Install and Configure a Samba Server on Linux: Fast, Secure File Sharing for Windows Clients

Table of Contents

Comparing Linux-to-Windows File Sharing Options

Sharing files between Linux servers and Windows workstations is a daily task in mixed-OS environments. Over the years, network admins have relied on a few standard protocols. Each comes with clear practical trade-offs:

Samba (SMB/CIFS): The de facto standard for cross-platform sharing. Windows Explorer connects out of the box with zero third-party software. It maps Windows ACLs cleanly to Linux permissions and pairs seamlessly with Active Directory if your company scales into domain accounts.
NFS (Network File System): Blazing fast for Linux-to-Linux transfers, but clunky on Windows. Windows clients need Pro or Enterprise editions with optional NFS features turned on. Mapping Windows Security Identifiers (SIDs) to Linux UID/GIDs often triggers confusing permission errors.
SFTP / SSHFS: Great for quick one-off administration tasks over SSH. For non-technical desktop users, mounting an SSHFS directory as a drive letter requires installing helper drivers like WinFsp and SSHFS-Win. These tools often freeze or drop connections during large transfers.
WebDAV / Cloud Gateways (Nextcloud, ownCloud): Reliable for remote workers who need web access and mobile sync. However, running a full web server and a MySQL database creates heavy overhead when you only need fast 1 Gbps or 10 Gbps transfers across a local office switch.

Pros and Cons of Samba

Before standardizing your local storage on Samba, weigh the benefits against day-to-day administrative quirks:

The Good

Zero client setup: Users map network drives instantly using standard Universal Naming Convention (UNC) paths like \\192.168.1.100\share.
Multi-layered access control: You can stack Samba share restrictions on top of standard Linux POSIX permissions and POSIX ACLs.
Modern wire security: Modern Samba releases default to SMB3 encryption, multichannel bandwidth aggregation, and robust dialect checks while ditching vulnerable legacy protocols.

The Catches

Two separate user databases: Unless you run an active LDAP or Active Directory domain, every user needs an account in both /etc/passwd and Samba’s local database (passdb.tdb).
Permission masking conflicts: A slight mismatch between Unix directory modes (chmod/chown) and Samba creation masks (create mask/directory mask) will quickly lock users out of newly created spreadsheets.

Recommended Architecture: The setgid Approach

Never run wide-open, unauthenticated guest shares on a production LAN. Instead, set up an isolated group-managed directory using the Linux setgid bit. This forces every new file and subfolder to inherit the parent directory’s group ownership automatically.

We tested this on an Ubuntu 22.04 LTS VM with 2 vCPUs and 4GB RAM serving 25 concurrent Windows 11 clients. Group inheritance cut permission-related support tickets to zero. It also removed the need for an hourly chmod -R cleanup cron job that previously wasted CPU cycles during busy workdays.

Our baseline security profile enforces four core rules:

Require SMB2 or SMB3 dialects. Dropping SMBv1 blocks legacy attacks like EternalBlue.
Bind access to a dedicated non-root Linux group (such as smbfinance).
Lock down parent directories with chmod 2770 to guarantee consistent group ownership.
Bind the Samba listener strictly to your private subnet. Never expose port 445 to the public internet.

Step-by-Step Implementation

Step 1: Install Samba Packages

First, update your package index and install the required Samba binaries:

sudo apt update
sudo apt install -y samba samba-common-bin smbclient

Confirm that the Samba daemon is active:

sudo systemctl status smbd --no-pager

Step 2: Build the Directory Structure and Assign Groups

Keep shared assets out of personal home directories. The standard convention on Debian and Ubuntu systems is /srv/samba. Create the share directory along with a dedicated system group:

sudo mkdir -p /srv/samba/finance_share
sudo groupadd smbfinance

Assign ownership to root:smbfinance and apply the 2770 mode. The leading 2 sets the setgid bit:

sudo chown -R root:smbfinance /srv/samba/finance_share
sudo chmod -R 2770 /srv/samba/finance_share

Step 3: Add Linux and Samba Users

Samba needs an underlying Linux user account to manage file ownership, but that user does not need interactive shell access to your server. Use the -M (no home directory) and -s /usr/sbin/nologin flags to create a restricted system user:

# Create the restricted Linux user
sudo useradd -M -s /usr/sbin/nologin -g smbfinance sarah

# Set the Samba password for Windows authentication
sudo smbpasswd -a sarah

Enter a strong password when prompted. Windows users will enter this password when mapping the share from their desktop.

Step 4: Configure /etc/samba/smb.conf

Always back up the default configuration file before editing:

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

Open the configuration file in your editor:

sudo nano /etc/samba/smb.conf

Replace or update the [global] block with these hardened defaults. Adjust the interfaces line to match your actual subnet (for example, 192.168.1.0/24):

[global]
   workgroup = WORKGROUP
   server string = Ubuntu File Server
   security = user
   passdb backend = tdbsam
   
   # Protocol hardening: disable SMB1 and NetBIOS
   server min protocol = SMB2_10
   client min protocol = SMB2_10
   disable netbios = yes
   smb ports = 445
   bind interfaces only = yes
   interfaces = 127.0.0.1/8 192.168.1.0/24
   
   # Logging
   log file = /var/log/samba/log.%m
   max log size = 1000
   logging = file

Scroll to the bottom of the file and define the share definition for the finance team:

[Finance]
   comment = Finance Team Shared Storage
   path = /srv/samba/finance_share
   valid users = @smbfinance
   guest ok = no
   read only = no
   browsable = yes
   create mask = 0660
   directory mask = 0770
   force group = smbfinance

Save the file and check your configuration syntax:

testparm

If testparm outputs Loaded services file OK, apply your changes:

sudo systemctl restart smbd

Step 5: Configure the Firewall

If you use UFW, restrict inbound traffic on port 445 to your internal subnet. Avoid opening this port globally:

sudo ufw allow from 192.168.1.0/24 to any port 445 proto tcp comment 'Samba SMB'

Step 6: Connect from a Windows Workstation

Press Windows Key + R to launch the Run dialog.
Type your server’s UNC path: \\192.168.1.100\Finance and press Enter.
When Windows asks for network credentials, enter sarah and the Samba password you set earlier.
Create a test .docx or .txt file inside the folder. Verify you can edit, rename, and delete the file without errors.

Troubleshooting Common Issues

If Windows displays an Access is Denied prompt:

Check directory permissions: Run ls -ld /srv/samba/finance_share. The output should show drwxrws--- with root:smbfinance ownership. If the sticky s bit is missing, rerun sudo chmod 2770 /srv/samba/finance_share.
Inspect active client logs: Tail the connection logs with sudo tail -n 50 /var/log/samba/log.* to see failed login attempts or protocol rejections.
Verify account status: If the user cannot connect, make sure their Samba account is not disabled: sudo smbpasswd -e sarah.