6 min read Easy 20.1k

Samba: SMB/CIFS sharing for Windows and Linux

Published on May 17, 2026 at 05:46 PM

Samba implements the SMB/CIFS protocol to share files and printers between Linux, Windows, and macOS. The standard for NAS and enterprise file servers.

Introduction

Samba:

SMB / CIFS protocol (Windows native)
Multi-OS file shares (Windows, macOS, Linux)
Active Directory: DC or domain member
Compatible with Windows auth
Performance: Samba 4.x handles SMB3 with multichannel, encryption

Use cases: NAS, office file server, Windows profile sharing, AD integration.

Prerequisites

Linux VPS / server Debian / Ubuntu
Root access
Configured LAN (no internet exposure without strict firewall!)

⚠️ Never expose Samba directly to internet: SMB is ransomware target #1. Restrict to LAN IPs.

Step 1: Installation

sudo apt update
sudo apt install -y samba smbclient
smbd --version

Step 2: Base config

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.orig
sudo nano /etc/samba/smb.conf

Minimal config:

[global]
   workgroup = WORKGROUP
   server string = File Server
   netbios name = fileserver
   security = user
   map to guest = bad user
   
   ; IP restrictions (CRUCIAL)
   hosts allow = 192.168.50.0/24 127.0.0.1
   hosts deny = 0.0.0.0/0
   
   ; Logs
   log file = /var/log/samba/log.%m
   max log size = 1000
   logging = file
   
   ; Performance
   server min protocol = SMB2_10
   server signing = mandatory
   server smb encrypt = desired
   
   ; Disable printer sharing if not needed
   load printers = no
   printing = bsd
   printcap name = /dev/null
   disable spoolss = yes
   
   ; Disable NetBIOS (SMB direct only on 445)
   smb ports = 445
   disable netbios = yes

[share]
   path = /srv/samba/share
   browseable = yes
   read no
   guest ok = no
   valid users = @smbusers
   create mask = 0664
   directory mask = 0775
   force group = smbusers

Step 3: Create folder and groups

sudo mkdir -p /srv/samba/share
sudo groupadd smbusers
sudo chgrp -R smbusers /srv/samba/share
sudo chmod -R 2770 /srv/samba/share

Step 4: Create a Samba user

User must exist on Linux AND have a Samba password (separate).

sudo adduser --no-create-home --disabled-login alice
sudo usermod -aG smbusers alice
sudo smbpasswd -a alice
sudo smbpasswd -e alice    # enable

List:

sudo pdbedit -L

Step 5: Verify and start

sudo testparm
sudo systemctl restart smbd nmbd
sudo systemctl enable smbd nmbd

Step 6: Test from Linux

smbclient -L localhost -U alice
smbclient //localhost/share -U alice

Permanent mount:

sudo apt install -y cifs-utils
sudo mkdir /mnt/smb-share
sudo mount -t cifs //SERVER_IP/share /mnt/smb-share -o username=alice,password=xxx,vers=3.0

/etc/fstab:

//192.168.50.10/share /mnt/smb-share cifs username=alice,password=xxx,uid=1000,gid=1000,vers=3.0,_netdev 0 0

Better: credentials file:

sudo nano /etc/smb-creds

username=alice
password=secret

sudo chmod 600 /etc/smb-creds

//192.168.50.10/share /mnt/smb-share cifs credentials=/etc/smb-creds,uid=1000,gid=1000,vers=3.0,_netdev 0 0

Step 7: Access from Windows

Explorer > Address:

\\192.168.50.10\share

Enter Samba credentials. Map as network drive: right-click > "Map network drive".

If really needed (rarely recommended):

[public]
   path = /srv/samba/public
   browseable = yes
   read no
   guest ok = yes
   guest yes
   create mask = 0666
   directory mask = 0777

sudo mkdir /srv/samba/public
sudo chmod 777 /srv/samba/public
sudo systemctl restart smbd

Step 9: Multi-user, fine ACLs

For finer permissions, use POSIX ACLs:

sudo apt install -y acl

Enable ACL in share:

[share]
   path = /srv/samba/share
   read no
   inherit acls = yes
   inherit permissions = yes
   acl_xattr:ignore system acls = yes
   vfs objects = acl_xattr

Set ACLs:

sudo setfacl -R -m g:smbusers:rwX /srv/samba/share
sudo setfacl -R -m d:g:smbusers:rwX /srv/samba/share   # default ACL
sudo getfacl /srv/samba/share

ACLs visible from Windows via right-click > Properties > Security.

Step 10: Quotas and limits

[share]
   path = /srv/samba/share
   read no
   max disk size = 10240    ; 10 GB announced to client

For real quotas, use filesystem quotas (ZFS, Btrfs, ext4 quotas).

Step 11: Performance tuning

[global]
   socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072
   
   aio read size = 16384
   aio write size = 16384
   use sendfile = yes
   
   ; SMB Multi-channel (requires SMB3+ on client side)
   server multi channel support = yes

Reboot Samba and test:

dd if=/dev/zero of=/srv/samba/share/test.bin bs=1M count=1024

Copy from Windows: should see 100+ MB/s on Gigabit.

Step 12: Active Directory

To join AD domain:

sudo apt install -y winbind libpam-winbind libnss-winbind

/etc/samba/smb.conf:

[global]
   workgroup = MYDOMAIN
   realm = MYDOMAIN.LOCAL
   security = ADS
   winbind use default domain = yes
   winbind enum users = yes
   winbind enum groups = yes
   template shell = /bin/bash
   template homedir = /home/%U
   idmap config * : range = 10000-99999
   idmap config MYDOMAIN : backend = rid
   idmap config MYDOMAIN : range = 100000-999999

Join domain:

sudo realm join mydomain.local -U Administrator

AD users can now access shares.

For Samba itself as AD DC, see https://wiki.samba.org/index.php/Active_Directory_Domain_Services.

Troubleshooting

"NT_STATUS_LOGON_FAILURE"

Wrong Samba password:

sudo smbpasswd alice

Or user not enabled:

sudo smbpasswd -e alice

"Permission denied" client-side

Check:

Linux permissions (ls -la /srv/samba/share)
force group in config
User in correct group

Very slow access

Check server min protocol = SMB2_10. SMB1 (deprecated) is slow and insecure.

On Windows client, enable SMB direct for Gigabit+.

NetBIOS disabled. Either re-enable (disable netbios = no, smb ports = 139 445) or browse by DNS name.

Logs

sudo tail -f /var/log/samba/log.smbd
sudo tail -f /var/log/samba/log.nmbd

Useful commands

sudo systemctl status smbd nmbd
sudo systemctl restart smbd nmbd

sudo testparm

sudo smbpasswd -a username
sudo smbpasswd -d username
sudo smbpasswd -e username
sudo smbpasswd -x username
sudo pdbedit -L

smbclient -L //SERVER_IP -U user
smbclient //SERVER_IP/share -U user

sudo smbstatus
sudo smbstatus --shares
sudo smbstatus --locks

sudo mount -t cifs //srv/share /mnt/point -o credentials=/etc/smb-creds,vers=3.0

sudo tail -f /var/log/samba/log.smbd

Conclusion

Samba turns your Linux server into a Windows-compatible file server:

Secure and performant SMB3
Active Directory integration
Fine ACLs
Multi-OS

Limits:

Config complexity
Ransomware target #1 (never expose)
Worse performance than NFS on Linux-only LAN

Going further:

For Linux-only, prefer NFS (better perf)
For turnkey NAS, look at TrueNAS Scale or OpenMediaVault
For HA, deploy Ctdb (clustered Samba)

Resources

Official docs: https://www.samba.org/samba/docs/
Wiki: https://wiki.samba.org
AD setup: https://wiki.samba.org/index.php/Active_Directory_Domain_Services
SMB protocol: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb/