Setting up a Samba Share on Debian 12 for Cross-Platform Access

This guide explains how to set up a network share on a Debian 12 server using Samba. This allows computers running Windows, macOS, or other Linux distributions to access a common folder on the server.

First, update your package list and install the necessary Samba packages. Open a terminal on your Debian 12 server and run:

sudo apt update
sudo apt install samba samba-common-bin

Decide on a location for your shared folder. A common place for service data is the /srv directory.

Create the folder (e.g., myshare):

sudo mkdir -p /srv/myshare

Set appropriate permissions. For a share where multiple users might read and write, you can create a dedicated group (e.g., sambashare) and assign ownership and permissions.

Optional: Create a group for Samba users

sudo addgroup sambashare

Change group ownership and permissions for the shared folder:

sudo chgrp sambashare /srv/myshare
sudo chmod -R 775 /srv/myshare  // Allows read/write for owner & group, read for others

Note: Using chmod -R 777 would make the folder world-writable, which is less secure and generally not recommended for sensitive data. It's better to manage access through Samba users and specific file permissions.

The main Samba configuration file is located at /etc/samba/smb.conf.

Before making any changes, it's wise to back up the original configuration:

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup

Open smb.conf using a text editor like nano or vim:

sudo nano /etc/samba/smb.conf

Scroll to the end of the file and add a new share definition. Below are two common examples.

This configuration creates a share accessible to anyone on the network without a password. Use with caution, especially on untrusted networks.

[PublicShare]
    comment = Public Shared Folder
    path = /srv/myshare
    browseable = yes
    writable = yes
    guest ok = yes
    read only = no
    create mask = 0664
    directory mask = 0775
    force user = nobody
    force group = nogroup

• [PublicShare]: The name that will appear when clients browse the network.
• comment: A descriptive comment for the share.
• path: The absolute path to the folder on your Debian server.
• browseable = yes: Makes the share visible in network browsers.
• writable = yes / read only = no: Allows users to write to the share.
• guest ok = yes: Allows access without requiring a username and password.
• create mask / directory mask: Default permissions for newly created files and directories within the share.
• force user / force group: Files and directories will be created with the ownership of this specified user and group (nobody and nogroup are often used for guest access).

This is the recommended approach for most situations, as it provides better security.

First, ensure the Linux user(s) who will access the share exist on the Debian server. If not, create them using adduser:

sudo adduser shareuser_example

(Replace shareuser_example with your desired username.)

Next, add this Linux user to Samba's password database. You will be prompted to set a Samba-specific password for this user (it can be different from their Linux system login password).

sudo smbpasswd -a shareuser_example

Now, add the following share definition to your /etc/samba/smb.conf file:

[SecureShare]
    comment = Secure User Share
    path = /srv/myshare  // Or a user-specific path like /home/shareuser_example/shared_data
    browseable = yes
    read only = no
    valid users = shareuser_example @sambashare // Allows specific users or members of a group
    # For multiple users: valid users = user1 user2 @some_other_group
    writable = yes
    create mask = 0660  // Owner and group can read/write
    directory mask = 0770 // Owner and group can read/write/execute

• valid users: Specifies which users (e.g., shareuser_example) or groups (prefixed with @, e.g., @sambashare) are allowed to access this share.
• Ensure that the Linux file permissions on the shared directory (/srv/myshare) allow the specified valid users or group members to read and write. For example:

    sudo chown shareuser_example:sambashare /srv/myshare # Or relevant user/group
    sudo chmod -R 770 /srv/myshare # Give read/write/execute to user and group
 

After saving your changes to smb.conf, use the testparm utility to check for syntax errors:

testparm

If there are no errors, it will display “Loaded services file OK.”

To apply the new configuration, restart the Samba daemons (smbd and nmbd):

sudo systemctl restart smbd
sudo systemctl restart nmbd

To ensure Samba starts automatically on boot:

sudo systemctl enable smbd
sudo systemctl enable nmbd

If you are using ufw (Uncomplicated Firewall) on your Debian server, you need to allow Samba traffic:

sudo ufw allow Samba

Alternatively, you can allow the specific ports:

sudo ufw allow proto tcp from any to any port 139,445
sudo ufw allow proto udp from any to any port 137,138

Then, reload ufw:

sudo ufw reload

You can now connect to your Samba share from various client operating systems. Replace your_server_ip with the actual IP address of your Debian server (e.g., 192.168.1.100) and ShareName with the name you defined in smb.conf (e.g., PublicShare or SecureShare).

1. Open File Explorer.
2. In the address bar, type: \\your_server_ip\SecureShare or \\your_server_hostname
3. You should see your defined share(s). Double-click to open.
4. If connecting to a secure share, you will be prompted for the username and password you set with smbpasswd.
5. To make access easier, you can right-click the share and select “Map network drive…” to assign it a drive letter.

1. Open your file manager (e.g., Nautilus, Dolphin, Thunar).
2. Look for an option like “Connect to Server,” “Network,” or “Browse Network.”
3. Enter the server address in the format: smb://your_server_ip/ShareName
4. If prompted, enter the credentials for your secure share.

1. First, install the CIFS client utilities if not already present:

    sudo apt update
    sudo apt install cifs-utils
 

1. Create a local directory to serve as a mount point:

    sudo mkdir /mnt/myserver_share
 

1. Mount the share:
   1. For a guest/public share:

      sudo mount -t cifs //your_server_ip/PublicShare /mnt/myserver_share -o guest,uid=$(id -u),gid=$(id -g)
 

1. For a secure share:

      sudo mount -t cifs //your_server_ip/SecureShare /mnt/myserver_share -o username=shareuser_example,uid=$(id -u),gid=$(id -g)
 

    (You will be prompted for the Samba password for ''%%shareuser_example%%''. The ''%%uid=$(id -u)%%'' and ''%%gid=$(id -g)%%'' options help map file ownership to your local user.)
- To automatically mount the share at boot, you can add an entry to your ''%%/etc/fstab%%'' file. (This is an advanced topic, refer to ''%%fstab%%'' and ''%%mount.cifs%%'' man pages for details).

1. Open Finder.
2. From the menu bar, click “Go” → “Connect to Server…” (or press Command+K).
3. In the “Server Address” field, type: smb://your_server_ip/ShareName
4. Click “Connect.”
5. If prompted, enter the username and password for your secure share.

While Samba is excellent for cross-platform compatibility, especially with Windows, other options exist:

• NFS (Network File System): Primarily used in Linux/Unix environments. It can be faster than Samba but setting it up for Windows clients is more involved.
• SFTP (SSH File Transfer Protocol): If you have an SSH server running on your Debian machine (which is common), SFTP is already available. Clients like FileZilla (Windows, macOS, Linux), WinSCP (Windows), or Cyberduck (macOS, Windows) can be used. For Linux and macOS, sshfs can mount an SFTP connection as a local filesystem. This doesn't provide network browsing in the same way as Samba but is very secure.

For most users needing to share folders between a Linux server and various client operating systems including Windows, Samba is the recommended solution due to its wide compatibility and ease of use on client machines. Opt for user authentication (Example 2) for better security.

You should add the following line. You can change the path's as you created before.

volumes:
      - /srv/myshare:/usr/src/paperless/consume

User of SMB's UID should be equal to the USERMAP_UID and USERMAP_GID values.

environment:
      USERMAP_UID: '1001' # **VERIFY with 'id -u' on your host and CHANGE if needed**
      USERMAP_GID: '1001' # **VERIFY with 'id -g' on your host and CHANGE if needed**