Home

🗂 Categories

No results found

Samba — SMB/CIFS Shares

If you like this project, consider supporting me on Buy Me a Coffee ☕️

tags:

Description

Samba implements the SMB/CIFS protocol on Linux/Unix, enabling Windows-compatible file/print shares and AD/DC features. Clients mount shares via cifs-utils (mount.cifs) or Windows Explorer. / Samba — реализация SMB/CIFS на Linux: файловые/принтерные шары и AD/DC. Клиенты — через mount.cifs или Windows.

Common use cases / Типовые сценарии:

Status: Actively maintained (Samba project). Alternatives: NFS (Unix-native, better perf), WebDAV, Nextcloud (sync-centric), 10.0.0.x NAS UIs (vendor). / Статус: активно развивается; альтернативы — NFS, WebDAV, Nextcloud.

Default ports: 137-139/udp (NetBIOS), 139/tcp, 445/tcp (SMB).
Paths: config /etc/samba/smb.conf; logs /var/log/samba/; users via smbpasswd/tdbsam.

Cross-reference: NFS, storage, LVM.

Installation

Install Samba / Установка Samba

# Debian/Ubuntu
apt install samba samba-common-bin smbclient

# RHEL/Rocky/Alma/Fedora
dnf install samba samba-common samba-client

# SUSE
zypper install samba
systemctl enable --now smb nmb    # Debian: smbd nmbd
systemctl status smbd

Client tools / Клиентские инструменты

# Debian/Ubuntu
apt install cifs-utils

# RHEL
dnf install cifs-utils

Configuration

Main files / Основные файлы

/etc/samba/smb.conf

/etc/samba/smb.conf.d/*.conf (drop-ins, newer)

/var/lib/samba/ (tdbsam database)

/var/log/samba/log.smbd

Global + share config / Глобальные и шаровые настройки

/etc/samba/smb.conf

[global]
   workgroup = <WORKGROUP>
   security = user
   map to guest = bad user
   server string = File Server %h
   netbios name = <NETBIOS_NAME>
   interfaces = <LAN_IF> lo
   bind interfaces only = yes
   smb ports = 445
   server min protocol = SMB2
   server max protocol = SMB3
   log file = /var/log/samba/log.%m
   max log size = 10000
   dns proxy = no
   load printers = no
   printing = bsd
   printcap name = /dev/null
   disable spoolss = yes
   # Domain member example:
   # realm = <REALM>
   # security = ads
   # idmap config * : range = 100000-999999
   # winbind use default domain = yes

[data]
   path = /srv/samba/data
   browseable = yes
   read only = no
   valid users = @staff
   write list = @staff
   create mask = 0664
   directory mask = 0775
   force group = staff
   # veto files = /.AppleDouble/._*
testparm                 # Validate smb.conf
systemctl restart smbd nmbd

Samba user database / База пользователей Samba

# Create system user first (if local)
useradd -M -s /usr/sbin/nologin sambauser

# Set Samba password (tdbsam)
smbpasswd -a sambauser
smbpasswd -e sambauser
smbpasswd -d sambauser
pdbedit -L -v

CIFS mount / Монтирование CIFS

# Interactive
mount -t cifs //<SERVER>/<SHARE> /mnt/share -o username=<USER>,uid=1000,gid=1000,iocharset=utf8

# With credentials file
//<SERVER>/<SHARE>  /mnt/share  cifs  credentials=/etc/samba/cred,uid=1000,gid=1000,_netdev,nofail  0  0

/etc/samba/cred

username=<USER>
password=<SECRET_KEY>
domain=<DOMAIN>
chmod 0600 /etc/samba/cred

Core Management

Client access / Доступ клиентов

smbclient //<SERVER>/<SHARE> -U <USER>
smbclient //<SERVER>/<SHARE> -U <USER> -c 'ls; put local.txt; get remote.txt'
smbtree -U <USER>

Server monitoring / Мониторинг сервера

smbstatus
smbstatus --profile
smbstatus -p          # processes
smbstatus -S          # shares
smbstatus -L          # locks

Sample smbstatus excerpt:

PID     Username     Group        Machine
12345   sambauser    staff        <CLIENT_IP> (ipv4:<CLIENT_IP>:45234)

DNS/NBNS / DNS и NetBIOS

# Ensure 445/tcp open
ss -lntp | grep -E '445|139'
smbclient -L <SERVER> -U <USER>

Sysadmin Operations

Logs / Логи

journalctl -u smbd --no-pager -n 50
tail -f /var/log/samba/log.smbd

Logrotate / Ротация логов

/etc/logrotate.d/samba

/var/log/samba/*.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root adm
    sharedscripts
    postrotate
        systemctl kill -s HUP smbd >/dev/null 2>&1 || true
    endscript
}

Disk quota / Квоты диска

# Optional: setquota for share users (XFS/ext4)
setquota -u sambauser 50G 60G 0 0 /srv/samba/data

Security

Hardening checklist / Чек-лист ужесточения

  1. Use security = user (or ads) — never security = share / Не используйте share-безопасность
  2. Prefer SMB3 + encryption if supported / Предпочитайте SMB3
  3. Bind to specific interfaces / Привязывайтесь к интерфейсам
  4. Restrict valid users per share / Ограничьте valid users
  5. Keep credentials files mode 0600 / Файлы cred — только root
  6. Disable guest/anonymous where not required / Отключите guest
  7. Monitor smbstatus for anomalies / Мониторьте активные сессии
  8. Apply filesystem ACLs consistent with smb.conf / Согласуйте ACL ФС с smb.conf
# Encrypt SMB3 when client supports it
# mount -t cifs ... -o vers=3.0,seal

[!WARNING] SMB on untrusted networks can leak credentials if forced to older dialects. Prefer VPN/VLAN + SMB3. / На незащищённых сетях SMB может утекать учётки — используйте SMB3 и изолированные сети.

Backup and Restore

Backup / Резервное копирование

# Data
tar czf /var/backups/samba-data-$(date +%F).tar.gz -C /srv/samba/data .

# Config + user DB (tdbsam)
tar czf /var/backups/samba-config-$(date +%F).tar.gz \
  /etc/samba /var/lib/samba/private /var/lib/samba/users

Restore / Восстановление

systemctl stop smbd nmbd
tar xzf /var/backups/samba-config-<DATE>.tar.gz -C /
tar xzf /var/backups/samba-data-<DATE>.tar.gz -C /srv/samba/data
systemctl start smbd nmbd
smbstatus

Troubleshooting

Symptom Cause Fix
Connection refused on 445 smbd down / firewall systemctl start smbd; open 445/tcp
NT_STATUS_LOGON_FAILURE Wrong smbpasswd / not enabled smbpasswd -a/-e; check pdbedit
NT_STATUS_ACCESS_DENIED valid users / unix perms Check share ACL + unix ownership
Share visible but empty browseable / path perms ls -la /srv/samba/data
Slow large copies smb3 vs dialect / disk Force vers=3.0; check disk I/O
macOS Finder issues ntdot / vfs modules Add vfs objects = catia fruit streams_xattr 
testparm -s
smbclient //<SERVER>/<SHARE> -U <USER> -c ls
smbstatus
tail -20 /var/log/samba/log.smbd

Comparison Tables

File sharing protocols / Протоколы файлового доступа

Protocol Client ecosystem Auth Performance Notes
SMB/CIFS Windows, macOS, Linux SMB user/AD Good Windows-native
NFS Linux/Unix Kerberos / IP Better raw No Windows-native
WebDAV HTTP clients HTTP basic/SSO Medium Firewall-friendly
FTP/SFTP Legacy automation Password/key Variable Not real-time shares

Production Runbooks

Runbook: New department share / Новый общий доступ для отдела

  1. Create unix group dept_abc / Создать группу unix
  2. Create /srv/samba/dept_abc with correct ownership / Создать каталог
  3. Add smb.conf share block with valid users = @dept_abc / Добавить share
  4. testparm + restart smbd / Проверить и перезапустить
  5. smbpasswd -a for each user / Добавить пользователей
  6. Test mount from Windows and Linux / Проверить доступ
  7. Configure quota if required / Настроить квоты

Runbook: Migrate share to new server / Миграция шары на новый сервер

  1. rsync data to new path (idle window) / Синхронизировать данные
  2. Freeze writes on source (optional) / Заморозить запись
  3. Final rsync + verify checksums / Финальная синхронизация
  4. Cut DNS/IP or inform clients / Переключить клиентов
  5. Keep old share read-only for 1–2 weeks / Оставить старый share read-only

If you like this project, consider supporting me on Buy Me a Coffee ☕️

Source: devtoolbox-cheats

On this page

linux 📁 Samba Cheatsheet Description Installation Install Samba / Установка Samba Client tools / Клиентские инструменты Configuration Main files / Основные файлы Global + share config / Глобальные и шаровые настройки Samba user database / База пользователей Samba CIFS mount / Монтирование CIFS Core Management Client access / Доступ клиентов Server monitoring / Мониторинг сервера DNS/NBNS / DNS и NetBIOS Sysadmin Operations Logs / Логи Logrotate / Ротация логов Disk quota / Квоты диска Security Hardening checklist / Чек-лист ужесточения Backup and Restore Backup / Резервное копирование Restore / Восстановление Troubleshooting Comparison Tables File sharing protocols / Протоколы файлового доступа Production Runbooks Runbook: New department share / Новый общий доступ для отдела Runbook: Migrate share to new server / Миграция шары на новый сервер Documentation Links