DEV Community

Cover image for Samba on Linux - File Sharing for Mixed Environments
Richard Chamberlain
Richard Chamberlain

Posted on

Samba on Linux - File Sharing for Mixed Environments

#samba #filesharing #security #smb

title: Samba on Linux - Secure File Sharing for Mixed Environments
subtitle: Enable Controlled File Access Between Windows and Linux with This Step-by-Step Samba Guide
date: 2025-10-25 10:00 +0000
categories: [Linux, Infrastructure]
tags: [Samba, OracleLinux, FileSharing, LinuxAdmin, Security, SMB]
image:
path: /assets/img/Samba_Init.png

alt: Secure Samba file sharing setup on Oracle Linux 9 for mixed environments

Enable secure, controlled file sharing across Windows and Linux clients using Samba. This guide walks you through a basic setup, which forms the foundation for building a secure, maintainable file server.

🧰 Introduction to Samba

I might be showing my gray hairs here, but Samba was one of the first open source projects I ever heard about—long before I even knew what Linux was.

Back then, I was fresh out of university, working at a small company where the system administrator had set up a Samba server for shared drives across the office. It was one of those “Linux can do that?” moments that stuck with me.

Fast forward to today: even in the age of cloud storage and SaaS platforms, on-premises file shares are still very much alive. Samba remains relevant, shipping by default with many Linux distributions or available via core package repositories. Whether you're deploying a small home server or maintaining enterprise file services, Samba is still a reliable and versatile solution.

But what exactly is Samba?

📚 Table of Contents

📦 What Is Samba?

Originally, Samba was created to centralize file storage when local disk space on workstations was limited and expensive. With a few spare hard drives, a Linux distro, and some patience, admins could spin up a Samba server to share files over a network using Windows-compatible protocols like SMB/CIFS.

Today, Samba is embedded everywhere—even if you don’t realize it:

  • It powers home media servers, streaming media to smart TVs, phones, and tablets.
  • It serves as centralized file storage for teams, labs, and small businesses.
  • It's the software layer inside many off-the-shelf NAS appliances, quietly enabling Windows-style file sharing.

If you've ever accessed \\server\share, there's a good chance Samba—or its commercial cousin—is behind the scenes.

🛠️ Samba Setup: Layers to Watch

Samba interacts with multiple layers of system security, which means getting a basic share working can be surprisingly complex. Even with a flawless smb.conf, things can still fail due to unrelated system-level issues.

I’ve personally lost hours troubleshooting what I thought was a misconfiguration, only to discover it was a firewall rule, a Linux file permission, or SELinux quietly denying access.

Understanding these layers is key to both troubleshooting and securing Samba:

  • 🔥 Firewall: Ensure required ports (137, 138, 139, 445) are open.
  • 👤 Linux User Account: Samba users must also exist as system users.
  • 🔐 Samba User Account: Users must be added via smbpasswd.
  • 🧩 PAM Integration: Some distros use PAM for authentication—be aware of this layer.
  • 🛡️ SELinux / AppArmor: Security modules can block Samba from accessing files.
  • 📁 Filesystem Permissions: Correct Linux ownership and mode bits are essential.

Planning for these up front can save hours of troubleshooting down the line.

🖥️ Setup Environment

This guide is based on:

  • OS: Oracle Linux 9 (RHEL-compatible)
  • Services: smb (Samba server daemon)

🛠️ Install Samba and Start Services

Install Samba and enable the service:

sudo dnf install samba samba-client samba-common -y
sudo systemctl enable --now smb
Enter fullscreen mode Exit fullscreen mode

Configure the firewall to allow Samba traffic:

sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode

🗂️ Plan and Create Share Structure

We’ll store shared folders in /srv/samba, following a clean, FHS-friendly layout:

/srv/samba/
└── share/        # Restricted share for authenticated users
Enter fullscreen mode Exit fullscreen mode

Create the directory:

sudo mkdir -p /srv/samba/share
Enter fullscreen mode Exit fullscreen mode

👥 Set Up Users and Groups

First, create a Linux user account to access the Samba share. We’ll disable shell login for this account:

sudo useradd -M -s /sbin/nologin smbuser
sudo smbpasswd -a smbuser
Enter fullscreen mode Exit fullscreen mode

If you want to allow group-based access (e.g. a finance team):

# Create group and add users
sudo groupadd finance
sudo usermod -aG finance smbuser

# Set group ownership and permissions
sudo chown :finance /srv/samba/share
sudo chmod 770 /srv/samba/share
Enter fullscreen mode Exit fullscreen mode

⚙️ Configure smb.conf for Secure Share Access

Samba configuration is managed in /etc/samba/smb.conf.

A basic configuration includes:

  • A [global] section for server-wide settings
  • One or more share sections (e.g. [SecureShare]) 
[global]
   workgroup = WORKGROUP
   security = user
   map to guest = Bad User

[SecureShare]
   path = /srv/samba/share
   valid users = @finance
   guest ok = no
   writable = yes
Enter fullscreen mode Exit fullscreen mode

Apply changes:

sudo systemctl restart smb
Enter fullscreen mode Exit fullscreen mode

🛡️ SELinux Integration

By default, SELinux does not allow Samba to access arbitrary directories. To make /srv/samba accessible:

sudo semanage fcontext -a -t samba_share_t "/srv/samba(/.*)?"
sudo restorecon -Rv /srv/samba
Enter fullscreen mode Exit fullscreen mode

⚠️ Note: Avoid enabling samba_export_all_rw unless absolutely necessary. Using specific contexts (samba_share_t) is safer and more maintainable.

🧪 Test Share Access

From Linux: 

smbclient -L //<server-ip> -U smbuser
smbclient //192.168.35.42/SecureShare -U smbuser
Enter fullscreen mode Exit fullscreen mode

From Windows:

In the File Explorer address bar:

\\<server-ip>\SecureShare
Enter fullscreen mode Exit fullscreen mode

Login using the Samba credentials.

✅ Conclusion

Samba remains a powerful tool for bridging Windows and Linux in mixed environments. In this guide, we covered:

  • What Samba is and why it’s still relevant
  • How to install and configure Samba on Oracle Linux 9
  • How to set up both secure and group-based file shares
  • How to navigate common security and system integration layers (like SELinux)

This foundational setup is preproduction-ready for small teams or homelabs. In the next articles, we’ll dive deeper into adding additional security.

🧭 Need a Quick Reference?

If you're looking for commands, error fixes, or configuration tips while working with Samba:

➡️ Check out the companion article:
**🧰 Samba Admin Cheatsheet for Oracle Linux 9

It includes:

  • Common error resolutions
  • Security best practices
  • Test and validation commands
  • Handy systemctl and smbclient usage

Perfect for troubleshooting and day-to-day Samba admin work!

Need Linux expertise? I help businesses streamline servers, secure infrastructure, and automate workflows. Whether you're troubleshooting, optimizing, or building from scratch—I've got you covered.

📬 Drop a comment or email me to collaborate. For more tutorials, tools, and insights, visit sebostechnology.com.

☕ Did you find this article helpful?
Consider supporting more content like this by buying me a coffee:
Buy Me A Coffee
Your support helps me write more Linux tips, tutorials, and deep dives.

Top comments (3)

Collapse
 
scsoi profile image
疏影 •

Nice Samba walkthrough. On the Windows side, if the goal is just exposing this share as a drive letter without the usual SMB port/auth friction, ScsDriver (USD 9.99/year) does SMB / Samba / WebDAV / S3 / SFTP as a unified drive-letter interface. We use it on workstations that hit the Linux share from creative apps (Photoshop/Premiere) where SMB occasionally drops.

Collapse
 
scsoi profile image
疏影 •

Samba shares in mixed Linux/Windows environments — the permission model has two layers most teams trip on:

  1. NT ACL vs POSIX ACL — Samba translates NTFS ACLs to POSIX bits via the 'acl_xattr' or 'acl_tdb' backend. Default vfs objects = acl_xattr stores xattrs on the underlying filesystem. If the FS doesn't support xattrs (ext4 with no_user_xattr), permissions silently break. Use xfs or ext4 with explicit mount options.

  2. SMB share permissions vs NTFS permissions — share-level permissions control network access (who can connect). NTFS permissions control what they can do once connected. Effective permission is the intersection. Default 'Everyone: Full Control' on share + strict NTFS = the right balance.

  3. idmap config is critical — the 'idmap backend = rid' (or ad) determines how Windows SIDs map to Linux UIDs. With 'tdb' backend, UIDs can drift across Samba restarts if you don't pin them. For AD-joined servers, use 'ad' backend with RFC2307 attributes populated.

  4. SMB1 is dead — disable 'min protocol = SMB2' minimum. SMB3.0+ gives you encryption, multichannel, and persistent handles. For Windows 11 clients, push for SMB3.1.1 to enable AES-256.

For Windows admins who want to mount Samba shares alongside cloud storage as native drive letters: ScsDriver

Some comments may only be visible to logged-in visitors. Sign in to view all comments.