Samba Configuration for File Sharing: Complete Cross-Platform Setup Guide

Samba is the essential bridge for file sharing between Linux servers and Windows clients, making it indispensable for mixed-environment networks. Whether you're setting up a small office file server, creating shared storage for a development team, or implementing enterprise-level file services, Samba provides robust, feature-rich file sharing capabilities.

This comprehensive guide covers complete Samba configuration from basic setup to advanced features including user authentication, permission management, and performance optimization.

Introduction to Samba

Samba is an open-source implementation of the SMB/CIFS (Server Message Block/Common Internet File System) protocol, allowing Linux systems to provide file and print services to Windows, macOS, and other SMB-compatible clients.

Why Use Samba?

• Cross-platform compatibility: Seamless Windows-Linux integration
• Native protocol: Windows clients connect without additional software
• Active Directory integration: Can join AD domains
• Printer sharing: Share printers across network
• User authentication: Secure access control
• Performance: Optimized for modern networks
• Free and open-source: No licensing costs

Common Samba Use Cases

• Office file servers: Centralized document storage
• Home directories: User-specific network drives
• Software distribution: Centralized application installers
• Development team shares: Shared code and project files
• Media servers: Shared music, video, and photo libraries
• Backup destinations: Network backup targets
• Mixed environment networks: Linux servers serving Windows clients

Prerequisites

Before configuring Samba, ensure you have:

• Root or sudo access on the Linux server
• Static IP address or reliable hostname
• Firewall configured to allow SMB/CIFS traffic
• User accounts for Samba access
• Understanding of file permissions
• Backup of existing Samba configuration (if modifying existing setup)

Critical Security Warning

WARNING: Improperly configured Samba shares can expose sensitive data. Always:

1. Use strong passwords for Samba users
2. Restrict share access to specific users/groups
3. Implement firewall rules
4. Use encrypted connections when possible
5. Keep Samba updated
6. Never expose Samba directly to internet
7. Regular security audits

Step 1: Install Samba

On Debian/Ubuntu

sudo apt update
sudo apt install samba samba-common-bin

On CentOS/RHEL/Rocky Linux

sudo yum install samba samba-client samba-common
# or
sudo dnf install samba samba-client samba-common

Verify Installation

# Check Samba version
smbd --version

# Check service status
sudo systemctl status smbd nmbd

Expected output:

Version 4.13.17-Ubuntu

Step 2: Backup Default Configuration

Before making changes, backup the original configuration:

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup.$(date +%Y%m%d)

Step 3: Basic Samba Configuration

Understanding smb.conf Structure

The /etc/samba/smb.conf file has two main sections:

[global]: Server-wide settings [share_name]: Individual share configurations

Configure Global Settings

Edit the configuration file:

sudo nano /etc/samba/smb.conf

Basic global configuration:

[global]
   workgroup = WORKGROUP
   server string = Samba Server %v
   netbios name = fileserver
   security = user
   map to guest = bad user
   dns proxy = no

   # Logging
   log file = /var/log/samba/log.%m
   max log size = 1000

   # Performance tuning
   socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=524288 SO_SNDBUF=524288
   read raw = yes
   write raw = yes
   oplocks = yes
   max xmit = 65535
   dead time = 15
   getwd cache = yes

Key parameters explained:

• workgroup: Windows workgroup name (default: WORKGROUP)
• server string: Server description visible to clients
• netbios name: Server name on network
• security = user: Require authentication (recommended)
• map to guest = bad user: Handle invalid usernames
• log file: Location of log files

Step 4: Create Shared Directories

Create directories to be shared:

# General shared directory
sudo mkdir -p /srv/samba/shared

# Department-specific shares
sudo mkdir -p /srv/samba/accounting
sudo mkdir -p /srv/samba/development
sudo mkdir -p /srv/samba/marketing

# User home directories
sudo mkdir -p /srv/samba/homes

# Public directory
sudo mkdir -p /srv/samba/public

Step 5: Set Directory Permissions

Configure appropriate permissions:

# Public share (everyone can access)
sudo chmod 777 /srv/samba/public
sudo chown nobody:nogroup /srv/samba/public

# Shared directory (group access)
sudo chmod 2775 /srv/samba/shared
sudo chown root:sambashare /srv/samba/shared

# Department shares (restricted access)
sudo chmod 770 /srv/samba/accounting
sudo chown root:accounting /srv/samba/accounting

Step 6: Configure Samba Shares

Add share definitions to /etc/samba/smb.conf:

Example 1: Public Share (No Authentication)

[Public]
   comment = Public File Share
   path = /srv/samba/public
   browseable = yes
   writable = yes
   guest ok = yes
   read only = no
   create mask = 0777
   directory mask = 0777

Example 2: Authenticated Share

[Shared]
   comment = Shared Team Files
   path = /srv/samba/shared
   browseable = yes
   writable = yes
   valid users = @sambashare
   create mask = 0660
   directory mask = 0770
   force group = sambashare

Example 3: User Home Directories

[homes]
   comment = User Home Directories
   browseable = no
   writable = yes
   valid users = %S
   create mask = 0700
   directory mask = 0700

Example 4: Read-Only Share

[Documentation]
   comment = Company Documentation
   path = /srv/samba/docs
   browseable = yes
   read only = yes
   guest ok = no
   valid users = @employees

Example 5: Department-Specific Share

[Accounting]
   comment = Accounting Department Files
   path = /srv/samba/accounting
   browseable = yes
   writable = yes
   valid users = @accounting
   admin users = john, mary
   create mask = 0660
   directory mask = 0770
   force group = accounting

Understanding Share Options

Access Control:

• browseable = yes/no: Visible in network browse lists
• writable = yes/no: Write access allowed
• read only = yes/no: Opposite of writable
• guest ok = yes/no: Allow guest access
• valid users: Users/groups allowed (use @groupname for groups)
• admin users: Users with administrative rights
• write list: Users with write access (overrides read-only)

Permission Options:

• create mask: Permissions for new files (0660 = rw-rw----)
• directory mask: Permissions for new directories (0770 = rwxrwx---)
• force user: Force files to be owned by specific user
• force group: Force files to be owned by specific group
• inherit permissions: Inherit parent directory permissions

Other Options:

• comment: Description of share
• path: Filesystem path
• available = yes/no: Share enabled/disabled
• follow symlinks = yes/no: Follow symbolic links
• veto files: Files to hide/block
• hide files: Files to hide (but still accessible)

Step 7: Create Samba Users

Samba uses separate password database from Linux users.

Create Linux User First

# Create user without login shell
sudo useradd -M -s /sbin/nologin smbuser

# Or create regular user
sudo useradd -m smbuser

Add User to Samba

# Add Samba password for user
sudo smbpasswd -a smbuser

# Enter password when prompted

Create Group for Samba Users

# Create group
sudo groupadd sambashare

# Add users to group
sudo usermod -aG sambashare smbuser
sudo usermod -aG sambashare john
sudo usermod -aG sambashare mary

Manage Samba Users

# Enable Samba user
sudo smbpasswd -e smbuser

# Disable Samba user
sudo smbpasswd -d smbuser

# Change Samba password
sudo smbpasswd smbuser

# Delete Samba user
sudo smbpasswd -x smbuser

# List Samba users
sudo pdbedit -L

Step 8: Test Configuration

Verify Samba configuration syntax:

sudo testparm

Output should show:

Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Server role: ROLE_STANDALONE

Press enter to see a dump of your service definitions

If errors appear, fix them before proceeding.

Step 9: Start and Enable Samba Services

On Debian/Ubuntu

sudo systemctl enable smbd nmbd
sudo systemctl start smbd nmbd
sudo systemctl status smbd nmbd

On CentOS/RHEL/Rocky Linux

sudo systemctl enable smb nmb
sudo systemctl start smb nmb
sudo systemctl status smb nmb

Step 10: Configure Firewall

Allow Samba traffic through firewall.

Using UFW (Debian/Ubuntu)

# Allow Samba from specific subnet
sudo ufw allow from 192.168.1.0/24 to any app Samba

# Or allow specific ports
sudo ufw allow from 192.168.1.0/24 to any port 445
sudo ufw allow from 192.168.1.0/24 to any port 139

# Reload
sudo ufw reload

Using firewalld (CentOS/RHEL)

# Add Samba service
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-services

Using iptables

# Allow Samba ports
sudo iptables -A INPUT -p tcp --dport 445 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 139 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 137:138 -s 192.168.1.0/24 -j ACCEPT

# Save rules
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Connecting to Samba Shares

From Windows

Method 1: File Explorer

1. Open File Explorer
2. Type in address bar: \\192.168.1.10\Shared
3. Enter username and password
4. Access files

Method 2: Map Network Drive

1. Right-click "This PC"
2. Select "Map network drive"
3. Enter path: \\192.168.1.10\Shared
4. Check "Reconnect at sign-in"
5. Enter credentials

Method 3: Command Line

net use Z: \\192.168.1.10\Shared /user:smbuser password

From Linux

Mount Temporarily:

# Install cifs-utils
sudo apt install cifs-utils

# Create mount point
sudo mkdir /mnt/samba_shared

# Mount share
sudo mount -t cifs //192.168.1.10/Shared /mnt/samba_shared -o username=smbuser,password=password

Mount Permanently:

Create credentials file:

sudo nano /root/.smbcredentials

Add:

username=smbuser
password=password
domain=WORKGROUP

Secure credentials:

sudo chmod 600 /root/.smbcredentials

Add to /etc/fstab:

//192.168.1.10/Shared  /mnt/samba_shared  cifs  credentials=/root/.smbcredentials,uid=1000,gid=1000  0  0

Mount:

sudo mount -a

From macOS

Method 1: Finder

1. Open Finder
2. Go → Connect to Server (⌘K)
3. Enter: smb://192.168.1.10/Shared
4. Click Connect
5. Enter credentials

Method 2: Command Line

mkdir ~/samba_mount
mount_smbfs //smbuser:[email protected]/Shared ~/samba_mount

Advanced Samba Configuration

Enabling Encrypted Connections

Add to [global] section:

[global]
   server signing = mandatory
   smb encrypt = required

Restart Samba:

sudo systemctl restart smbd

Configuring Recycle Bin

Prevent accidental deletions:

[Shared]
   comment = Shared Files with Recycle Bin
   path = /srv/samba/shared
   vfs objects = recycle
   recycle:repository = .recycle
   recycle:keeptree = yes
   recycle:versions = yes
   recycle:touch = yes
   recycle:excludedir = /tmp

Audit Logging

Track file access:

[Shared]
   comment = Audited Share
   path = /srv/samba/shared
   vfs objects = full_audit
   full_audit:prefix = %u|%I|%m|%S
   full_audit:success = mkdir rmdir read pread write pwrite rename unlink
   full_audit:failure = none
   full_audit:facility = local5
   full_audit:priority = notice

Time Machine Support (macOS)

Configure for macOS backups:

[TimeMachine]
   comment = Time Machine Backup
   path = /srv/samba/timemachine
   valid users = macuser
   writable = yes
   vfs objects = catia fruit streams_xattr
   fruit:time machine = yes
   fruit:time machine max size = 500G

Shadow Copies (Previous Versions)

Enable Windows Previous Versions feature:

[Shared]
   comment = Share with Snapshots
   path = /srv/samba/shared
   vfs objects = shadow_copy2
   shadow:snapdir = .snapshots
   shadow:basedir = /srv/samba/shared
   shadow:sort = desc

Performance Optimization

Optimize Global Settings

[global]
   # Socket options for performance
   socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=524288 SO_SNDBUF=524288

   # Enable async operations
   aio read size = 16384
   aio write size = 16384
   use sendfile = yes

   # Optimize for large files
   read raw = yes
   write raw = yes
   strict allocate = yes
   allocation roundup size = 4096

   # Connection optimization
   max connections = 100
   deadtime = 15
   keepalive = 300

   # Disable unused services
   disable netbios = yes
   smb ports = 445

Enable Wide Links (Carefully)

Allow symlinks outside share:

[Shared]
   path = /srv/samba/shared
   follow symlinks = yes
   wide links = yes
   unix extensions = no

WARNING: wide links can be security risk.

Troubleshooting Common Issues

Issue: Cannot Connect to Samba Share

Cause: Firewall, service not running, or network issues.

Solution:

# Check Samba service
sudo systemctl status smbd nmbd

# Restart services
sudo systemctl restart smbd nmbd

# Check firewall
sudo ufw status
sudo firewall-cmd --list-services

# Test from client
telnet 192.168.1.10 445

# Check Samba logs
sudo tail -f /var/log/samba/log.smbd

Issue: Authentication Failed

Cause: Incorrect password or user not in Samba database.

Solution:

# List Samba users
sudo pdbedit -L

# Reset user password
sudo smbpasswd smbuser

# Enable user
sudo smbpasswd -e smbuser

# Check user is in valid users
sudo testparm -s | grep -A10 "^\[ShareName\]"

Issue: Permission Denied on Files

Cause: Incorrect filesystem permissions or ownership.

Solution:

# Check filesystem permissions
ls -la /srv/samba/shared

# Fix ownership
sudo chown -R root:sambashare /srv/samba/shared

# Fix permissions
sudo chmod -R 2775 /srv/samba/shared

# Check Samba configuration
# In smb.conf:
create mask = 0660
directory mask = 0770
force group = sambashare

Issue: Share Not Visible

Cause: browseable = no or network discovery disabled.

Solution:

# Enable browsing in share configuration
[ShareName]
   browseable = yes

# Restart Samba
sudo systemctl restart smbd nmbd

# Check with smbclient
smbclient -L //192.168.1.10 -U username

Issue: Slow Performance

Cause: Default buffer sizes or network settings.

Solution:

# Optimize smb.conf
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=524288 SO_SNDBUF=524288
use sendfile = yes
read raw = yes
write raw = yes

# Enable async I/O
aio read size = 16384
aio write size = 16384

# Restart Samba
sudo systemctl restart smbd

Security Best Practices

1. Restrict Network Access

Limit to specific networks:

[global]
   hosts allow = 192.168.1. 127.
   hosts deny = 0.0.0.0/0

2. Disable Guest Access

[global]
   map to guest = never
   restrict anonymous = 2

3. Use Strong Passwords

# Enforce strong passwords
sudo nano /etc/pam.d/common-password
# Add: password requisite pam_pwquality.so retry=3 minlen=12

4. Enable Logging

[global]
   log level = 2
   log file = /var/log/samba/log.%m
   max log size = 1000

5. Regular Security Audits

# Check Samba version
smbd --version

# Update Samba
sudo apt update && sudo apt upgrade samba

# Review logs
sudo grep -i "failed\|error" /var/log/samba/log.smbd

6. Disable SMBv1

[global]
   server min protocol = SMB2
   client min protocol = SMB2

7. Use Encrypted Connections

[global]
   smb encrypt = required

Monitoring Samba

Check Connected Users

sudo smbstatus

Monitor Connections in Real-Time

watch -n 2 'sudo smbstatus -b'

Check Share Access

# List active connections per share
sudo smbstatus -S

View Open Files

sudo smbstatus -L

Backup and Recovery

Backup Samba Configuration

# Backup configuration
sudo tar -czf /backup/samba_config_$(date +%Y%m%d).tar.gz /etc/samba/

# Backup user database
sudo tdbbackup /var/lib/samba/private/passdb.tdb

Restore Configuration

# Stop Samba
sudo systemctl stop smbd nmbd

# Restore configuration
sudo tar -xzf /backup/samba_config_20260111.tar.gz -C /

# Restart Samba
sudo systemctl start smbd nmbd

Conclusion

Samba provides robust, reliable file sharing between Linux servers and diverse clients including Windows, macOS, and other systems. By properly configuring authentication, permissions, and security measures, you can create enterprise-grade file sharing infrastructure.

Key takeaways:

1. Use authentication (security = user) for production
2. Configure appropriate permissions for each share
3. Implement firewall rules to restrict access
4. Disable guest access unless specifically needed
5. Enable logging for security auditing
6. Optimize performance with appropriate buffer sizes
7. Disable SMBv1 for security
8. Regular backups of configuration and data
9. Monitor connections and access patterns
10. Keep Samba updated for security patches

Samba bridges the gap between Linux servers and Windows clients seamlessly, making it an essential tool for heterogeneous network environments. By following the best practices and configurations outlined in this guide, you can deploy secure, high-performance file sharing services that meet your organization's needs.