Samba (SMB/CIFS) File Server Turnkey Configuration

We set up Samba servers turnkey for reliable and secure file sharing between Linux and Windows. Our experience: over 50 projects, from small office NAS to high‑load clusters with replication. We guarantee 99.9% availability and full integration with your existing infrastructure — Active Directory, LDAP, monitoring systems.

Typical situation: a company migrates from Windows Server to Linux but needs to keep familiar UNC paths and access rights. Or you need a budget file storage solution without losing functionality. Samba with correctly tuned ACLs and optimized SMB2/3 parameters solves these tasks.

How to Integrate Samba with Active Directory?

For corporate use, AD integration is mandatory. We configure Samba as a domain member using net ads join. During configuration, we enable winbind to map AD users and groups to Linux identifiers. This allows using a single account for file access.

# Install Samba with AD support
apt install samba smbclient winbind

# Configure /etc/samba/smb.conf
[global]
workgroup = DOMAIN
security = ads
realm = DOMAIN.LOCAL
# ... other parameters

# Join domain
net ads join -U administrator

# Start winbind
systemctl enable --now winbind

After that, AD users can connect to shares without creating local accounts. Permissions are assigned via AD groups — Samba automatically applies them to ACLs.

Why Does Samba Slow Down and How to Fix It?

Slow Samba is often caused by incorrect network buffer alignment or using SMB1. First, disable SMB1 and enable SMB3. Optimize socket options:

[global] socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072 

Also check disk subsystem performance: use SSD for metadata and configure write cache. For WAN connections, increase server max protocol = SMB3 and enable server signing = mandatory. Our engineers perform load testing with smbclient and dd to find bottlenecks.

Basic Samba Configuration

We start with package installation and a minimal configuration file:

apt install samba samba-common-bin 

The /etc/samba/smb.conf file consists of a global section and share sections:

[global]
    workgroup = MYGROUP
    server string = File Server
    netbios name = FILESERVER
    server role = standalone server
    log file = /var/log/samba/log.%m
    max log size = 1000
    map to guest = bad user
    usershare allow guests = no
    min protocol = SMB2
    max protocol = SMB3

[data]
    path = /srv/samba/data
    valid users = @sambagroup
    browseable = yes
    writable = yes
    create mask = 0664
    directory mask = 0775
    force group = sambagroup

[public]
    path = /srv/samba/public
    browseable = yes
    guest ok = yes
    writable = no
    read only = yes

The parameter map to guest = bad user automatically redirects unknown users to guest access; otherwise, Windows clients will get an authentication error when trying to connect to a public share.

Users and Groups

Samba stores passwords in its own database, separate from system accounts:

# Create system user and group
useradd -M -s /sbin/nologin jsmith
groupadd sambagroup
usermod -aG sambagroup jsmith

# Add to Samba database
smbpasswd -a jsmith
smbpasswd -e jsmith

# Check
pdbedit -L -v jsmith

For large organizations, we recommend the LDAP backend (passdb backend = ldapsam), which simplifies centralized management.

Permissions: Linux ACL + Samba

The correct permission scheme combines group ACLs and inherited rights:

# Group sambagroup can read and write
setfacl -R -m g:sambagroup:rwX /srv/samba/data
setfacl -R -d -m g:sambagroup:rwX /srv/samba/data
# Others – read only
setfacl -R -m o::r-X /srv/samba/data

Parameters create mask and directory mask in smb.conf limit maximum permissions for new files created via Samba.

Work Stages

1. Audit of current infrastructure (network, domain, disk capacity).
2. Design of share structure and permission scheme.
3. Installation and configuration of Samba, performance optimization.
4. Creation of users/groups, integration with AD/LDAP.
5. Configuration of filesystem ACLs.
6. Firewall and discovery (wsdd) setup.
7. Monitoring integration (Prometheus + Grafana + samba_exporter).
8. Testing with Windows and Linux clients, stress test.
9. Delivery of documentation and administrator training.

What Is Included in Turnkey Setup

• Deployment of Samba standalone or in a domain.
• Configuration of ACLs with permission inheritance.
• Integration with AD/LDAP via winbind.
• Performance optimization (buffers, cache, SMB3).
• Monitoring: samba_exporter for Prometheus, alerts in Grafana.
• Backup of configuration and data (rsync + snapshot).
• Administration and disaster recovery documentation.
• 30 days of support after commissioning.

Protocol Comparison: SMB vs NFS vs FTP

Monitoring and Diagnostics

Check syntax, status, and logs via command‑line tools:

# Syntax check
testparm
# List active connections
smbstatus
# Test connection
smbclient //fileserver/data -U jsmith
# Logs
journalctl -u smbd
tail -f /var/log/samba/log.smbd

For network filtering, open ports and install wsdd for discovery in Windows:

# Allow SMB and WS-Discovery traffic
ufw allow from 192.168.1.0/24 to any port 445,139 proto tcp
ufw allow from 192.168.1.0/24 to any port 137:138 proto udp
# Install and start wsdd
apt install wsdd
systemctl enable --now wsdd

Common issues: NT_STATUS_ACCESS_DENIED when writing — check both Samba ACLs and filesystem permissions. NT_STATUS_CONNECTION_REFUSED — check if smbd is running and ports are open.

Timeline and Cost

A standard file server is configured in 1‑2 days. For AD/LDAP integration or complex ACL schemes, up to 5 days. Cost is calculated individually after audit. Savings compared to Windows Server can reach 50% without losing functionality.

Order a turnkey Samba configuration — get a consultation from an engineer with 5+ years of experience. We guarantee reliability and performance for your file storage. Contact us for an assessment of your project — we will respond within 2 hours.