Quick answer

What this guide helps you do

Create an authenticated Samba share for a trusted home network, align Linux permissions, validate configuration and limit firewall exposure.

Plan the boundary

Use Samba on a trusted LAN or through a private VPN, not by forwarding SMB ports from the public internet. Decide which users need read-only or write access and confirm the underlying drive mounts reliably before Samba starts.

Install and preserve configuration

sudo apt update
sudo apt install samba
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup-$(date +%F-%H%M%S)

Create a dedicated Linux group and directory, adapting names to your setup:

sudo groupadd -f sambashare
sudo mkdir -p /srv/shares/home
sudo chgrp sambashare /srv/shares/home
sudo chmod 2770 /srv/shares/home

Add an authenticated user

The account must exist in Linux and in Samba’s password database:

sudo usermod -aG sambashare YOUR_USER
sudo smbpasswd -a YOUR_USER

Use a strong, unique password. Re-login is needed before a current shell receives new group membership.

Define the share

Append a controlled share to /etc/samba/smb.conf:

[HomeShare]
    path = /srv/shares/home
    browseable = yes
    read only = no
    guest ok = no
    valid users = @sambashare
    force group = sambashare
    create mask = 0660
    directory mask = 2770

Samba rules do not override Linux filesystem permissions; both layers must permit access.

Validate before reload

sudo testparm
sudo systemctl reload smbd
sudo systemctl status smbd --no-pager

Do not reload invalid configuration. Test locally where the smbclient package is available, then connect from a LAN client using the server name or address.

Limit firewall exposure

If UFW is active, allow Samba only from the trusted subnet rather than from anywhere. Verify listening sockets and existing rules:

sudo ss -lntup | grep -E ':(139|445)'
sudo ufw status verbose

Never expose TCP 445 directly to the internet.

Troubleshoot methodically

Permission denied requires checking the Samba user, valid-users rule, Linux group membership, parent-directory traversal and mounted filesystem. A missing share requires testparm, service logs, firewall and name-resolution checks.

sudo journalctl -u smbd -b --no-pager -n 100
namei -l /srv/shares/home
getfacl -p /srv/shares/home

Verification checklist

  • The storage drive mounts before Samba.
  • Guest access is disabled unless intentionally required.
  • Linux and Samba identities are aligned.
  • testparm reports valid configuration.
  • Firewall access is limited to the trusted network.
  • Read and write behaviour matches the design.
  • A reboot preserves the share.
  • Shared data has an independent backup.

This is a secure starting pattern, not a claim that it fits every network.

Next: Give Docker Access to a USB Drive. Return to Mount a Drive Automatically with fstab.

Official reference: Set up Samba as a file server.