LFCE 68 🐧 Samba — Installation and Config - KandZ

⏱️ Estimated read: 11 min | |

Samba is the Linux implementation of the SMB/CIFS protocol, the file-sharing protocol that Windows clients use. The previous chapter covered NFS, which shares files between Unix-like systems; Samba shares files with Windows, macOS, and Linux clients that speak the SMB protocol. The LFCE exam objectives include providing SMB/CIFS shares to clients using Samba . The installation is a package manager command, but the configuration requires understanding the smb.conf structure, the [global] section that controls the server’s identity and security mode, and the share sections that define the directories that clients can access.

The configuration file is /etc/samba/smb.conf. It is divided into two types of sections: the [global] section that applies to the entire server, and the share sections that define individual directories. The workgroup parameter in the global section matches the Windows workgroup name. The security parameter determines how clients authenticate, with user being the default for a standalone server that authenticates against the local Samba user database . The testparm command validates the configuration before the service is restarted.

Key point: Samba shares are defined by a section name in square brackets, followed by the path to the directory and the access options. The read only = no option makes the share writable, and the guest ok = yes option allows access without a password . The smbpasswd -a command adds a user to the Samba password database, which is separate from the Linux user database. Without a Samba user, the client cannot authenticate even if the Linux user exists.

Why Samba configuration requires explicit user management

The authentication problem.

Samba does not use the Linux password database directly for SMB authentication. It maintains its own user database, typically stored in the tdbsam backend. The smbpasswd -a <user> command adds a user to this database and prompts for the SMB password . The Linux user account must exist before the Samba user is created, but the passwords are separate. A client that authenticates with the SMB password is mapped to the Linux user, and the file permissions on the share are evaluated against that user’s UID and GID.

The workgroup problem.

The workgroup parameter in the [global] section must match the Windows workgroup or domain that the clients belong to. If the workgroup names do not match, the clients may not discover the server in the network neighborhood, though they can still connect by IP address or hostname . The netbios name parameter sets the name that the server advertises on the network; if it is not set, Samba uses the hostname.

The share-permission problem.

The read only = no option makes the share writable from Samba’s perspective, but the Linux file permissions must also allow writing. The directory must be owned by a user or group that has write access, and the Samba user must be a member of that group or the owner . The create mask and directory mask options set the permissions for new files and directories created through the share.

a. Installing the packages

The Samba server package is named samba on Debian, Ubuntu, RHEL, and Fedora. The client utilities are in the samba-client or smbclient package.

# Debian / Ubuntu
sudo apt update
sudo apt install samba

# RHEL / Rocky / Fedora
sudo dnf install samba

# Verify the installation
smbd --version
# Output: Version 4.x.x

The smbd daemon is the SMB file-sharing service. The nmbd daemon provides NetBIOS name resolution, which is optional for modern clients that use DNS. The service is managed through systemctl as smbd and nmbd .

b. The global section and the share definition

The [global] section sets the server’s identity and security mode. The share sections define the directories that clients can access.

# /etc/samba/smb.conf
[global]
    workgroup = EXAMPLE
    server string = Samba Server
    security = user
    passdb backend = tdbsam
    log file = /var/log/samba/%m.log
    max log size = 1000

[share]
    comment = Shared Directory
    path = /srv/samba/share
    browsable = yes
    guest ok = yes
    read only = no
    create mask = 0755

The workgroup matches the Windows workgroup. The security = user mode requires clients to authenticate with a username and password. The passdb backend = tdbsam stores the Samba passwords in a TDB database. The log file parameter uses the %m variable, which expands to the client’s NetBIOS name, so each client has its own log file .

The [share] section defines a share named share. The path is the directory to share. The browsable = yes option makes the share visible in the Windows network browser. The guest ok = yes option allows clients to connect without a password. The read only = no option makes the share writable. The create mask = 0755 option sets the permissions for new files .

The directory must be created and the permissions set before the share works.

# Create the directory
sudo mkdir -p /srv/samba/share

# Set ownership to the Samba user or group
sudo chown nobody:nogroup /srv/samba/share
sudo chmod 777 /srv/samba/share

The chmod 777 is appropriate only for a guest-accessible share. For an authenticated share, the directory should be owned by the user or group that the Samba users belong to, with the appropriate permissions .

c. Creating Samba users and validating the configuration

A Samba user must be created for each user that authenticates to the share. The Linux user account must exist first.

# Create a Linux user without a login shell
sudo useradd -M -s /usr/sbin/nologin alice

# Add the user to the Samba database
sudo smbpasswd -a alice
# New SMB password: <password>
# Retype new SMB password: <password>

The useradd -M -s /usr/sbin/nologin command creates a Linux user without a home directory and without a login shell, which is appropriate for a user that only accesses Samba . The smbpasswd -a command adds the user to the Samba database and prompts for the password. The password is separate from the Linux password.

The testparm command validates the smb.conf syntax before the service is restarted.

# Validate the configuration
sudo testparm
# Output: Load smb config files from /etc/samba/smb.conf
#         Loaded services file OK.

# Restart the service
sudo systemctl restart smbd
sudo systemctl enable smbd

The testparm command parses the configuration and reports syntax errors. It should be run after every change . The systemctl restart smbd command applies the configuration, and the systemctl enable smbd command configures the service to start at boot.

Complete Example Session

# ============================================
# PART 1: INSTALL SAMBA
# ============================================
sudo apt install samba

# ============================================
# PART 2: BACK UP THE DEFAULT CONFIGURATION
# ============================================
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

# ============================================
# PART 3: CONFIGURE THE GLOBAL SECTION
# ============================================
sudo tee /etc/samba/smb.conf > /dev/null <<'EOF'
[global]
    workgroup = EXAMPLE
    server string = Samba Server
    security = user
    passdb backend = tdbsam
    log file = /var/log/samba/%m.log
    max log size = 1000
EOF

# ============================================
# PART 4: DEFINE THE SHARE
# ============================================
sudo tee -a /etc/samba/smb.conf > /dev/null <<'EOF'

[share]
    comment = Shared Directory
    path = /srv/samba/share
    browsable = yes
    guest ok = no
    read only = no
    create mask = 0755
EOF

# ============================================
# PART 5: CREATE THE DIRECTORY
# ============================================
sudo mkdir -p /srv/samba/share
sudo chown alice:alice /srv/samba/share
sudo chmod 755 /srv/samba/share

# ============================================
# PART 6: CREATE A SAMBA USER
# ============================================
sudo useradd -M -s /usr/sbin/nologin alice
sudo smbpasswd -a alice
# Enter the SMB password when prompted

# ============================================
# PART 7: VALIDATE THE CONFIGURATION
# ============================================
sudo testparm
# Output: Loaded services file OK.

# ============================================
# PART 8: START AND ENABLE THE SERVICE
# ============================================
sudo systemctl restart smbd
sudo systemctl enable smbd

# ============================================
# PART 9: OPEN THE FIREWALL
# ============================================
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload
# Or on Debian: sudo ufw allow samba

# ============================================
# PART 10: TEST FROM A CLIENT
# ============================================
# On a client:
# smbclient -L //server -U alice
# smbclient //server/share -U alice
# Or mount: sudo mount -t cifs //server/share /mnt -o user=alice

The ten parts demonstrate the complete Samba setup: installation, backup, global configuration, share definition, directory creation, user creation, validation, service start, firewall, and client test. The critical verification is Part 7: testparm confirms that the configuration is syntactically valid before the service is restarted.

Quick Reference

Installation Packages

Distribution	Package
Debian / Ubuntu	`samba`
RHEL / Rocky / Fedora	`samba`

Key smb.conf Parameters

Parameter	Section	Purpose
`workgroup`	`[global]`	Windows workgroup name
`security`	`[global]`	Authentication mode (`user`, `ads`)
`passdb backend`	`[global]`	Password database (`tdbsam`)
`path`	Share	Directory to share
`read only`	Share	Write access (`no` for writable)
`guest ok`	Share	Passwordless access
`browsable`	Share	Visible in network browser
`create mask`	Share	Permissions for new files

Commands

Command	Purpose
`testparm`	Validate configuration
`smbpasswd -a <user>`	Add Samba user
`smbpasswd <user>`	Change Samba password
`pdbedit -L`	List Samba users
`systemctl restart smbd`	Apply configuration
`smbclient -L //server`	List shares

Firewall

System	Command
firewalld	`firewall-cmd --add-service=samba`
ufw	`ufw allow samba`

Best Practices

✅ Do This:

# Validate before restarting
testparm                                                      # ✅

# Create Linux user without login shell
useradd -M -s /usr/sbin/nologin alice                         # ✅

# Add Samba user
smbpasswd -a alice                                            # ✅

# Set the workgroup to match the clients
workgroup = EXAMPLE                                           # ✅

# Use security = user for standalone servers
security = user                                               # ✅

# Set the directory permissions
chown alice:alice /srv/samba/share && chmod 755 /srv/samba/share # ✅

❌ Don’t Do This:

# Forget to create the Samba user
# The client cannot authenticate                              # ❌

# Use guest ok = yes for sensitive data
guest ok = yes                                                # ❌

# Forget to restart smbd after configuration changes
systemctl restart smbd                                        # ✅ (do this)

# Use security = share (removed in Samba 4)
security = share                                              # ❌

# Ignore testparm
systemctl restart smbd    # Syntax error prevents start       # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Client cannot authenticate	No Samba user	`smbpasswd -a <user>`
Share not visible	`browsable = no` or workgroup mismatch	Set `browsable = yes`; match workgroup
Cannot write despite `read only = no`	Directory permissions	`chown` and `chmod` the directory
Service fails to start	Syntax error in `smb.conf`	`testparm` reports the error
Firewall blocks connection	Samba ports not open	`firewall-cmd --add-service=samba`

Real-World Examples

1. Install Samba

apt install samba

2. Global section

[global]
workgroup = EXAMPLE
security = user
passdb backend = tdbsam

3. Read-only share

[readonly]
path = /srv/samba/readonly
read only = yes
browsable = yes

4. Writable share

[share]
path = /srv/samba/share
read only = no
guest ok = no

5. Guest share

[public]
path = /srv/samba/public
guest ok = yes
read only = no

6. Create Samba user

useradd -M -s /usr/sbin/nologin alice && smbpasswd -a alice

7. Validate configuration

testparm

8. Restart service

systemctl restart smbd && systemctl enable smbd

9. List shares

smbclient -L //localhost -U alice

10. Mount from client

mount -t cifs //server/share /mnt -o user=alice

Visual

Samba Architecture

┌──────────────────────────────────────────────────────────────┐
│  SAMBA PROVIDES SMB/CIFS SHARES TO WINDOWS CLIENTS           │
│                                                              │
│  Windows Client                                              │
│  ┌─────────┐                                                 │
│  │ Explorer│                                                 │
│  └────┬────┘                                                 │
│       │ SMB (TCP 445)                                        │
│       ▼                                                      │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Samba (smbd)                                           │  │
│  │                                                        │  │
│  │ [global]                                               │  │
│  │   workgroup = EXAMPLE                                  │  │
│  │   security = user                                      │  │
│  │                                                        │  │
│  │ [share]                                                │  │
│  │   path = /srv/samba/share                              │  │
│  │   read only = no                                       │  │
│  └──────────────────────────┬─────────────────────────────┘  │
│                             │                                │
│                             ▼                                │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Linux Filesystem                                       │  │
│  │ /srv/samba/share                                       │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

smb.conf Structure

┌──────────────────────────────────────────────────────────────┐
│  GLOBAL SECTION AND SHARE SECTIONS                           │
│                                                              │
│  [global]                                                    │
│  ├── workgroup = EXAMPLE                                     │
│  ├── security = user                                         │
│  ├── passdb backend = tdbsam                                 │
│  └── log file = /var/log/samba/%m.log                        │
│                                                              │
│  [share]                                                     │
│  ├── comment = Shared Directory                              │
│  ├── path = /srv/samba/share                                 │
│  ├── browsable = yes                                         │
│  ├── guest ok = no                                           │
│  └── read only = no                                          │
│                                                              │
│  [another-share]                                             │
│  └── ...                                                     │
└──────────────────────────────────────────────────────────────┘

User Creation Flow

┌──────────────────────────────────────────────────────────────┐
│  TWO USER DATABASES                                          │
│                                                              │
│  Linux user database:                                        │
│  └── useradd -M -s /usr/sbin/nologin alice                   │
│                                                              │
│  Samba user database:                                        │
│  └── smbpasswd -a alice                                      │
│      └── prompts for SMB password                            │
│                                                              │
│  The client authenticates against the Samba database.        │
│  The file access is evaluated against the Linux UID/GID.     │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Package	`samba`
Configuration	`/etc/samba/smb.conf`
Daemon	`smbd`
Global section	`[global]`
Share section	`[share]`
Share path	`path = /srv/samba/share`
Write access	`read only = no`
Guest access	`guest ok = yes`
Security mode	`security = user`
Password database	`passdb backend = tdbsam`
Add Samba user	`smbpasswd -a <user>`
Validate config	`testparm`
Service	`systemctl restart smbd`
Firewall	`firewall-cmd --add-service=samba`

Key takeaways:

Samba shares files with Windows clients using SMB/CIFS. The smbd daemon handles the protocol, and the /etc/samba/smb.conf file defines the server’s identity and the shares .
The [global] section sets the workgroup and security mode. The workgroup matches the Windows workgroup, and security = user requires clients to authenticate with a Samba username and password .
Each share is a section with a path and access options. The read only = no option makes the share writable, and guest ok = yes allows passwordless access. The browsable = yes option makes the share visible in the network browser .
Samba users are separate from Linux users. The smbpasswd -a <user> command adds a user to the Samba database. The Linux user must exist first, but the passwords are separate .
testparm validates the configuration. It parses the smb.conf file and reports syntax errors before the service is restarted. It should be run after every change .
The directory permissions must allow the Samba user to write. The read only = no option is not sufficient if the Linux permissions deny write access. The directory must be owned by the user or group that the Samba user belongs to.

Remember: Samba is the SMB/CIFS server. The [global] section defines the workgroup and the security mode. Each share section defines a directory and its access options. The Samba user is created with smbpasswd -a, and the Linux user must exist first. The testparm command validates the configuration, and the smbd service serves the shares. The firewall must permit the SMB traffic. Configure the global section, define the shares, create the users, validate, restart, and test from a client.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!