Learn NAS - SMB/CIFS Sharing Deep Dive

#Introduction

SMB/CIFS is the most widely used file sharing protocol in the world, largely thanks to native Windows support. Episode 9 dissects this protocol in depth: how Samba configures an SMB server, how to choose the protocol version, and how to optimize performance and integration with the Windows ecosystem.

After episode 8, you can already mount an SMB share. Now you'll understand what happens behind the scenes and how to adapt it to real workloads — from read-heavy media servers to collaboration folders with strict locking.

By the end of this episode you'll be able to read and modify smb.conf, choose a safe protocol version, enable printer shares, tune oplocks, and apply Windows-style permissions.

#Samba and the Structure of smb.conf

#The Role of Samba

Samba is the open-source implementation of the SMB/CIFS protocol and its supporting protocols. On TrueNAS SCALE and OpenMediaVault, Samba is the engine behind every SMB share. Its main configuration lives in smb.conf.

testparm -v

The testparm command validates smb.conf and shows all active parameters along with their defaults. It's the first tool to reach for when you suspect a misconfiguration.

#The Basic Structure of the Configuration File

smb.conf consists of a global section and per-share sections. The global section governs the behavior of the whole server, while each per-share section governs one specific directory.

[global]
   workgroup = WORKGROUP
   server min protocol = SMB2_10
   server max protocol = SMB3_11
 
[data]
   path = /tank/data
   valid users = @data-teams
   read only = no

Running testparm against this file ensures the syntax is correct. The section names in square brackets are the share names shown on the client.

#SMB Protocol Versions

#Why Versions Matter

Every SMB version brings security and performance improvements. SMBv1 is ancient and vulnerable to many well-known attacks; modern Samba disables it by default. Locking the version range with server min protocol and server max protocol is a basic security practice.

server min protocol = SMB2_10
server max protocol = SMB3_11

The SMB2_10 to SMB3_11 range allows safe versions while staying compatible with modern Windows, macOS, and Linux. Configurations like min protocol = SMB1 are only kept for legacy devices that should really be replaced.

#Checking the Version in Use

To see the protocol versions of active sessions, use the Samba status:

smbstatus

The smbstatus output shows connected clients and each session's protocol version. It's a quick way to make sure no client has fallen back to an old protocol.

#Browsing and Printer Shares

#Network Browsing

Browsing lets clients discover shares without typing a full address. Samba supports this through the server list in the Windows network neighborhood. The server string parameter and browse settings give the NAS an identity on the network.

server string = NAS Lab Belajar NAS

If browsing misbehaves, direct access by IP address remains the most reliable. Don't rely too much on browsing, because it depends on discovery protocols that differ between operating systems.

#Printer Shares

Samba can also share printers to the network. Each printer is registered as a share with the print type. This configuration is common in small offices without a separate print server.

[printer-kantor]
   path = /var/spool/samba
   printable = yes
   printer name = lexmark-kantor

Printer shares are used by Windows clients after the printer driver is installed on the client side. For modern homelabs, printer sharing via Samba is increasingly rare because many printers have their own network connection.

#Tuning Oplocks and Async

#Oplocks and Client Caching

Oplocks (opportunistic locks) allow clients to cache files and read optimistically without round-tripping to the server. This dramatically speeds up access for read-dominated workloads like media and documentation. However, for files that are frequently accessed together, overly loose oplocks can cause data conflicts.

kernel oplocks = yes
oplocks = yes

The oplocks = yes parameter enables opportunistic locking. The defaults are good for most cases; lower them only if you have an application that conflicts with client caching.

#Async for Writes

Async operations let the server complete writes without waiting for full disk synchronization, boosting throughput for workloads tolerant of brief delays. For data requiring strict durability, combine this with an appropriate write cache policy.

aio read size = 1
aio write size = 1

The aio write size parameter enables asynchronous I/O for files that are large enough. The size is in bytes; a value of 1 practically enables it for all files.

#Windows Integration

#Windows-Style Permissions

SMB ACLs allow permissions to be managed with the Windows model instead of just POSIX. On TrueNAS SCALE, a dataset with the NFSv4 acltype can expose SMB permissions recognized by Windows Explorer. This matters so that permissions set from the Windows side work consistently.

zfs get acltype tank/data

The zfs get acltype output shows the dataset's ACL type. Make sure its value matches your SMB integration needs in a Windows environment.

#DFS for a Centralized Hierarchy

DFS (Distributed File System) arranges shares under a single centralized namespace, for example \\nas\kantor\data, which can point to any physical location. In Windows environments with many servers, DFS eases migration and failover.

host msdfs = yes

The host msdfs = yes parameter enables DFS support on Samba. DFS link configuration is done from the Windows client side or administration tooling.

#Closing

In this episode 9 you dissected SMB/CIFS: understanding the smb.conf structure, locking protocol versions with server min and max, configuring browsing and printer shares, tuning oplocks and async, and integrating Windows-style permissions and DFS.

Key takeaways:

• Samba is the SMB engine; testparm validates its configuration.
• Lock the protocol between SMB2_10 and SMB3_11 for security.
• Oplocks speed up reads; async speeds up large writes.
• SMB ACLs enable Windows-style permissions on top of datasets.
• DFS unifies the namespace for large-scale Windows environments.

In the next episode, episode 10, we'll cover NFS sharing — from the /etc/exports format, the differences between NFSv3 and v4, Kerberos authentication with sec=krb5, to nconnect for throughput and using it as shared storage for virtualization and containers. SMB is mature; now it's the turn of Unix administrators' favorite protocol.