Setup Samba Linux: Complete Guide to a Shareable Drive

If you need to setup Samba on Linux for cross-platform file sharing across Windows, macOS, and mobile devices, this guide walks through the full process: smb.conf configuration, Windows 11 24H2 compatibility, WS-Discovery, and security patching.

While NFS works well for Linux-to-Linux file sharing, many home servers have a mix of operating systems. When you need to share files between Linux servers and Windows machines, or want broader device compatibility, Samba handles it.

I run Samba alongside NFS on my N100 mini PC that hosts Jellyfin and handles backups. All family devices (Windows laptops, Android phones, and Linux machines) access shared media and documents through it. NFS gives me performance between Linux systems, and Samba covers everything else. If you’re shopping for hardware, the ASUS DC510 is a good compact option for this kind of always-on home server.

Understanding SMB, CIFS, and Samba

What is Samba?

Samba is an open-source implementation of the SMB/CIFS protocol that lets Linux and Unix systems communicate with Windows systems using native Windows networking protocols. It turns your Linux machine into a Windows-compatible file server.

What Samba gives you

Samba vs NFS Comparison

If you only need HTTP-based file access, serving a WebDAV share with Nginx is another option worth considering.

Prerequisites and Planning

Before setting up Samba, make sure you have:

Check Your Samba Version

Run this first to see what your distro ships:

smbd --version

Network Architecture for Mixed Environment

Step 1: Samba Server Configuration on Linux (smb.conf)

This is the core section. Install, configure, test, and start your Samba server.

Install Samba Package

sudo apt update && sudo apt install samba samba-common-bin -y

sudo dnf install samba samba-client samba-common -y

Create Samba Users

Samba maintains its own user database separate from system users. Create users for file sharing:

# Add system user (if doesn't exist)
sudo useradd -m -s /bin/bash mediauser

# Add user to Samba database
sudo smbpasswd -a mediauser

Create Shared Directories

Organize your shared directories:

# Create main Samba directory
sudo mkdir -p /srv/samba

# Create specific share directories
sudo mkdir -p /srv/samba/media
sudo mkdir -p /srv/samba/documents
sudo mkdir -p /srv/samba/backups
sudo mkdir -p /srv/samba/public

# Set ownership
sudo chown -R mediauser:mediauser /srv/samba/media
sudo chown -R mediauser:mediauser /srv/samba/documents
sudo chown -R nobody:nogroup /srv/samba/public

# Set permissions
sudo chmod -R 755 /srv/samba
sudo chmod -R 777 /srv/samba/public

Configure smb.conf (Modern Global Block)

The main configuration file is /etc/samba/smb.conf. Back up the original first:

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup

Edit the configuration file:

sudo nano /etc/samba/smb.conf

Here’s a modern, lean [global] block that works with Samba 4.19+ and Windows 11 24H2:

[global]
   workgroup = WORKGROUP
   server string = BitDoze Home Server
   netbios name = HOMESERVER

   # LAN-only bind (use your real CIDR, or remove these two lines entirely)
   interfaces = lo 192.168.1.0/24
   bind interfaces only = yes

   server role = standalone server
   security = user
   map to guest = bad user
   guest account = nobody

   # Explicit SMB3 (optional, SMB1 is already disabled by default since 4.11)
   server min protocol = SMB2_10
   server max protocol = SMB3_11

   # Recommended for Windows 11 24H2+ clients (signing required by default there)
   server signing = mandatory

   logging = file
   log file = /var/log/samba/%m.log
   max log size = 1000
   log level = 1

   # Uncomment to disable legacy NetBIOS traffic entirely (port 445 only)
   # smb ports = 445
   # disable netbios = yes

Define Share Sections

[media]
   comment = Media Files (Movies, Music, Photos)
   path = /srv/samba/media
   valid users = mediauser
   read only = no
   browsable = yes
   create mask = 0755
   directory mask = 0755
   force user = mediauser
   force group = mediauser

[documents]
   comment = Personal Documents
   path = /srv/samba/documents
   valid users = mediauser
   read only = no
   browsable = yes
   create mask = 0644
   directory mask = 0755

[backups]
   comment = Backup Storage
   path = /srv/samba/backups
   valid users = mediauser
   read only = no
   browsable = no
   create mask = 0600
   directory mask = 0700
   hide unreadable = yes

[public]
   comment = Public Share (Guest Access)
   path = /srv/samba/public
   public = yes
   guest ok = yes
   read only = no
   browsable = yes
   create mask = 0666
   directory mask = 0777
   force user = nobody
   force group = nogroup

With Samba 4.23+, SMB3 Unix Extensions are enabled by default. Files created from Linux and macOS clients keep their POSIX mode bits. The create mask and force user settings still apply to Windows clients.

Test, Start, and Enable Samba Services

First, validate your configuration:

# Test configuration syntax (read the output carefully)
sudo testparm -s

If testparm shows errors or unknown parameters, fix them before proceeding. Common mistakes: dead time (should be deadtime), encrypt passwords (remove it).

Then start the services:

sudo systemctl enable --now smbd nmbd
sudo systemctl status smbd nmbd

sudo systemctl enable --now smb nmb
sudo systemctl status smb nmb

Verify Samba is listening:

ss -tlnp | grep -E '445|139'

Expected output: lines showing port 445 (and 139 if NetBIOS is enabled) in LISTEN state.

Test a local connection:

smbclient //localhost/media -U mediauser -c 'ls'

You should see the contents of your media share (empty if freshly created).

Configure Firewall

sudo ufw allow samba

# Or manually if you prefer:
sudo ufw allow 445/tcp    # SMB over TCP
sudo ufw allow 137/udp    # NetBIOS Name Service
sudo ufw allow 138/udp    # NetBIOS Datagram Service
sudo ufw allow 139/tcp    # NetBIOS Session Service

sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload

Step 2: Connect Linux, Windows, and macOS Clients

Mount Samba Shares on Linux (cifs-utils & fstab)

Install CIFS Utilities

# Ubuntu/Debian
sudo apt install cifs-utils -y

# CentOS/RHEL
sudo dnf install cifs-utils -y

Create Credentials File

For security, store credentials in a protected file instead of putting them in fstab:

sudo nano /etc/samba/credentials

Add:

username=mediauser
password=your_password
domain=WORKGROUP

Secure the file:

sudo chmod 600 /etc/samba/credentials

Mount Samba Shares

# Create mount points
sudo mkdir -p /mnt/samba-media
sudo mkdir -p /mnt/samba-docs

# Mount shares
sudo mount -t cifs //192.168.1.100/media /mnt/samba-media \
  -o credentials=/etc/samba/credentials,uid=1000,gid=1000,vers=3.1.1,iocharset=utf8

# Verify mount
df -h | grep cifs

Permanent Mounting via fstab

Add entries to /etc/fstab for automatic mounting:

sudo nano /etc/fstab

Add these lines:

//192.168.1.100/media  /mnt/samba-media  cifs  credentials=/etc/samba/credentials,uid=1000,gid=1000,file_mode=0664,dir_mode=0775,vers=3.1.1,iocharset=utf8,nofail,x-systemd.automount,_netdev  0  0
//192.168.1.100/documents  /mnt/samba-docs  cifs  credentials=/etc/samba/credentials,uid=1000,gid=1000,file_mode=0664,dir_mode=0775,vers=3.1.1,iocharset=utf8,nofail,x-systemd.automount,_netdev  0  0

Key options: vers=3.1.1 forces SMB3 and avoids any SMB1 negotiation. x-systemd.automount mounts on first access instead of at boot (fixes the race where fstab tries to mount before the network is up). nofail prevents boot hangs if the share is unavailable.

Verify:

sudo mount -a && mount | grep cifs

Common failures:

• mount error(2): No such file or directory: wrong share name
• mount error(13): Permission denied: wrong credentials or SMB version mismatch; try adding vers=3.0 or vers=2.0

Windows 11 / 10 File Explorer & SMB Client (incl. 24H2 Fixes)

Basic Connection

Method 1: File Explorer

1. Open File Explorer
2. In the address bar, type: \\192.168.1.100 (replace with your server IP)
3. Enter your Samba username and password
4. Browse available shares

Method 2: Map Network Drive

# Using Command Prompt
net use Z: \\192.168.1.100\media /user:mediauser

# Using PowerShell
New-PSDrive -Name "Z" -PSProvider FileSystem -Root "\\192.168.1.100\media" -Credential (Get-Credential)

Windows 11 24H2 Changes

If you’re getting connection errors after upgrading to Windows 11 24H2, check your client configuration:

Get-SmbClientConfiguration | FL RequireSecuritySignature,EnableInsecureGuestLogons

server signing = mandatory

sudo systemctl restart smbd    # Debian/Ubuntu
sudo systemctl restart smb     # RHEL/Fedora

\\HOMESERVER\media

net use Z: \\HOMESERVER\media /user:mediauser

Set-SmbClientConfiguration -RequireSecuritySignature $false

macOS Finder + Avahi Discovery

1. Open Finder
2. Press Cmd + K to open “Connect to Server”
3. Enter: smb://192.168.1.100
4. Authenticate with your Samba credentials
5. Select shares to mount

To make Samba shares appear automatically in Finder’s Network sidebar, install avahi-daemon for mDNS/DNS-SD advertisement:

sudo apt install avahi-daemon -y
sudo systemctl enable --now avahi-daemon

Create the service file:

sudo nano /etc/avahi/services/smb.service

<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
  <name replace-wildcards="yes">%h SMB</name>
  <service>
    <type>_smb._tcp</type>
    <port>445</port>
  </service>
</service-group>

Restart avahi:

sudo systemctl restart avahi-daemon

Verify from another Mac: avahi-browse -a should show the SMB service.

Mobile Devices

iOS (iPhone/iPad): The native Files app has built-in SMB support since iOS 13. Open Files → tap the three dots (⋯) → “Connect to Server” → enter smb://192.168.1.100 → authenticate. No third-party app needed.

Android: Use Solid Explorer, CX File Explorer, or Google’s Android Samba Client (samba-documents-provider from the Play Store). AndSMB is another option.

Media streaming: VLC on both iOS and Android can browse and play media directly from SMB shares.

Step 3: Advanced Security and Performance

User and Group Management

Create Multiple Users

# Add additional users
sudo useradd -m john
sudo smbpasswd -a john

sudo useradd -m mary
sudo smbpasswd -a mary

# Create groups
sudo groupadd sambausers
sudo usermod -a -G sambausers john
sudo usermod -a -G sambausers mary

Group-Based Shares

Add group-based access to smb.conf:

[family-photos]
   comment = Family Photo Collection
   path = /srv/samba/photos
   valid users = @sambausers
   read only = no
   browsable = yes
   create mask = 0664
   directory mask = 0775
   force group = sambausers

SMB3 Encryption and Signing

Signing is already enabled via server signing = mandatory in the global config above. This protects against man-in-the-middle attacks and is required by Windows 11 24H2.

For full traffic encryption (useful on untrusted network segments or when tunneling over VPN):

[global]
   smb encrypt = required

Or per-share for sensitive data only:

[secure-docs]
   path = /srv/samba/secure
   smb encrypt = required
   valid users = mediauser

On a typical home LAN, signing alone is sufficient. Encryption adds CPU overhead. Use it when the network path is untrusted.

Access Control Lists (ACLs)

# Install ACL support
sudo apt install acl -y

# Set detailed permissions
sudo setfacl -R -m u:john:rwx /srv/samba/media
sudo setfacl -R -m u:mary:r-- /srv/samba/media
sudo setfacl -R -m g:sambausers:rw- /srv/samba/documents

Performance: What Actually Matters in 2026

What actually affects Samba performance:

1. Gigabit wiring and switch. If you’re on 100Mbps, no smb.conf tweak will help. This is the bottleneck in most home setups.
2. SMB3 Directory Leases (Samba 4.22+, on by default). Clients cache directory listings locally. Great for media libraries where you browse the same folders repeatedly.
3. deadtime = 15. Close idle connections after 15 minutes. Frees resources. Add to [global] if you want it.
4. noatime mount option. Add to the filesystem hosting your Samba shares in /etc/fstab to skip writing access timestamps on every read.
5. io_uring. Distro builds with liburing (Debian, Ubuntu) get io_uring-based async I/O in smbd automatically.
6. vfs_aio_ratelimit (Samba 4.24). Useful if your backing storage is slow (spinning disks, USB drives). Limits async I/O to prevent overwhelming the device.

Step 4: Integrate with Your Home Server

Jellyfin Integration

For media server integration, as I use in my N100 setup:

# Create dedicated media structure
sudo mkdir -p /srv/samba/media/{movies,tvshows,music,photos}

# Set ownership for Jellyfin user
sudo chown -R jellyfin:jellyfin /srv/samba/media

[jellyfin-media]
   comment = Jellyfin Media Library
   path = /srv/samba/media
   valid users = mediauser, jellyfin
   read only = no
   browsable = yes
   force user = jellyfin
   force group = jellyfin
   create mask = 0664
   directory mask = 0775

Backup Integration

Combine with adding a new drive to Ubuntu LVM for backup storage:

#!/bin/bash
# Backup script using Samba shares
BACKUP_DATE=$(date +%Y%m%d)
rsync -av --delete /home/ /srv/samba/backups/home-backup-$BACKUP_DATE/

For a more robust backup strategy, consider self-hosting backups with Restic and Rclone.

Docker Container Access

For Docker containers that need access to Samba shares:

services:
  filebrowser:
    image: filebrowser/filebrowser
    volumes:
      - /srv/samba:/srv
    ports:
      - "8080:80"

You can self-host FileBrowser with Docker for a web-based file manager that works alongside Samba.

Step 5: Discovery and Monitoring

Why Windows Can’t See Your Samba Share (wsdd2 / WS-Discovery)

This is the most common complaint after setting up Samba: you open Windows Explorer, click “Network,” and your server doesn’t appear.

The reason: modern Windows (10/11) uses WS-Discovery to discover network devices, not the old NetBIOS browse protocol that Samba’s nmbd handles. Samba has no built-in WS-Discovery server.

Install wsdd2 to fix this:

sudo apt install wsdd2 -y
sudo systemctl enable --now wsdd2

sudo apt install wsdd -y

# Create systemd unit if missing
sudo nano /etc/systemd/system/wsdd.service

[Unit]
Description=Web Services for Devices (wsdd)
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/wsdd --interface eth0
Restart=on-failure

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now wsdd

Verify:

systemctl status wsdd2    # or wsdd

Check Windows Explorer, then Network. Your Samba server should now appear.

Optional: Disable NetBIOS Entirely

On modern LANs where all clients support SMB2+, you can disable NetBIOS to reduce attack surface:

[global]
   smb ports = 445
   disable netbios = yes

Then stop and disable nmbd:

sudo systemctl disable --now nmbd    # Debian/Ubuntu
sudo systemctl disable --now nmb     # RHEL/Fedora

This eliminates ports 137, 138, and 139. Only port 445 remains. Only do this if all your clients are Windows 10+, macOS, or modern Linux.

Monitoring with smbstatus, Logs, and Prometheus

# View active Samba connections
sudo smbstatus

# Detailed connection info
sudo smbstatus -v

# Brief summary
sudo smbstatus -b

# Share access
sudo smbstatus -S

# Locked files
sudo smbstatus -L

# Real-time monitoring
watch -n 2 'sudo smbstatus'

Log analysis:

# View Samba logs
sudo tail -f /var/log/samba/log.smbd

# Client-specific logs
sudo tail -f /var/log/samba/192.168.1.101.log

# Search for errors
sudo grep -i error /var/log/samba/*.log

# Systemd journal
journalctl -u smbd -f

Graceful reload (no dropped connections) vs restart:

sudo systemctl reload smbd     # Graceful, preferred for config changes
sudo systemctl restart smbd    # Drops active connections

For Grafana users, Samba 4.23+ includes smb_prometheus_endpoint, a built-in Prometheus metrics exporter on port 9922. See server and Docker monitoring for setting up a full monitoring stack.

Troubleshooting Common Issues

Connection Problems

Diagnostic steps:

# Reset user password
sudo smbpasswd -x mediauser  # Remove user
sudo smbpasswd -a mediauser  # Re-add user

# Test local connection
smbclient //localhost/media -U mediauser -c 'ls'

Windows 11 24H2 Error Codes

Slow Transfer Speeds

1. Check network link speed:

   ethtool eth0 | grep Speed

   If it shows 100Mb/s, that’s your bottleneck — check cables and switch.

2. Test raw network throughput:

   # On server
   iperf3 -s
   # On client
   iperf3 -c 192.168.1.100

3. Check disk I/O:

   sudo iotop -o

4. Remove any legacy socket options from smb.conf — these hurt more than they help on modern kernels.

Permission Debugging

# Check effective permissions
sudo smbcacls //localhost/media /path/to/file -U mediauser

# Check ACLs
getfacl /srv/samba/media

# Reset permissions
sudo chmod -R 755 /srv/samba/
sudo chown -R mediauser:mediauser /srv/samba/media

Samba Security and Patching Best Practices

Keep Samba Patched

Samba security releases in the past year:

• 15 Oct 2025: CVE-2025-10230 (CVSS 10.0), CVE-2025-9640
• 26 May 2026: 6 CVEs patched
• 28 Jul 2026: 6 CVEs patched

Actionable steps:

# Check your version
smbd --version

# Update Samba
sudo apt update && sudo apt upgrade -y    # Debian/Ubuntu
sudo dnf upgrade samba -y                 # RHEL/Fedora

# Check for deprecation warnings after update
sudo testparm -s
journalctl -u smbd -b --priority=err

Subscribe to the Samba security announcements at https://www.samba.org/samba/history/security.html.

Network Security Checklist

[secure-share]
   path = /srv/samba/secure
   hosts allow = 192.168.1.0/24
   hosts deny = ALL
   smb encrypt = required
   valid users = mediauser

Backup and Recovery

# Backup Samba configuration
sudo cp /etc/samba/smb.conf /backup/smb.conf.$(date +%Y%m%d)

# Backup user database
sudo cp -r /var/lib/samba /backup/samba-users.$(date +%Y%m%d)

Restoration:

#!/bin/bash
# restore-samba.sh
sudo cp /backup/smb.conf.YYYYMMDD /etc/samba/smb.conf
sudo cp -r /backup/samba-users.YYYYMMDD/* /var/lib/samba/
sudo systemctl restart smbd nmbd    # Debian/Ubuntu
# sudo systemctl restart smb nmb   # RHEL/Fedora

Conclusion

Samba on Linux gives you cross-platform file sharing for mixed environments. It requires more configuration than NFS, but the universal compatibility makes it worth it for networks with Windows, macOS, and mobile devices.

On my N100 mini PC, running both NFS and Samba works best. NFS handles Linux-to-Linux transfers with speed, while Samba covers everything else. In 2026, the main things to get right: enable server signing = mandatory for Windows 11 24H2 compatibility, install wsdd2 so Windows can discover your shares, and keep Samba patched.

For more on home servers, see my guides on the best mini PCs for home servers and server monitoring. If you need a remote VPS for offsite replication or a WireGuard endpoint, a Hetzner Cloud VPS works well for that.