Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

Samba — file sharing over SMB

5 min Ubuntu 24.04 · Samba 4

An SMB server for Windows-compatible shares; the SMB password is separate from the system one, easy to forget to set.

Cheat sheet

5 commands Printable version
  • sudo smbpasswd -a user set an SMB password (separate from the system one!)
  • testparm check smb.conf
  • smbstatus who's connected / open files
  • smbclient -L //host -U user list shares
  • sudo mount -t cifs //host/share /mnt -o credentials=/etc/smbcred,vers=3.0
  • smb.conf: [share] path= / valid users= / read only=no

Overview

Samba implements the SMB/CIFS protocol — shared folders compatible with Windows (and with Linux/macOS). The server is smbd (files) plus nmbd (names); config at /etc/samba/smb.conf.

Unlike nfs (the Linux world, by UID/GID), SMB is more convenient for mixed environments and login/password authentication.

bash 
systemctl status smbd
ss -tlnp | grep -E ':445|:139'     # is SMB listening (see ss)

Configuration

The whole server is configured in one file, /etc/samba/smb.conf: a global [global] section and one section per share. After any edit — testparm (syntax check) and sudo systemctl restart smbd; reload is not enough to change shares without dropping current connections if the [global] section changed.

ini 
[global]
   workgroup = WORKGROUP
   server string = files
   map to guest = bad user

[share]
   path = /srv/share
   read only = no
   valid users = alice @smbusers
   create mask = 0664
   directory mask = 0775

Key directives: path — the directory on disk; valid users — who may connect (a name or @group); read only — deny writes by default; create mask/directory mask — permissions for new files and directories; map to guest = bad user in [global] lets unknown users in as guests — without this line, anonymous access is closed.

Recipes

2

Server

bash 
sudo apt install samba
sudo smbpasswd -a alice            # set an SMB password (SEPARATE from the system one!)
sudo smbpasswd -e alice            # enable the user
testparm                           # check smb.conf syntax
sudo systemctl restart smbd
smbstatus                          # who's connected, which files are open, locks

Client (Linux)

bash 
smbclient -L //10.0.0.1 -U alice            # list shares
smbclient //10.0.0.1/share -U alice         # interactive (ftp-like: get/put)
sudo apt install cifs-utils
sudo mount -t cifs //10.0.0.1/share /mnt/s -o username=alice,uid=1000,gid=1000
# permanent — credentials in a file (don't expose the password in fstab):
#   /etc/smbcred:  username=alice / password=...
#   /etc/fstab:    //10.0.0.1/share /mnt/s cifs credentials=/etc/smbcred,_netdev,nofail 0 0
sudo mount -t cifs ... -o vers=3.0          # explicit protocol version (for an old server)

Troubleshooting

5

NT_STATUS_LOGON_FAILURE

Wrong SMB password/user. The SMB password is set separately with smbpasswd -a (it is not the system password). The user must exist in the system (users-groups).

NT_STATUS_ACCESS_DENIED

System permissions on the directory (path) or valid users/read only in smb.conf. Check both permissions and the share section (smbstatus/testparm).

Server/share not visible

The SMB port 445/tcp is closed (firewall) or the service isn't running. testparm for the config; systemctl status smbd. Check reachability: nc -zv host 445.

Mount: "host is down" / protocol negotiation failed

An SMB version mismatch. Add -o vers=3.0 (or 2.1). Very old SMBv1 is disabled in newer kernels — don't use it.

Cyrillic/permissions in file names

unix charset = UTF-8; permissions for new files — create mask/directory mask, force user/force group for a single owner.

Danger zone

map to guest = bad user combined with valid users that doesn't list the whole needed group opens the share to anonymous users on the network — don't set this line in production without a clear reason. read only = no on a share with create mask = 0777 lets anyone who connects change other people's files; set masks to the minimum permissions actually needed instead of copying the example as-is.

See also

  • nfs — Network directories over NFS — exporting on the server, mounting on the client, permissions.
  • firewall — Traffic filtering — simple ufw and lower-level nftables.
  • users-groups — Accounts, groups, membership; useradd/usermod, /etc/passwd and /etc/group.

Found an inaccuracy? Report an error in the article

Topics
Loading…