How to Set Up a Samba File Share

Samba implements the SMB protocol on Linux, letting Windows machines browse and mount your shares natively, and giving Linux clients a standard CIFS mount point. This guide walks through installing Samba, creating a dedicated share user, configuring a share, opening the firewall, and verifying access from both Windows and Linux. Configuration differences between Debian/Ubuntu, Fedora/RHEL, and Arch are called out at each step.

Install Samba

Debian / Ubuntu

sudo apt update && sudo apt install -y samba samba-common-bin

Fedora / RHEL 9 / Rocky Linux 9

sudo dnf install -y samba samba-common samba-client

Arch Linux

sudo pacman -S samba

On Arch, a minimal smb.conf is not created automatically. Copy the example before editing:

sudo cp /etc/samba/smb.conf.default /etc/samba/smb.conf

Create a Dedicated Share User

Samba maintains its own password database separate from /etc/shadow. Best practice is to create a system user with no login shell, then add that same username to Samba's database.

sudo useradd -M -s /sbin/nologin shareuser

sudo smbpasswd -a shareuser

You will be prompted to set a Samba password for shareuser. This password is what Windows and Linux clients will use — it does not need to match the system account password.

sudo smbpasswd -e shareuser

The -e flag enables the account; newly added accounts are disabled by default.

Create the Shared Directory

Pick a path. /srv/samba/shared is conventional and keeps share data under the FHS-correct /srv tree.

sudo mkdir -p /srv/samba/shared
sudo chown shareuser:shareuser /srv/samba/shared
sudo chmod 0770 /srv/samba/shared

If you want multiple local users to read/write the share, create a dedicated group instead and assign it to the directory:

sudo groupadd sambashare
sudo usermod -aG sambashare shareuser
sudo chown root:sambashare /srv/samba/shared
sudo chmod 2770 /srv/samba/shared

The setgid bit (2770) ensures new files inherit the group, which avoids permission drift over time.

Configure smb.conf

The main configuration file is /etc/samba/smb.conf. Back it up first, then edit it.

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak
sudo nano /etc/samba/smb.conf

A working minimal configuration looks like this. Add or replace the [global] section and append the share stanza at the bottom:

[global]
   workgroup = WORKGROUP
   server string = Samba Server
   server role = standalone server
   log file = /var/log/samba/log.%m
   max log size = 50
   dns proxy = no
   # Disable legacy SMB1 — it is insecure
   server min protocol = SMB2

[shared]
   comment = Shared Files
   path = /srv/samba/shared
   browseable = yes
   read only = no
   valid users = shareuser
   create mask = 0660
   directory mask = 0770
   force group = sambashare

Key directives explained:

• server min protocol = SMB2 — disables SMB1, which has known critical vulnerabilities (EternalBlue). Never re-enable it unless you have a very specific legacy device requirement.
• valid users — restricts the share to named Samba accounts. Comma-separate multiple users, or use @sambashare to allow an entire group.
• create mask / directory mask — set maximum permissions on newly created files and directories inside the share.

Validate the configuration before restarting the service:

testparm

testparm will print the parsed configuration and flag syntax errors. Fix any warnings before proceeding.

Enable and Start the Samba Services

Samba requires two units: smbd (file sharing) and nmbd (NetBIOS name resolution for older clients). On modern networks with DNS you can skip nmbd, but enabling it costs little.

Debian / Ubuntu

sudo systemctl enable --now smbd nmbd

Fedora / RHEL / Rocky

sudo systemctl enable --now smb nmb

Note the different unit names (smb/nmb vs smbd/nmbd) on the Red Hat family.

Arch Linux

sudo systemctl enable --now smb nmb

Open the Firewall

Samba needs TCP 445 (SMB direct) and TCP/UDP 137–139 (NetBIOS). Most modern clients only need 445.

firewalld (Fedora / RHEL / Rocky)

sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload

ufw (Debian / Ubuntu)

sudo ufw allow samba

nftables (Arch or manual setup)

sudo nft add rule inet filter input tcp dport 445 accept
sudo nft add rule inet filter input udp dport '{137,138}' accept
sudo nft add rule inet filter input tcp dport 139 accept

Persist these rules according to your nftables setup (typically by saving to /etc/nftables.conf).

SELinux (RHEL / Fedora / Rocky)

If SELinux is enforcing, label the share path correctly and enable the required boolean:

sudo semanage fcontext -a -t samba_share_t '/srv/samba/shared(/.*)?'
sudo restorecon -Rv /srv/samba/shared
sudo setsebool -P samba_enable_home_dirs off

Connect from Windows

Open File Explorer and type the server's IP or hostname in the address bar:

\\192.168.1.50\shared

Windows will prompt for credentials. Enter shareuser and the Samba password you set with smbpasswd. To map as a persistent drive, right-click This PC → Map network drive and check Reconnect at sign-in.

Connect from Linux

One-off mount with smbclient (testing)

smbclient //192.168.1.50/shared -U shareuser

Mounting with mount.cifs

sudo apt install -y cifs-utils   # Debian/Ubuntu
sudo dnf install -y cifs-utils   # Fedora/RHEL

sudo mkdir -p /mnt/shared
sudo mount -t cifs //192.168.1.50/shared /mnt/shared \
  -o username=shareuser,password=yourpassword,vers=3.0,uid=$(id -u),gid=$(id -g)

For persistent mounts, store credentials in a protected file and reference it in /etc/fstab instead of embedding passwords in the mount options:

echo -e 'username=shareuser\npassword=yourpassword' | sudo tee /etc/samba/credentials
sudo chmod 600 /etc/samba/credentials

//192.168.1.50/shared  /mnt/shared  cifs  credentials=/etc/samba/credentials,vers=3.0,uid=1000,gid=1000,_netdev  0  0

Add that line to /etc/fstab. The _netdev option tells systemd to wait for the network before attempting the mount.

Verify and Troubleshoot

Check service status

sudo systemctl status smbd   # or smb on RHEL family

List active shares and connections

sudo smbstatus

Test authentication locally

smbclient -L localhost -U shareuser

This should list available shares. If it fails with NT_STATUS_LOGON_FAILURE, the Samba password for the user is wrong or the account is disabled — re-run smbpasswd -e shareuser.

Common issues

• Permission denied on the share — check that shareuser owns or has group access to /srv/samba/shared, and that valid users matches the login you're using.
• Share not visible on Windows — confirm nmbd/nmb is running and UDP 137/138 is open. On modern Windows 10/11, SMB discovery over NetBIOS is often disabled; access by IP directly.
• SELinux denials — run sudo ausearch -m avc -ts recent to read audit denials and confirm the file context is set correctly.
• mount.cifs fails with "wrong fs type" — install cifs-utils on the client; the kernel module is present but the userspace helper is missing.