Samba File Sharing on Linux

2020-03-12 · linux, samba, smb, centos

The request comes up regularly: "we need a share the Windows machines can see" for backup dumps, exported reports, or a drop folder for SQL Server .bak files that need to get onto a Linux box. Samba makes a Linux directory look like a Windows file share, and for a workgroup setup without Active Directory it is a short configuration. The parts that eat time on CentOS are the firewall and SELinux, so I cover both, with Ubuntu 18.04 notes where paths differ. Windows clients need to reach 445/tcp (and 139/tcp for old ones), and the people connecting need local Linux accounts, because Samba keeps its own password database but maps to system users.

Install Samba

CentOS:

sudo yum install samba samba-client samba-common

Ubuntu:

sudo apt install samba

The version on CentOS 7 is 4.10 in current updates; CentOS 8 and Ubuntu 18.04 carry 4.x as well. All of them speak SMB2/SMB3, which is what current Windows expects; SMB1 is off by default on Windows 10 and should stay off.

Directory and users

sudo mkdir -p /srv/samba/backups
sudo groupadd smbusers
sudo useradd -M -s /sbin/nologin -G smbusers backupuser
sudo smbpasswd -a backupuser
sudo chown root:smbusers /srv/samba/backups
sudo chmod 2770 /srv/samba/backups

-s /sbin/nologin (/usr/sbin/nologin on Ubuntu) means the account can use Samba but not SSH. smbpasswd -a sets the Samba password, which is stored separately from the Linux one in /var/lib/samba/private/passdb.tdb. The 2770 mode sets the setgid bit so files created in the share belong to smbusers.

smb.conf

I move the shipped file aside and start with a short one. The original is mostly commented examples, and I can't see what's actually active:

sudo mv /etc/samba/smb.conf /etc/samba/smb.conf.orig
sudo vi /etc/samba/smb.conf

[global]
    workgroup = WORKGROUP
    server string = db01 file server
    server min protocol = SMB2
    security = user
    map to guest = never
    log file = /var/log/samba/log.%m
    max log size = 1000
    passdb backend = tdbsam
    hosts allow = 10.0.1. 127.

[backups]
    path = /srv/samba/backups
    comment = Database backup drop
    browseable = yes
    writable = yes
    valid users = @smbusers
    create mask = 0660
    directory mask = 2770
    force group = smbusers

server min protocol = SMB2 refuses SMB1 clients. hosts allow limits connections at the Samba level in addition to the firewall. valid users = @smbusers allows any member of the group; force group keeps ownership consistent regardless of who wrote the file.

Check the syntax:

testparm

It prints the effective configuration and warns about unknown parameters. Then start the services:

sudo systemctl enable --now smb nmb      # CentOS
sudo systemctl enable --now smbd nmbd    # Ubuntu

nmb provides NetBIOS name browsing; if clients will connect by IP or DNS name, you can leave it disabled.

Firewall

CentOS:

sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload

Ubuntu:

sudo ufw allow from 10.0.1.0/24 to any app Samba

SELinux on CentOS

This is the one that produces Access denied on Windows while everything else looks correct. Samba may only serve directories labelled samba_share_t:

sudo semanage fcontext -a -t samba_share_t "/srv/samba(/.*)?"
sudo restorecon -Rv /srv/samba
ls -ldZ /srv/samba/backups

semanage comes from policycoreutils-python (CentOS 7) or policycoreutils-python-utils (CentOS 8). If you would rather share an existing directory such as a home directory or /var/lib/mysql-dumps without relabelling, use the boolean instead:

sudo setsebool -P samba_export_all_rw on

That is broader than a label, so I prefer the fcontext approach for a dedicated share.

Testing

From the server itself:

smbclient -L localhost -U backupuser
smbclient //localhost/backups -U backupuser -c 'put /etc/hostname test.txt; ls'

You should see the backups share listed and the file uploaded. From Windows, open \\10.0.1.20\backups in Explorer, authenticate as backupuser, and create a file. Back on Linux, ls -la /srv/samba/backups should show it owned by backupuser:smbusers with mode -rw-rw----. The connection log is under /var/log/samba/log.<clientname>.

When Windows says no

Windows says You do not have permission to access \\server\backups although smbclient works locally: SELinux. sudo ausearch -m avc -ts recent | grep smbd confirms it; apply the SELinux label above.
NT_STATUS_LOGON_FAILURE from smbclient: the Samba password was never set (smbpasswd -a), or the account is disabled (pdbedit -L -v backupuser shows the flags). Note that changing the Linux password does not change the Samba one.
NT_STATUS_CONNECTION_REFUSED or a timeout from Windows but not from the server: firewall. sudo ss -tlnp | grep 445 confirms Samba is listening; then check firewall-cmd --list-services.
Windows 10 connects but asks for credentials repeatedly: the client is trying the cached Windows login. Use server\backupuser or \backupuser in the username field to force a local Samba account.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE from an old scanner or NAS: the client only speaks SMB1. Either update the client or, reluctantly, set server min protocol = NT1 for that share's server.

Samba can do a lot more, but a workgroup share covers most of what I get asked for. On CentOS, remember the SELinux label is part of the config too.