Configure Samba on Unix

Mon, 05 Apr 2021 00:00:00 +0000

Ubuntu 26.04 LTS

For a standalone file server using APT and systemd. Run commands in Bash with sudo privileges. Replace username1, username2, the example directories, and network addresses with your own values.

Install Samba

sudo apt update
sudo apt install samba samba-common-bin smbclient -y
smbd --version

Add Samba users

Check whether the Linux users already exist:

id username1
id username2

Run the corresponding command only for a missing account:

sudo adduser username1
sudo adduser username2

Add Samba passwords interactively, then enable the accounts:

sudo smbpasswd -a username1
sudo smbpasswd -a username2
sudo smbpasswd -e username1
sudo smbpasswd -e username2
sudo pdbedit -L

Samba passwords are managed separately from Linux login passwords. Enter them at the prompts rather than including them in commands.

Prepare shared directories

Share	Server directory	Allowed user
sync	`/srv/samba/sync`	username2
exchange	`/home/username1/exchange`	username1
documents	`/home/username1/documents`	username1
media	`/home/username1/media`	username1
backups	`/home/username1/backups`	username1

If /srv/samba/sync is intended to be a separate disk or mount, mount it first and confirm that findmnt -T /srv/samba/sync shows the intended filesystem.

Create missing directories. These commands leave existing directories and their permissions unchanged:

if [ ! -e /srv/samba/sync ]; then
    sudo install -d -o username2 -g "$(id -gn username2)" -m 0755 /srv/samba/sync
fi

for dir in exchange documents media backups; do
    if [ ! -e "/home/username1/$dir" ]; then
        sudo install -d -o username1 -g "$(id -gn username1)" -m 0755 "/home/username1/$dir"
    fi
done

Inspect ownership and parent-directory permissions:

ls -ld /srv/samba/sync /home/username1 /home/username1/{exchange,documents,media,backups}
namei -l /srv/samba/sync
namei -l /home/username1/exchange

sudo -u username2 sh -c 'test -r /srv/samba/sync && test -w /srv/samba/sync && test -x /srv/samba/sync' \
    && echo '/srv/samba/sync: permission check passed'

for dir in exchange documents media backups; do
    sudo -u username1 sh -c 'test -r "$1" && test -w "$1" && test -x "$1"' sh "/home/username1/$dir" \
        && echo "$dir: permission check passed"
done

If a success message is missing, resolve ownership, group membership, ACLs, or a read-only mount before continuing. Parent directories must be traversable. Existing files need their own appropriate permissions; a successful directory check does not prove that every file is writable.

Syncthing permissions

Check which Linux account runs Syncthing. Using username2 for both services simplifies ownership. If Syncthing runs under a different account, configure a shared group or ACLs and adjust creation permissions for both services. The 0644/0755 settings below do not provide write access to another account by default.

Do not recursively change ownership or permissions on an existing Syncthing directory without reviewing its current access requirements.

Configure Samba

Create a timestamped backup:

sudo cp -a /etc/samba/smb.conf "/etc/samba/smb.conf.bak.$(date +%Y%m%d-%H%M%S)"
sudo vim /etc/samba/smb.conf

Use another installed editor if preferred. Preserve the existing [global] section and confirm that this server is configured for standalone user authentication. Add the following shares at the end, replacing any existing sections with the same names rather than creating duplicates.

[sync]
    comment = Sync Folder
    path = /srv/samba/sync
    browseable = yes
    read only = no
    guest ok = no
    valid users = username2
    create mask = 0644
    directory mask = 0755
    force user = username2

[exchange]
    comment = Shared Folder
    path = /home/username1/exchange
    browseable = yes
    read only = no
    guest ok = no
    valid users = username1
    create mask = 0644
    directory mask = 0755
    force user = username1

[documents]
    comment = documents
    path = /home/username1/documents
    browseable = yes
    read only = no
    guest ok = no
    valid users = username1
    create mask = 0644
    directory mask = 0755
    force user = username1

[media]
    comment = media
    path = /home/username1/media
    browseable = yes
    read only = no
    guest ok = no
    valid users = username1
    create mask = 0644
    directory mask = 0755
    force user = username1

[backups]
    comment = backups
    path = /home/username1/backups
    browseable = yes
    read only = no
    guest ok = no
    valid users = username1
    create mask = 0644
    directory mask = 0755
    force user = username1

The masks permit local read access by other users when parent directories allow traversal; SMB access remains restricted by valid users. For private single-user data, consider 0600/0700 after checking the requirements of Syncthing and other services. Review existing global defaults, especially permission inheritance settings, because they can affect creation behavior. See the official parameter reference.

Check configuration and restart Samba

sudo testparm -s

Resolve configuration errors and unknown parameters, then verify the reported paths and users before proceeding. This checks configuration loading, not real client access.

sudo systemctl enable --now smbd
sudo systemctl restart smbd
sudo systemctl status smbd --no-pager

Restarting interrupts existing SMB connections.

nmbd supplies legacy NetBIOS name and browsing services. If those services are required and the unit is available, run:

sudo systemctl enable --now nmbd
sudo systemctl restart nmbd

Modern direct SMB connections by IP do not require nmbd. See the nmbd manual.

Firewall

Find the server’s LAN address:

ip -br address
ip route show default

Use the address on the appropriate LAN interface. The default route’s gateway address is not the server’s address.

If UFW is installed and used on this server, inspect its status and available profiles:

sudo ufw status verbose
sudo ufw app list

Allow the Samba profile from your trusted LAN. Replace the example subnet with your actual network:

sudo ufw allow from 192.168.1.0/24 to any app Samba
sudo ufw status numbered

This rule limits access to the example LAN subnet. Adding a rule does not activate an inactive firewall. If enabling UFW remotely, first allow your actual SSH port. Apply equivalent rules to any other firewall in use. See the Ubuntu firewall documentation.

Connect to shares

On the server, test authentication and directory listing. Enter passwords when prompted:

smbclient -L //127.0.0.1 -U username1
smbclient //127.0.0.1/sync -U username2 -c 'ls'

for share in exchange documents media backups; do
    smbclient "//127.0.0.1/$share" -U username1 -c 'ls'
done

These cross-account tests should fail:

smbclient //127.0.0.1/sync -U username1 -c 'ls'
smbclient //127.0.0.1/exchange -U username2 -c 'ls'

A visible share name does not imply permission to open it.

Windows

Enter a path in File Explorer, replacing the example IP:

\\192.168.1.10\sync
\\192.168.1.10\exchange
\\192.168.1.10\documents
\\192.168.1.10\media
\\192.168.1.10\backups

Sign in as username2 for sync and username1 for the other shares. If Windows reports conflicting credentials when switching accounts, close files and disconnect existing connections to that server before reconnecting. Use net use to inspect mappings and remove only the relevant connections; also review saved credentials for that server.

macOS and Linux

In macOS Finder, select Go > Connect to Server. In a Linux file manager with SMB support, select Connect to Server. Enter:

smb://192.168.1.10/exchange
smb://192.168.1.10/sync

Verify writes

For every share, connect from another computer with the permitted account. Create a temporary folder, upload a test file, edit it, rename it, and delete only the test content you created. Check access to existing files separately. For /srv/samba/sync, verify that Syncthing can process files created through SMB.

Notes

Symptom	Check first
`NT_STATUS_LOGON_FAILURE`	Samba account, account status, and password.
`NT_STATUS_ACCESS_DENIED`	Allowed user, parent-directory traversal, file permissions, and ACLs.
`NT_STATUS_BAD_NETWORK_NAME`	Share name, directory existence, and loaded configuration.
Read succeeds but write fails	Ownership, existing file permissions, read-only mounts, disk space, and quotas.
Local connection works but remote connection fails	Server IP, firewall rules, network isolation, and TCP port 445.
Server absent from Windows Network	Try its IP path directly to distinguish discovery from connection problems.

Useful diagnostics:

sudo testparm -s
sudo pdbedit -L
sudo journalctl -u smbd -n 100 --no-pager
sudo ss -lntp 'sport = :445'
findmnt -T /srv/samba/sync
df -h /srv/samba/sync

Restore configuration

List the backups:

ls -lt /etc/samba/smb.conf.bak.*

Replace the placeholder filename with your chosen backup:

sudo cp -a /etc/samba/smb.conf.bak.YYYYMMDD-HHMMSS /etc/samba/smb.conf
sudo testparm -s && sudo systemctl restart smbd

Restoring this file does not reverse account, password, filesystem permission, or firewall changes.

Configuration reviewed against official documentation; commands have not been run on the target server.

Samba on Di