Samba Server on Linux: Secure File Sharing

Samba is a free and open-source implementation of the SMB/CIFS protocol that enables file sharing between Linux servers and Windows, Linux, or macOS clients.

This article explains not only how to configure Samba, but also what each command and configuration directive does, making it suitable for beginners and system administrators alike.

1. Installing Samba

First, update the package repository and install the required Samba packages:

sudo apt update
sudo apt install samba samba-common

• samba: installs the core Samba services (smbd, nmbd)
• samba-common: provides shared configuration files and utilities

Verify that Samba is installed correctly:

smbd --version

• Verifies that the Samba daemon is installed correctly
• Displays the installed Samba version

2. Creating a Shared Directory

Create a dedicated directory for file sharing:

sudo mkdir -p /srv/share

• Creates the directory /srv/share
• -p ensures parent directories are created if they do not exist

sudo chown -R $USER:$USER /srv/share

• Changes ownership of the directory to the current user
• -R applies ownership recursively to all files and subdirectories

sudo chmod -R 775 /srv/share

• Sets permissions:
  • Owner & group: read, write, execute
  • Others: read & execute
• Required so Samba users can access the directory

Note : /srv is recommended for service-related data according to Linux filesystem standards.

3. Configuring Samba

Edit the main Samba configuration file:

sudo nano /etc/samba/smb.conf

• Opens the main Samba configuration file
• All share definitions and access rules are defined here

Add the following configuration at the bottom of the file:

[Share-Umum]
   comment = Public Shared Folder
   path = /srv/share
   browseable = yes
   read only = no
   writable = yes
   create mask = 0664
   directory mask = 0775
   valid users = @samba

Share Configuration

[Share-Umum]

• Defines the name of the Samba share
• This name appears when clients browse server

comment = Public Shared Folder

• Optional description of the shared folder
• Helps identify the share in network browsers

path = /srv/share

• Specifies the directory on the Linux filesystem to be shared

browseable = yes

• Allows the share to be visible when browsing the server
• If set to no, users must access it manually

read only = no

• Allows write access to the share
• yes would restrict the share to read-only

writable = yes

• Explicitly enables write permissions
• Often used together with read only = no for clarity

create mask = 0664

• Sets default permissions for newly created files
• Files will be readable and writable by owner and group

directory mask = 0775

• Sets default permissions for newly created directories
• Allows group members to create and modify files

valid users = @samba

• Restricts access to users in the samba group
• Enhances security by limiting who can access the share

4. Creating Samba Users

Samba authentication is based on Linux users with a separate Samba password.

sudo adduser username

• Creates a Linux system user
• Samba authentication is based on Linux users

sudo groupadd samba

• Creates a dedicated group for Samba users
• Simplifies access control and permission management

sudo usermod -aG samba username

• Adds the user to the samba group
• -aG ensures existing group memberships are preserved

sudo smbpasswd -a username

• Creates a Samba password for the user
• Required for authentication from Windows or Linux clients

sudo smbpasswd -e username

• Enables the Samba account
• Without this, the user cannot log in

5. Restarting and Enabling Samba Services

Apply the configuration by restarting Samba services:

sudo systemctl restart smbd nmbd

• Restarts Samba service to apply configuration changes
• smbd: handles file sharing and authentication
• nmbd: handles NetBIOS name resolution (mainly for Windows)

sudo systemctl enable smbd nmbd

• Ensures Samba services start automatically on boot

6. Validating the Configuration

Check the Samba configuration syntax:

testparm

• Check the Samba configuration file for syntax errors
• Displays the effective configuration
• Essential for troubleshooting before production use

7. Accessing the Share form Windows

Open File Explorer and access the server using:

\\IP_Server

or directly:

\\IP_Server\Share-Umum

• Opens the samba server in Windows Exploler
• Directly accesses the specified share
• Promts for Samba username and password

8. Accessing the Share from Linux

Manual Mount

sudo mount -t cifs //IP_Server/Share-Umum /mnt/smb -o username=username

• -t cifs: specifies SMB/CIFS filesystem type
• //IP_Server/Share-Umum: Samba share path
• /mnt/smb: local mount point
• -o username=: Samba login username

Persistent Mount (/etc/fstab)

# SMB Mount
//IP_Server/Share-Umum  /mnt/smb  cifs  username=username,password=YOUR_PASSWORD,iocharset=utf8,vers=3.0  0  0

• Automatically mounts the share at boot
• vers=3.0 enforces modern SMB protocol
• iocharset=utf8 ensures proper character encoding

9. Fixing Permission Issues

sudo chmod -R 0775 /srv/share

Ensures group members can read, write, and execute

sudo chown -R :samba /srv/share

• Assigns group ownerhip to samba
• Aligns filesystem permissions with Samba access rules

10. Troubleshooting Commands

systemctl status smbd

• Displays Samba service status and error messages

sudo netstat -tulnp | grep smb

• Confirms Samba is listening on required ports (445, 139)

sudo smbclient -L localhost -U username

• Lists available Samba shares
• Useful for validating authentication and share visibility

Best Practices

• Disable SMB1 (deprecated and insecure)
• Use SMB2 or SMB3 only
• Always align Samba permissions with Linux filesystem permissions
• Avoid storing frequently synchronized data (e.g., Obsidian Vaults) on SMB

Conclusion

Understanding each command and configuration directive helps prevent common Samba issues related to permissions, authentication, and access control. With proper setup and security practices, Samba remains a robust and reliable file-sharing solution for Linux-based environments.