SMB HOWTO: Samba file shares and mounting Windows shares

Updated November 2026

SMB is the file-sharing protocol of Windows, and Samba is its free implementation for Linux. With Samba a Linux machine can share folders with Windows, macOS and Linux clients; with the kernel’s CIFS client (from cifs-utils) it can mount shares from Windows or any NAS. This page covers both directions with SMB2 and SMB3, because SMB1 is switched off by default.

The classic SMB HOWTO from 2000 is kept by the Linux Documentation Project at tldp.org. As of November 2026 the newest Samba release series is 4.25 (4.25.1); Debian 13 ships Samba 4.22. Everything below works on both.

SMB1 is gone by default

Since Samba 4.11, both server min protocol and client min protocol default to SMB2_02, so clients and servers that only speak SMB1 (also called NT1 or CIFS) can no longer connect. The Linux kernel client stopped asking for SMB1 by default in kernel 4.13.5; it now negotiates the highest version at or above SMB 2.1 that both sides support. The mount.cifs manual notes that SMB1 has much weaker security.

Do not turn SMB1 back on for convenience. If an old scanner or media player only speaks SMB1, upgrade its firmware, or give it a separate, isolated Samba instance or VLAN. Setting server min protocol = NT1 on your main file server weakens it for everyone.

A Samba file server

# Debian / Ubuntu
sudo apt install samba smbclient
# Fedora / RHEL / Alma / Rocky
sudo dnf install samba samba-client

Create a group, a shared directory and the Linux accounts that may use it. New files inherit the group because of the setgid bit (the 2 in 2770):

sudo groupadd projects
sudo usermod -aG projects alice
sudo mkdir -p /srv/samba/projects
sudo chgrp projects /srv/samba/projects
sudo chmod 2770 /srv/samba/projects

Replace /etc/samba/smb.conf with a short, readable file (keep a copy of the packaged one):

[global]
    workgroup = WORKGROUP
    server role = standalone server
    log file = /var/log/samba/log.%m
    max log size = 1000
    logging = file

[projects]
    path = /srv/samba/projects
    read only = no
    valid users = @projects
    force group = projects
    create mask = 0660
    directory mask = 2770

server role = standalone server means Samba keeps its own user list and is not part of a domain. valid users = @projects allows only members of the Linux group. create mask and directory mask keep files group-writable but private from other users. Check the file every time you change it:

testparm -s

A good run ends the header with Server role: ROLE_STANDALONE and then prints your settings without errors.

Samba passwords

Samba cannot use the hashes in /etc/shadow, so each user needs a Samba password as well. The Linux account must exist first and must not be locked:

sudo smbpasswd -a alice     # prompts for the new SMB password
sudo pdbedit -L             # list Samba users

Start, open the firewall, and label for SELinux

# Debian / Ubuntu: the services are smbd and nmbd
sudo systemctl enable --now smbd
sudo ufw allow from 192.168.1.0/24 to any port 445 proto tcp

# Fedora / RHEL: the services are smb and nmb
sudo systemctl enable --now smb
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload
sudo semanage fcontext -a -t samba_share_t "/srv/samba/projects(/.*)?"
sudo restorecon -Rv /srv/samba/projects

Modern clients reach SMB on TCP port 445. nmbd (NetBIOS name service) is only needed for old-style network browsing; Red Hat advises not to start it when Samba is part of an Active Directory domain. Without the samba_share_t label, SELinux on Fedora and RHEL blocks access even when file permissions are right.

Test it

smbclient -L //localhost -U alice
smbclient //fileserver/projects -U alice -c 'ls'

From Windows, type \\fileserver\projects into File Explorer’s address bar. On macOS use Go → Connect to Server with smb://fileserver/projects.

Guest shares. Samba’s wiki shows a guest-only share using map to guest = Bad User and guest ok = yes, but warns that guest shares are a security risk, should never be mixed with authenticated users, and may not work from Windows 10 (version 1709) or later, which can block SMB2/3 guest access by default. Use real accounts.

Mount a Windows or Samba share on Linux

# Debian / Ubuntu
sudo apt install cifs-utils
# Fedora / RHEL
sudo dnf install cifs-utils

sudo mkdir -p /mnt/projects
sudo mount -t cifs //fileserver/projects /mnt/projects \
     -o username=alice,uid=$(id -u),gid=$(id -g)

Without uid= and gid=, files on a server without Unix extensions (any Windows server) appear owned by root, because both default to 0. Check what was negotiated with findmnt -t cifs; the options include vers=3.1.1 or similar.

Permanent mounts with a credentials file

Never put a password in /etc/fstab, which every user can read. Create a root-only credentials file instead:

sudo mkdir -p /etc/samba/credentials
sudo install -m 600 /dev/null /etc/samba/credentials/fileserver
sudoedit /etc/samba/credentials/fileserver

Its format is one setting per line:

username=alice
password=<alice-smb-password>
domain=WORKGROUP

Then add to /etc/fstab:

//fileserver/projects  /mnt/projects  cifs  credentials=/etc/samba/credentials/fileserver,uid=1000,gid=1000,file_mode=0640,dir_mode=0750,_netdev,nofail,x-systemd.automount  0 0
sudo systemctl daemon-reload
sudo systemctl restart remote-fs.target   # starts the new automount unit now
ls /mnt/projects                          # first access mounts the share

Add seal to the options to request SMB3 encryption on networks you do not trust. If several local users should each use their own server account through one mount, look at the multiuser option in mount.cifs(8). Desktop users rarely need fstab: GNOME Files and KDE Dolphin open smb://fileserver/projects directly.

Samba as an Active Directory domain controller

Samba can also be an Active Directory domain controller (DC): Windows and Linux machines join the domain, users log in with one password, and Group Policy works. Provisioning creates the domain, its Kerberos realm and its DNS zone in one step:

sudo samba-tool domain provision --interactive

Before you run it, follow the Samba wiki’s checklist: a static IP address, a short host name (under 15 characters), the full name resolving to the LAN address rather than 127.0.0.1, no existing smb.conf, and a DNS domain you will never need to rename (avoid .local). Provision only the first DC; further DCs join the existing domain.

Distribution support differs. Debian and Ubuntu package the AD DC parts (samba-ad-dc on Debian 13). Red Hat states that it does not support running Samba as an AD domain controller on RHEL; for central accounts on RHEL-family systems, see FreeIPA in the LDAP HOWTO. Samba as a domain member (server role = member server with winbind) is supported widely.

Common problems

Sources