, which happens when the share was created with Windows ACL support unticked. Enable it under Shared Folder → Edit → Advanced.
• New users cannot log into DSM at all: the group lacks DSM login in Application Privileges, or the account is limited to a different IP range.

Groups for rights, users for identity, ACLs only as a last resort. Break that rule once and you'll be debugging it in a year.