Install Samba, create a dedicated share, map a Linux account to a Samba password, apply matching filesystem permissions, and restrict SMB traffic to trusted networks. On an Internet-reachable VPS, use authenticated users rather than a guest share, and enforce the policy in both the VPS provider firewall and the server’s own firewall.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are building
Samba makes a Linux directory available through the SMB protocol used by Windows and supported by Linux and macOS file managers. A VPS can host the service on local virtual-disk storage or on a mounted volume, provided that storage is persistent and has suitable permissions. The central configuration file is /etc/samba/smb.conf.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →A working share has three separate layers:
- Samba configuration: the share name, path, read/write behavior, and allowed users.
- Linux identity and permissions: ownership, mode bits, and optional POSIX ACLs on the directory and every parent directory.
- Network policy: provider and host firewalls that allow SMB only from approved client networks.
If any layer denies access, the share will fail even when the other two are correct. Canonical describes Samba as one of the common ways to network Ubuntu and Windows computers, but a public VPS needs a stricter policy than a typical home LAN.
Requirements and design decisions
Before installing packages, decide who will connect and where the files will live.
#1 Best Overall
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
| Decision | Recommended starting point | When to choose another option |
|---|---|---|
| Operating system | Ubuntu or Debian with administrator access through sudo |
Use the distribution’s Samba package and service names if you run another Linux distribution. |
| Storage | A persistent VPS disk with enough free space for the share and backups | Use a separately mounted volume when data must outlive a VPS rebuild or exceed the boot disk. |
| Identity model | Standalone, authenticated Samba users (security = user) |
Use domain or Active Directory integration when an existing identity service must control access. |
| Network path | Private network, VPN, or a narrow client-IP allowlist | Do not make SMB reachable from the entire Internet merely because the VPS has a public address. |
| Permission model | One user for a private share, or a dedicated Linux group for several users | Use POSIX ACLs when different users need different read and write rights. |
Record the VPS address, the client networks that should connect, the Linux usernames that need access, and the directory that should be shared. Keep administrative access through SSH separate from file-sharing credentials.
Step 1: Install Samba
- Refresh package metadata and install Samba:
sudo apt update
sudo apt install sambaThe package supplies the server binaries, service units, and configuration file. Do not replace the distribution package with an unverified build on a production VPS; regular security updates are part of operating the server.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Save a copy of the original configuration before editing:
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backupThat backup gives you a known rollback point if a later edit prevents the daemon from starting.
Step 2: Create a dedicated share directory
Keep shared data outside users’ home directories. Ubuntu documents /srv as the location intended for site-specific data, so create a directory such as:
sudo mkdir -p /srv/samba/privateA dedicated path makes ownership, backups, quotas, and future migration easier to reason about. Do not point a share at /, /etc, a whole home-directory tree, or a directory containing SSH keys.
Choose the owner
For a single-user share, make the intended Linux account the owner. For a team share, create a dedicated group and make the directory group-owned:
sudo groupadd --system sambashare
sudo chown -R alice:sambashare /srv/samba/private
sudo chmod 2770 /srv/samba/privateThe set-group-ID bit in 2770 causes new files and directories to inherit the sambashare group. Replace alice with an account that actually exists. If the group already exists, do not run groupadd again.
Check parent-directory traversal
A user needs execute (x) permission on each parent directory to reach the share. Inspect the path if a correctly authenticated user still receives “access denied”:
namei -l /srv/samba/privateStep 3: Create Linux identities
Standalone Samba’s default security model is security = user: a client authenticates with a username and password. A Samba username must already exist as a Linux system account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create a non-administrative account when one is needed:
Rank #2
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
sudo adduser aliceFor a team share, add existing accounts to the dedicated group:
sudo usermod -aG sambashare alice
sudo usermod -aG sambashare bobGroup membership is evaluated when a session starts. Have affected users disconnect and reconnect after membership changes. Do not put ordinary file-sharing users in the sudo group simply to make permissions work.
Step 4: Define the share in smb.conf
Open the configuration file:
sudo nano /etc/samba/smb.confRetain global settings required by your distribution, then add or adapt a global section and a share section. This is a minimal authenticated example:
[global]
workgroup = WORKGROUP
security = user
[private]
path = /srv/samba/private
browsable = yes
read only = no
valid users = alice[private] is the network share name; it is not required to match the directory name. path is the server-side directory. browsable = yes permits clients that browse available shares to see it, while read only = no permits writes subject to Linux permissions. valid users limits authentication for this share to the named account.
Set creation permissions deliberately
For a single-user share, the default creation behavior may be sufficient if the directory’s mode bits are correct. A team share often needs explicit masks so new files remain group-accessible:
force group = sambashare
create mask = 0660
force create mode = 0660
directory mask = 2770
force directory mode = 2770Add these lines inside the [private] section only when the group-based design is intended. The masks do not grant access that the underlying filesystem denies; they constrain the permissions Samba requests when creating objects.
Use a group instead of a long user list
For several users, replace the individual list with a group:
Recommended Free Tools
valid users = @sambashareThe group must exist in Linux, and each member must have both a Linux account and a Samba password. Keep share definitions separate when two groups need different directories or write policies.
Why not enable guest access?
A guest configuration can allow any client on the local network to open a share. Canonical’s basic guest example warns about that broad access. On a public VPS, guest access removes the identity check that protects the data and is unsuitable unless an isolated private network and an explicit, understood use case justify it. Do not combine a guest share with an Internet-facing address.
Step 5: Align Linux permissions and optional ACLs
Samba directives cannot override Linux filesystem permissions. Confirm the owner, group, and mode on the share:
ls -ld /srv/samba/private
getfacl /srv/samba/privateFor a private single-user directory, an owner-only or owner-and-group mode is usually preferable to world access. For a team directory, grant access through sambashare and keep “other” permissions closed. Avoid chmod -R 777; it turns a Samba mistake into unrestricted local filesystem access.
Rank #3
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Use POSIX ACLs when mode bits cannot express the policy. For example, to grant Bob access without changing the owner:
sudo setfacl -m u:bob:rwx /srv/samba/private
sudo setfacl -m d:u:bob:rwx /srv/samba/privateThe first rule affects the directory now; the default ACL affects newly created children. Review ACLs with getfacl, and document them so a later ownership change does not silently remove access.
Step 6: Add Samba credentials
Register each Linux account with Samba and choose a password used by SMB clients:
sudo smbpasswd -a aliceRepeat for every permitted user. The command fails or produces an unusable login if the Linux account does not exist. A Samba password is separate from the Linux login password, so changing one does not automatically change the other.
Disable a credential without deleting the Linux account when necessary:
sudo smbpasswd -d aliceRemove it entirely only when you understand the effect on existing sessions and any other shares:
sudo smbpasswd -x aliceStep 7: Restrict the network at both firewall layers
A VPS commonly has a provider-level firewall or security group in addition to its operating-system firewall. Apply the same least-privilege rule in both places: allow SMB only from trusted client addresses or a private network. A broad host rule such as sudo ufw allow samba is useful as a basic Ubuntu example, but it should not be the final policy for a public VPS.
Host firewall with UFW
Allow the service from a specific subnet, replacing the example network with your VPN or office range:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo ufw allow from 203.0.113.0/24 to any app SambaIf the application profile is unavailable, create narrowly scoped rules for the SMB ports your deployment uses rather than allowing them from everywhere. Keep SSH access available from its own restricted source before enabling UFW, or you can lock yourself out.
Provider firewall
In the VPS control panel, create inbound rules limited to the same trusted source ranges. Do not add an “allow all” rule for the server’s public address. If all clients connect through a VPN, allow only the VPN address range and leave public SMB blocked.
Legacy discovery traffic
Modern Windows clients normally connect directly to SMB without relying on NetBIOS browsing. If you intentionally support legacy discovery, it may require additional NetBIOS ports and daemon settings; open them only for the same private ranges. Do not expose legacy discovery services to the Internet.
Rank #4
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Step 8: Validate and apply the configuration
Check the file with the Samba validation utility installed by the package before restarting services:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo testparmRead every warning and correct misspelled parameters, invalid paths, and unknown users. A syntactically valid file can still point to a missing directory or a user who lacks Linux permissions, so perform those checks separately.
Apply changes by restarting both services:
sudo systemctl restart smbd.service nmbd.serviceOn systems where a reload is sufficient, reload configuration to avoid interrupting active sessions:
sudo systemctl reload smbd.serviceVerify service state and recent errors:
sudo systemctl status smbd.service nmbd.service
sudo journalctl -u smbd.service -u nmbd.service --since '10 minutes ago'Service names can vary slightly by distribution, but the Ubuntu/Debian units above are the usual ones installed by the package.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Step 9: Connect from client computers
Windows
In File Explorer’s address bar, enter the UNC path:
\server-ipprivateReplace server-ip with the VPS address or a private DNS name. When prompted, enter the Samba username and password. If Windows cached an incorrect credential, remove the saved entry in Credential Manager, disconnect the old mapping, and reconnect with the intended account.
To assign a drive letter, use “This PC” → “Map network drive,” choose a letter, enter the same UNC path, and select the option to connect with different credentials when the Windows login does not match the Samba account.
Ubuntu or another Linux desktop
In the file manager, choose “Other Locations” or the equivalent network-location command and enter an SMB address such as smb://server-ip/private. Authenticate with the Samba credentials, not necessarily the desktop login password.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →macOS
In Finder, choose “Go” → “Connect to Server,” enter smb://server-ip/private, and sign in with the Samba username and password. Save the connection only on trusted computers.
Command-line test
From a Linux client with Samba client tools installed, list the share and authenticate explicitly:
smbclient //server-ip/private -U aliceA successful session should let you list files and upload a harmless test file. Delete that file after confirming the result.
Best Value
- One Place for All Your Data - Consolidate scattered files from multiple computers, phones and external drives into one accessible hub with 100% ownership
- Professional File Collaboration - Share projects with clients, sync documents across teams and maintain version control without Dropbox fees
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- DIY Surveillance System - Transform IP cameras into a professional monitoring solution with motion alerts, recording schedules and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Step 10: Test the complete permission path
Test as every permission class you created, not only as the administrator:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Connect with an allowed user and verify listing, reading, creating, renaming, and deleting files according to the intended policy.
- Connect with a Linux account that has no Samba credential; it should fail authentication.
- Connect with a valid Samba user who is not in
valid users; the share should reject access. - Test a user who is authenticated but lacks Linux directory permission; access should still be denied.
- From an untrusted network, verify that the firewall blocks the connection rather than merely hiding the share from browsing.
These tests distinguish an identity problem from a filesystem or network problem and create a baseline for later changes.
Authenticated, group-based, and domain deployments compared
| Implementation | Strength | Cost or limitation | Best fit |
|---|---|---|---|
| Standalone, named Samba users | Simple, explicit credentials and a small attack surface | Passwords and membership are managed on the VPS | One person, a household, or a small project |
| Group-based standalone share | Central Linux group controls several users and inherited file permissions | Requires careful group membership, masks, and ACL review | Teams sharing one directory with a common policy |
| Guest share | Easy access without per-user credentials | No reliable identity boundary; unsafe for an Internet-facing VPS | Only an isolated, trusted private network with a deliberate risk decision |
| Domain or Active Directory integration | Central identity, policy, and account lifecycle | More services, configuration, and operational dependencies | Organizations that already operate a domain |
The Samba configuration manual distinguishes standalone user security from domain-oriented modes. Choose domain integration because your organization needs centralized identity, not merely to avoid creating a few local accounts.
Storage choices and reliability
Local VPS storage is straightforward and usually has the fewest moving parts. A separately mounted block volume can simplify expansion and recovery, but the mount must be present before Samba starts and its ownership and ACLs must survive reattachment. Object storage is not a drop-in replacement for a POSIX filesystem: use a filesystem-compatible mount only after checking its locking, rename, metadata, and durability behavior for SMB workloads.
Back up the files and the configuration independently. Include /etc/samba/smb.conf, the account and group policy documentation, ACL information, and a record of which firewall ranges are trusted. Test restoring a representative directory to a temporary location; a backup that cannot preserve ownership and permissions may restore data that users still cannot open.
Hardening checklist for a public VPS
- Use named Samba users and disable credentials that no longer need access.
- Keep the share directory separate from system files and SSH material.
- Grant only the read/write rights each user or group requires; avoid world-writable modes.
- Limit both provider and host firewall rules to private networks, VPN ranges, or explicit client addresses.
- Keep the operating system and Samba package updated through the normal security-update process.
- Use a private network or VPN whenever clients can reach one; public addressing should be a last resort.
- Monitor authentication and service logs for unexpected failures or repeated attempts.
- Maintain tested backups before changing storage, ACLs, or account membership.
- Do not assume that hiding a share by setting
browsable = nois an access control; authentication, filesystem permissions, and firewalls provide the boundary.
Troubleshooting by symptom
The service will not start
Run sudo testparm, then inspect sudo journalctl -u smbd.service. Correct an invalid parameter, a malformed section, or a path that does not exist. Restore the saved configuration only as a temporary rollback, then reapply changes one at a time.
The client cannot reach the server
Check the VPS provider firewall first, then UFW or another host firewall, and finally whether the client is using the correct public or private address. A timeout usually indicates routing or filtering; an immediate authentication prompt indicates that the service is reachable.
Authentication fails even though the Linux password works
Confirm that the username exists as a Linux account and was added with sudo smbpasswd -a username. Check capitalization, remove stale client credentials, and ensure the account was not disabled with smbpasswd -d.
The share appears but opening it gives “access denied”
Check the account against valid users, then inspect owner, group, mode bits, ACLs, and parent-directory traversal with namei -l. Samba approval does not bypass a Linux denial.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Users can create files but colleagues cannot edit them
Review group membership, inherited set-group-ID behavior, creation and directory masks, and default ACLs. Existing files may need their group or ACL corrected separately from the share definition.
Windows keeps using the wrong account
Disconnect the mapped share, remove the saved credential in Windows Credential Manager, and reconnect using the exact Samba username. A persistent cached session can make a correct server configuration appear broken.
Files disappear after a VPS reboot
Verify that the intended data volume is mounted at the same path before smbd starts. A missing mount can leave Samba pointing at an empty directory on the boot disk; stop the service, mount the correct volume, and confirm ownership before reconnecting clients.
When this design is the right fit
A standalone Samba share is appropriate when a small number of known users need familiar SMB access and you can place the VPS behind a private network or a strict allowlist. It is less suitable when many employees need centralized identity, when clients cannot be trusted, or when the storage backend does not provide reliable POSIX semantics. In those cases, use a domain-integrated design or a file service built for the chosen storage and network model rather than weakening Samba’s access controls.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
