12.4 Sharing Files with Samba
If you have machines running Windows, you’ll probably want to permit access to your Linux system’s files and printers from those Windows machines using the standard Windows network protocol, Server Message Block (SMB). macOS supports SMB file sharing too, but you can also use SSHFS, described in Section 12.5.
The standard file sharing software suite for Unix is called Samba. Not only does Samba allow your network’s Windows computers to get to your Linux system, but it also works the other way around: you can print and access files on Windows servers from your Linux machine via its Samba client software.
To set up a Samba server, do the following:
- Create an smb.conf file.
- Add file sharing sections to smb.conf.
- Add printer sharing sections to smb.conf.
- Start the Samba daemons
nmbdandsmbd.
When you install Samba from a distribution package, your system should perform these steps using some reasonable defaults for the server. However, it probably won’t be able to determine which particular shares (resources) on your Linux machine you want to offer to clients.
The discussion of Samba in this chapter is not intended to be comprehensive; it’s limited to getting Windows machines on a single subnet to see a standalone Linux machine through the Windows Network Places browser. There are countless ways to configure Samba, because there are many possibilities for access control and network topology. For the gory details on how to configure a large-scale server, see Using Samba, 3rd edition, by Gerald Carter, Jay Ts, and Robert Eckstein (O’Reilly, 2007), which is a much more extensive guide, and visit the Samba website (https://samba.org/).
12.4.1 Server Configuration
The central Samba configuration file is smb.conf, which most distributions place in an etc directory, such as /etc/samba. However, you might have to hunt around to find this file, as it could also be in a lib directory, such as /usr/local/samba/lib.
The smb.conf file format is similar to the XDG style that you’ve seen elsewhere (such as the systemd configuration format) and breaks down into several sections denoted with square brackets such as [global] and [printers]. The [global] section in smb.conf contains general options that apply to the entire server and all shares. These options primarily pertain to network configuration and access control. This sample [global] section shows how to set the server name, description, and workgroup:
[global]
# server name
netbios name = name
# server description
server string = My server via Samba
# workgroup
workgroup = MYNETWORK
These parameters work as follows:
netbios name The server name. If you omit this parameter, Samba uses the Unix hostname. NetBIOS is an API that SMB hosts often employ to talk to one another.
server string A short description of the server. The default is the Samba version number.
workgroup The Windows workgroup name. If you’re on a Windows domain, set this parameter to the name of your domain.
12.4.2 Server Access Control
You can add options to your smb.conf file to limit which machines and users can access your Samba server. Here are a few of the many options that you can set in your [global] section and in the sections that control individual shares (as described later in the chapter):
interfaces Set this to have Samba listen (accept connections) on the given networks or interfaces. For example:
interfaces = 10.23.2.0/255.255.255.0
interfaces = enp0s31f6
bind interfaces only Set this to yes when using the interfaces parameter in order to limit access to only the machines that you can directly reach on those interfaces.
valid users Set this to allow the given users access. For example:
valid users = jruser, bill
guest ok Set this parameter to true to make a share available to anonymous users on the network. Do this only if you’re sure that the network is private.
browseable Set this to make shares viewable by network browsers. If you set this parameter to no for any shares, you’ll still be able to access the shares on the Samba server, but you’ll need to know their exact names in order to be able to access them.
12.4.3 Passwords
In general, you should allow access to your Samba server only with password authentication. Unfortunately, the basic password system on Unix is different from that on Windows, so unless you specify cleartext network passwords or authenticate passwords with a Windows domain server, you must set up an alternative password system. This section shows you how to set up an alternative password system using Samba’s Trivial Database (TDB) backend, which is appropriate for small networks.
First, use these entries in your smb.conf [global] section to define the Samba password database characteristics:
# use the tdb for Samba to enable encrypted passwords
security = user
passdb backend = tdbsam
obey pam restrictions = yes
smb passwd file = /etc/samba/passwd_smb
These lines allow you to manipulate the Samba password database with the smbpasswd command. The obey pam restrictions parameter ensures that any user changing their password with the smbpasswd command must obey any rules that PAM (Pluggable Authentication Modules, covered in Chapter 7) enforces for normal password changes. For the passdb backend parameter, you can optionally specify a pathname for the TDB file after a colon—for example, tdbsam:/etc/samba/private/passwd.tdb.
If you have access to a Windows domain, you can set security = domain to make Samba use the domain’s authentication system and eliminate the need for a password database. However, in order for domain users to access the machine running Samba, each domain user must have a local account with the same username on that machine.
Adding and Deleting Users
The first thing you need to do to give a Windows user access to your Samba server is to add the user to the password database with the smbpasswd -a command:
# smbpasswd -a username
The username parameter to the smbpasswd command must be a valid username on your Linux system.
Like the regular system’s passwd program, smbpasswd asks you to enter the new SMB user’s password twice. After the password passes any necessary security checks, smbpasswd confirms that it has created the new user.
To remove a user, use the -x option to smbpasswd:
# smbpasswd -x username
To just temporarily deactivate the user, use the -d option; the -e option can be used later to reenable the user:
# smbpasswd -d username
# smbpasswd -e username
Changing Passwords
You can change a Samba password as the superuser by using smbpasswd with no options or keywords other than the username:
# smbpasswd username
However, if the Samba server is running, any user can change their own Samba password by entering smbpasswd by itself on the command line.
Finally, here’s one place in your configuration to beware of. If you see a line like this in your smb.conf file, be careful:
unix password sync = yes
This line causes smbpasswd to change a user’s normal password in addition to the Samba password. The result can be very confusing, especially when a user changes their Samba password to something that’s not their Linux password and discovers that they can no longer log in to their Linux system. Some distributions set this parameter by default in their Samba server packages!
12.4.4 Manual Server Startup
Typically, you shouldn’t need to worry about starting the server if you installed Samba from a distribution package. Check the list from systemctl --type=service to verify. However, if you installed it from source code, run nmbd and smbd with the following arguments, where smb_config_file is the full path of your smb.conf file:
# nmbd -D -s smb_config_file
# smbd -D -s smb_config_file
The nmbd daemon is a NetBIOS name server, and smbd does the actual work of handling share requests. The -D option specifies daemon mode. If you alter the smb.conf file while smbd is running, you can notify the daemon p. 328 of the changes with a HUP signal, though it’s almost always for the better if you let systemd supervise the server, in which case you can get systemctl to do the work for you.
12.4.5 Diagnostics and Logfiles
If something goes wrong when a Samba server starts up, an error message appears on the command line. However, runtime diagnostic messages go to the log.nmbd and log.smbd logfiles, which are usually in a /var/log directory, such as /var/log/samba. You’ll also find other logfiles there, such as individual logs for each individual client.
12.4.6 File Share Configuration
To export a directory to SMB clients (that is, to share a directory with a client), add a section like this to your smb.conf file, where label is what you would like to call the share (such as mydocuments) and path is the full directory path:
[label]
path = path
comment = share description
guest ok = no
writable = yes
printable = no
These parameters are useful in directory shares:
guest ok A yes setting here allows guest access to the share. The public parameter is a synonym.
writable A yes or true setting here marks the share as read-write. Do not allow guest access to a read-write share.
printable Obviously, on a directory share, this parameter must be set to no or false.
veto files This parameter prevents the export of any files that match the given patterns. You must enclose each pattern between forward slashes (so that it looks like /pattern/). This example bars object files, as well as any file or directory named bin:
veto files = /*.o/bin/
12.4.7 Home Directories
You can add a section called [homes] to your smb.conf file if you want to export home directories to users. The section should look like this:
[homes]
comment = home directories
browseable = no
writable = yes
By default, Samba reads the logged-in user’s /etc/passwd entry to determine their home directory for [homes]. However, if you don’t want Samba to follow this behavior (that is, you want to keep the Windows home directories in a different place than the regular Linux home directories), you can use the %S substitution in a path parameter. For example, here’s how you would switch a user’s [homes] directory to /u/user:
path = /u/%S
Samba substitutes the current username for the %S.
12.4.8 Printer Sharing
You can export your printers to Windows clients by adding a [printers] section to your smb.conf file. Here’s how the section looks when you’re using CUPS, the standard Unix printing system:
[printers]
comment = Printers
browseable = yes
printing = CUPS
path = cups
printable = yes
writable = no
To use the printing = CUPS parameter, your Samba installation must be configured and linked against the CUPS library.
Depending on your configuration, you may also want to allow guest access to your printers with the guest ok = yes option rather than give a Samba password or account to everyone who needs to access the printers. For example, it’s easy to limit printer access to a single subnet with firewall rules.
12.4.9 The Samba Client
The Samba client program smbclient can print to and access remote Windows shares. This program comes in handy when you’re in an environment where you must interact with Windows servers that don’t offer a Unix-friendly means of communication.
To get started with smbclient, use the -L option to get a list of shares from a remote server named SERVER:
$ smbclient -L -U username SERVER
You don’t need -U username if your Linux username is the same as your username on SERVER.
After you run this command, smbclient asks for a password. To try to access a share as a guest, press ENTER; otherwise, enter your password on SERVER. Upon success, you should get a share list like this:
Sharename Type Comment
--------- ---- -------
Software Disk Software distribution
Scratch Disk Scratch space
IPC$ IPC IPC Service
ADMIN$ IPC IPC Service
Printer1 Printer Printer in room 231A
Printer2 Printer Printer in basement
Use the Type field to help you make sense of each share, and pay attention only to the Disk and Printer shares (the IPC shares are for remote management). This list has two disk shares and two printer shares. Use the name in the Sharename column to access each share.
Accessing Files as a Client
If you need only casual access to files in a disk share, use the following command (again, you can omit the -U username if your Linux username matches your username on the server):
$ smbclient -U username '\\SERVER\sharename'
Upon success, you will get a prompt like this, indicating that you can now transfer files:
smb: \>
In this file transfer mode, smbclient is similar to the Unix ftp, and you can run these commands:
get file Copies file from the remote server to the current local directory.
put file Copies file from the local machine to the remote server.
cd dir Changes the directory on the remote server to dir.
lcd localdir Changes the current local directory to localdir.
pwd Prints the current directory on the remote server, including the server and share names.
!command Runs command on the local host. Two particularly handy commands are !pwd and !ls to determine directory and file status on the local side.
help Shows a full list of commands.
Using the CIFS Filesystem
If you’d like to have more convenient access to files on a Windows server, you can attach a share directly to your system with mount. The command syntax is as follows (notice the use of SERVER:sharename rather than the normal \\SERVER\sharename format):
# mount -t cifs SERVER:sharename mountpoint -o user=username,pass=password
In order to use mount like this, you must have the Common Internet File System (CIFS) utilities installed on your system. Most distributions offer these as a separate package.