Samba NAS (Network File Shares)

Set up network-accessible file shares on a self-hosted Linux server using Samba (SMB/CIFS). Covers installation, configuration, testing, and client connectivity.

Quick Setup

1. Install

sudo apt update && sudo apt install -y samba smbclient

2. Configure /etc/samba/smb.conf

Guest access (trusted LAN) — no password, full read/write:

[global]
workgroup = WORKGROUP
server string = <hostname>
netbios name = <hostname>
security = user
map to guest = Bad User
guest account = nobody
server min protocol = SMB2
client min protocol = SMB2

[share-name]
path = /mnt/<path>
browseable = yes
read only = no
guest ok = yes
force user = <username>
create mask = 0777
directory mask = 0777

Key directives:

map to guest = Bad User — anonymous connections get guest access instead of being rejected
force user = <username> — all file operations run as this user (avoids permission mismatches with pre-existing files)
create mask / directory mask = 0777 — full rwx for everyone (safe on trusted LAN only)
server min protocol = SMB2 — disables the ancient SMB1 protocol (security)

3. Start

sudo systemctl restart smbd
sudo systemctl enable smbd

4. Test locally

smbclient -L //localhost -N

Should list all configured shares. Then test write:

smbclient //localhost/<share> -N -c "put /etc/hostname test.txt; ls; rm test.txt"

5. Check firewall

If ufw is active:

sudo ufw allow samba

Client Connection Guide

OS	How to connect
Windows	File Explorer → `\\<server-ip>` or `\\<hostname>`
macOS	Finder → Go → Connect to Server → `smb://<server-ip>`
Linux	File manager → `smb://<server-ip>/` or mount via `mount -t cifs`

Password-Protected (vs Guest)

If guest access is not desired, replace the share config with:

[share-name]
path = /mnt/<path>
browseable = yes
read only = no
valid users = <username>

Then set a Samba password:

sudo smbpasswd -a <username>

Note: this creates a separate Samba password — it does not need to match the system login password.

Pitfalls

/usr/share/cockpit/ is NOT for Samba — common confusion. Samba config is in /etc/samba/smb.conf, not Cockpit package directories.
NTFS/exFAT drives — already mounted with uid=1000,gid=1000,umask=000, so guest + force user works fine. For ext4 drives, verify the mount point has world-readable/writable permissions.
SMB1 disabled warning on smbclient -L is normal — ignore it. This means the server correctly requires SMB2+.
Firewall on other machines: Windows/macOS clients may need network discovery enabled to see the server in the file browser. Connecting directly via IP always works.
CGNAT: These shares are LAN-only. For external access, use a VPN (Tailscale, WireGuard) — never expose SMB directly to the internet.
Restart after config changes: Always sudo systemctl restart smbd after editing smb.conf. No reload — restart.
Testing checklist after changes:
1. systemctl is-active smbd — service running?
2. smbclient -L //localhost -N — shares visible?
3. smbclient //localhost/<share> -N -c "ls" — contents readable?
4. smbclient //localhost/<share> -N -c "put /etc/hostname _test; rm _test" — writable?

3.7 KiB Raw Blame History