Samba implements the Windows file sharing protocol (SMB) on Linux. With it, a Linux server can share folders that Windows, macOS and Linux clients open as network drives. It’s useful for team file shares, backup targets for Windows machines, and media libraries. On an internet-facing VPS, though, SMB must stay behind a VPN.

Security first: never expose SMB publicly

SMB (TCP 445) is one of the most attacked protocols on the internet, and many ISPs block it anyway. On a VPS:

  • don’t open port 445 to the world;
  • give users access through WireGuard or Tailscale, and allow SMB only from the VPN subnet. See WireGuard and Tailscale;
  • or offer SFTP instead, which is safe to expose with keys. See SFTPGo.

The examples assume a VPN subnet of 10.8.0.0/24.

Install

sudo apt install samba
smbd --version

Create a shared folder and users

sudo groupadd smbteam
sudo useradd -M -s /usr/sbin/nologin alice        # no shell login
sudo usermod -aG smbteam alice
sudo smbpasswd -a alice                            # Samba password (separate from Linux)
sudo smbpasswd -e alice

sudo mkdir -p /srv/samba/team
sudo chown root:smbteam /srv/samba/team
sudo chmod 2770 /srv/samba/team                    # setgid: new files keep the group

Configure smb.conf

Add to /etc/samba/smb.conf:

[global]
   server min protocol = SMB3
   smb encrypt = required
   interfaces = lo 10.8.0.1/24
   bind interfaces only = yes
   hosts allow = 127.0.0.1 10.8.0.0/24
   hosts deny = 0.0.0.0/0
   map to guest = never

[team]
   path = /srv/samba/team
   valid users = @smbteam
   read only = no
   create mask = 0660
   directory mask = 2770
   force group = smbteam
  • server min protocol = SMB3 disables old, insecure SMB1 and SMB2.
  • smb encrypt = required encrypts all traffic (supported by Windows 8+ and current macOS and Linux clients).
  • interfaces + bind interfaces only make Samba listen only on the VPN interface.

Check and apply:

testparm
sudo systemctl restart smbd
sudo systemctl enable smbd
sudo ss -tlnp | grep smbd          # should listen on 10.8.0.1:445, not 0.0.0.0

Firewall (UFW):

sudo ufw allow from 10.8.0.0/24 to any port 445 proto tcp

If you don’t need Windows network browsing, disable nmbd: sudo systemctl disable --now nmbd.

Connect from clients

  • Windows: File Explorer → \\10.8.0.1\team, or map a drive: net use T: \\10.8.0.1\team /user:alice.
  • macOS: Finder → Go → Connect to Server → smb://10.8.0.1/team.
  • Linux:
sudo apt install cifs-utils
sudo mount -t cifs //10.8.0.1/team /mnt/team -o username=alice,uid=$(id -u),gid=$(id -g),seal

(seal requests encryption.) For fstab, store credentials in a root-only file, and use credentials=/root/.smbcred,_netdev,nofail. See mount options.

Permissions model

Access must be allowed by both Samba (valid users, read only) and Linux file permissions. When something fails, check both. See Linux file permissions explained.

Logs and troubleshooting

sudo tail -f /var/log/samba/log.smbd
sudo smbstatus                  # connected users and open files
smbclient -L //10.8.0.1 -U alice
Problem Check
Access denied smbpasswd -a done? User in valid users? Linux permissions?
Can’t connect VPN up? Samba bound to the VPN IP? Firewall rule?
Old client fails It may not support SMB3 encryption: update the client

Quick reference

Task Command
Install apt install samba
Add Samba user smbpasswd -a <user>
Check config testparm
Restart systemctl restart smbd
Connected users smbstatus
Port 445/tcp: VPN only

Related: NFS server and client and SMB file sharing on Windows Server.

  • Linux
  • File Sharing
  • Samba