[beginner] [raspi4] [user rights] which user-rights concept for home network with raspi4, ext. HDD (2bay), NAS, Windows PC

    first of all:

    I have little to no knowledge about setting up networks, user rights and security concepts.

    my setup:

    My Raspberry Pi 4 runs libreelec/kodi, is connected to my home network and my TV. An 2bay external HDD case with 2x1 TB (JBOD, NTFS file system with some mkv- and mp3-files on it) is connected via USB to the raspi. I just bought a 2bay NAS (qnap TS-230) with freshly installed 2x 1TB HDDs (as static volumes) for the purpose of putting mkv- and mp3-files on it, so I can play them on my raspi and maybe on my android tablet (with VLC player). Last but not least I have a Windows 10 PC in daily use in the network.

    my questions:

    - since I am a noob in regards of security and configuration, what are the main steps to make libreelec more safe than the default state?

    - what are the main differences between "profiles" and "users"?

    - if I set up users with read-only-rights - what might be a good concept?

    - do I have to set up user rights within libreelec and kodi separately?

    bonus question:

    - since I only play mkv- and mp3-files from LE/kodi which I provide from sources which don't come from the raspi/LE/kodi - does the LE/kodi need internet connection at all?

    I have understood what your RPi4 configuration is but I don't understand your questions.

    As far as I know LibreELEC only manages a single user: root. Kodi can handle something it calls 'profiles' that allow you to configure media content for other users, for example children; the latter has nothing to do with data access permissions, because they are always from the root user.

    If you connect your hard drives to a USB port it will be impossible for you to restrict permissions and assign read-only to local users. Even remote access to LibreELEC from SSH or SAMBA is done from the root user.

    If you connect your hard drives to a network through a NAS then you may be able to create users and access permissions to the content of your hard drives.

    Does this answer your questions?