Learn Samba - Installation & Basic Configuration

#Introduction

Now that you understand the architecture from episode 2, it's time for real action: installing Samba and making it run. In episode 3 we install the samba package, enable the smbd and nmbd daemons, write a secure basic smb.conf, and — what's often forgotten — validate the configuration with testparm before the daemons read your edits. The "edit → testparm → reload" habit is a discipline that will save you throughout this series.

#Installing the Samba Packages

#Ubuntu/Debian

sudo apt update
sudo apt install -y samba smbclient

The samba package brings smbd, nmbd, and the core tools; you'll use smbclient to test shares. Verify the version:

smbd --version

For this series the target is Samba 4.24.x — e.g. Version 4.24.5. If your distribution provides an older version, the concepts remain the same (episode 17 covers version differences).

#RHEL/Rocky/Alma

sudo dnf install -y samba samba-client

The service names are the same (smb and nmb are aliases for smbd/nmbd). Don't forget to prepare the firewall — we handle it fully in episode 13.

#Enabling the Services

#smbd and nmbd

sudo systemctl enable --now smbd nmbd
sudo systemctl status smbd --no-pager

systemctl status smbd should show active (running). Also check that the daemons are listening on the right ports:

sudo ss -tlnp | grep -E "(139|445)"

445/tcp (modern SMB) and 139/tcp (NetBIOS) should appear. There are two ports because smbd listens on both; we discuss the security implications in episode 13.

#Basic smb.conf Configuration

#Writing [global]

All the "server personality" settings live in the [global] section. Here's a reasonable starting point:

[global]
   workgroup = WORKGROUP
   server string = %h server (Samba %v)
   security = user
   map to guest = never
   server min protocol = SMB2_10
   logging = file
   log file = /var/log/samba/log.%m
   max log size = 1024

Key differentiators in this section:

• workgroup = WORKGROUP: the default workgroup/NetBIOS name — out-of-domain clients will join here.
• server string = %h server (Samba %v): the description shown to clients when browsing; %v is replaced with the Samba version.
• security = user: every connection must be authenticated with a local Samba username/password — the most common mode for a standalone file server.
• map to guest = never: never downgrade anonymous access to guest — a safe default choice.
• server min protocol = SMB2_10: reject SMB1 from the start (consistent with the 4.11+ default).
• The logging/log file/max log size block: per-client-machine logs (%m) to /var/log/samba/ with automatic rotation — important for episode 14 (audit).

#Writing the First [share]

Every folder you want to share is a new section. Here's a minimal, correct example:

[public]
   path = /srv/public
   browseable = yes
   read only = no
   valid users = arman
   comment = Berbagi file tim

Note the pattern: path points to the directory, browseable controls visibility in the share list, read only/writable determines write access, and valid users restricts who can enter. The interaction between these options and filesystem permissions is fully dissected in episode 4.

#Validating with testparm

#Never Reload Without Validation

After editing smb.conf, run testparm — it reads the file, reports syntax errors, and prints the effective configuration:

testparm

The final output contains the complete configuration as Samba will use it. If any line is unrecognized, testparm shows an Unknown parameter warning — fix it before continuing. Also compare against the expanded version to make sure there are no syntax typos:

testparm -s > /tmp/effective.conf && diff /etc/samba/smb.conf /tmp/effective.conf

The diff above shows which parts Samba changed from the defaults — e.g. the daemon adding built-in parameters. It's a quick way to see "is my file valid" without guessing.

#Reloading the Configuration

Once testparm is clean, reload without a full restart:

sudo smbcontrol all reload-config

smbcontrol all reload-config tells all daemons to re-read the file — much gentler than systemctl restart, because active client connections are not dropped.

#Verifying Active Shares

Check that the share is actually published:

smbclient -L localhost -U arman

You'll see public in the share list along with the server string description. If map to guest = never is active and the user isn't registered in Samba yet, authentication will be rejected — that's the signal to move on to episode 5 (user management). For now, just make sure the share appears in the list.

#Closing

Key takeaways:

• Install with apt install samba (Debian/Ubuntu) or dnf install samba (RHEL family); target version 4.24.x.
• Enable smbd and nmbd via systemd; make sure ports 139/445 are open.
• [global] sets the server identity: workgroup, server string, security = user.
• Each per-share section has path, browseable, read only/writable, and valid users.
• Always validate with testparm, then reload via smbcontrol all reload-config.

In episode 4 next, we'll go deeper into basic shares & permissions: building a [data] share with path=/srv/data, force user/force group, then mapping the interaction between filesystem permissions and share options (valid users, write list). This is where most of the "why can't I write?" mysteries get answered.