How to configure Samba Server share on Debian 9 Stretch Linux

Lubos Rendek

Debian

13 June 2017

Contents

Objective

The objective is to perform a basic configuration of Samba server on Debian 9 Stretch Linux to provide access to Samba shares via MS Windows client machine.

Operating System and Software Versions

Operating System: - Debian 9 Stretch
Software: - Samba 4.5.8-Debian

Requirements

Privileged access to your Debian system will be required.

Difficulty

EASY

Conventions

# - requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command
$ - requires given linux commands to be executed as a regular non-privileged user

Scenario

The below configuration procedure will assume a following scenario and pre-configured requirements:

Server and MS Windows client are located on the same network and no firewall is blocking any communication between the two
MS Windows client can resolve samba server by hostname samba-server
MS Windows client's Workgroup domain is WORKGROUP

Instructions

Installation

Let's start by Samba server installation:

# apt install samba

Furthermore, for testing purposes it is also recommended to install samba client:

# apt install smbclient

Samba server should now be up and running on your system:

# systemctl status smbd

● smbd.service - Samba SMB Daemon

   Loaded: loaded (/lib/systemd/system/smbd.service; enabled; vendor preset: enabled)

   Active: active (running) since Tue 2017-06-13 10:35:34 AEST; 3min 32s ago

     Docs: man:smbd(8)

           man:samba(7)

           man:smb.conf(5)

 Main PID: 1654 (smbd)

   Status: "smbd: ready to serve connections..."

   CGroup: /system.slice/smbd.service

           ├─1654 /usr/sbin/smbd

           ├─1655 /usr/sbin/smbd

           ├─1656 /usr/sbin/smbd

           └─1659 /usr/sbin/smbd

SUBSCRIBE TO NEWSLETTER
Subscribe to Linux Career NEWSLETTER and receive latest Linux news, jobs, career advice and tutorials.

Default Samba Configuration

The main Samba configuration file is called /etc/samba/smb.conf. Before we start editing smb.conf config file, let's make a backup of the original configuration file and extract a current configuration relevant lines to a new smb.conf file:

# cp /etc/samba/smb.conf /etc/samba/smb.conf_backup

# grep -v -E "^#|^;" /etc/samba/smb.conf_backup | grep . > /etc/samba/smb.conf

Your new /etc/samba/smb.conf should now contain:

# cat /etc/samba/smb.conf

[global]

   workgroup = WORKGROUP

   dns proxy = no

   log file = /var/log/samba/log.%m

   max log size = 1000

   syslog = 0

   panic action = /usr/share/samba/panic-action %d

   server role = standalone server

   passdb backend = tdbsam

   obey pam restrictions = yes

   unix password sync = yes

   passwd program = /usr/bin/passwd %u

   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

   pam password change = yes

   map to guest = bad user

   usershare allow guests = yes

[homes]

   comment = Home Directories

   browseable = no

   read only = yes

   create mask = 0700

   directory mask = 0700

   valid users = %S

[printers]

   comment = All Printers

   browseable = no

   path = /var/spool/samba

   printable = yes

   guest ok = no

   read only = yes

   create mask = 0700

[print$]

   comment = Printer Drivers

   path = /var/lib/samba/printers

   browseable = yes

   read only = yes

   guest ok = no

Restart your samba server and use SMB client to confirm all exported samba groups:

# systemctl restart smbd

# smbclient -L localhost

WARNING: The "syslog" option is deprecated

Enter root's password:

Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.8-Debian]

        Sharename       Type      Comment

        ---------       ----      -------

        print$          Disk      Printer Drivers

        IPC$            IPC       IPC Service (Samba 4.5.8-Debian)

Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.8-Debian]

        Server               Comment

        ---------            -------

        LASERPRINTER

        LINUXCONFIG          Samba 4.5.8-Debian

        Workgroup            Master

        ---------            -------

        WORKGROUP            LINUXCONFIG

Add Users

Samba has its own user management system. However, any user existing on the samba user list must also exist within /etc/passwd file. From this reason, create a new user using useraddcommand before creating any new Samba user. Once your new system user eg. linuxconfig exits, use smbpasswd command to create a new Samba user:

# smbpasswd -a linuxconfig

New SMB password:

Samba Home Directories Share

By default all home directories are exported read-only and they are not browseable. To change this default configuration settings change the current homes share definition to:

[homes]

   comment = Home Directories

   browseable = yes

   read only = no

   create mask = 0700

   directory mask = 0700

   valid users = %S

Every time you make a change to your /etc/samba/smb.conf configuration file do not forget to restart your samba server daemon:

# systemctl restart smbd

Samba Public Anonymous Share

The following Samba definition will allow any user to read and write data into Samba share under /var/samba/ directory. First, create a new directory and make it accessible by anyone:

# mkdir /var/samba

# chmod 777 /var/samba/

Next, add a new samba share definition within your /etc/samba/smb.conf Samba configuration file:

[public]

  comment = public anonymous access

  path = /var/samba/

  browsable =yes

  create mask = 0660

  directory mask = 0771

  writable = yes

  guest ok = yes

Restart your samba server daemon:

# systemctl restart smbd

Mount Samba Shares

Now, we are ready to turn our attention to MS Windows machine and network map our new Samba share directories. Start by listing all available shares by \\samba-server command execution:

If all went well you should see the list of all browsable samba shares:

Next, map any of the shared directories by right-clicking on the share and selecting a Map Network Drive... option. Tick, Connect using different credentials option and finish the network drive mapping by supplying the user credentials created in previous steps:

Appendix

List Samba users:

# pdbedit -w -L

Delete Samba user:

# pdbedit -x -u username