Ubuntu 26.04 Tutorial / Create a Restricted Samba File Share

Ubuntu

A restricted Samba share needs authentication, share access rules, Linux directory permissions, and network restrictions together. This exercise creates LabShare on a dedicated server and tests both an allowed and an excluded user.

Plan the server, accounts, and connection path

Samba shares files through SMB (Server Message Block). Use the server’s real address in Windows File Explorer or test with smbclient on Linux. Keep SMB within a trusted LAN or managed VPN rather than exposing it directly to the internet.

Use a fresh lab VM where the following names and /srv/ubuntu-share-lab do not exist. On an existing server, inspect global settings, accounts, and shares before changing anything. Samba credentials are separate from Linux login passwords, and the Linux user must exist first.

Ubuntu’s Samba access-control guide explains the relationship between account databases, share rules, and filesystem permissions.

Create the group and Samba-only accounts

sudo apt update
sudo apt install samba smbclient
sudo addgroup ubuntu-share-lab
sudo adduser --disabled-password --gecos "" --no-create-home --shell /usr/sbin/nologin --ingroup ubuntu-share-lab sharelab
sudo adduser --disabled-password --gecos "" --no-create-home --shell /usr/sbin/nologin sharedeny
sudo smbpasswd -a sharelab
sudo smbpasswd -a sharedeny
sudo install -d -m 2770 -o root -g ubuntu-share-lab /srv/ubuntu-share-lab
id sharelab
id sharedeny
ls -ld /srv/ubuntu-share-lab

Enter separate lab passwords interactively at the two smbpasswd prompts; do not place passwords on the command line. Confirm that sharelab belongs to the permitted group and sharedeny does not. The leading 2 sets setgid to help new entries inherit the group, while 770 permits owner/group access. Do not apply chmod 777 to existing data.

Add the share and check configuration

backup_dir=$(sudo mktemp -d /root/samba-lab.XXXXXX)
sudo cp -a /etc/samba/smb.conf "$backup_dir/smb.conf"
printf "%s\n" "$backup_dir"
sudoedit /etc/samba/smb.conf

Record the backup location and append this section once at the end of the existing file. If the share name already exists, stop and choose a new name. Preserve [global] and all other share sections.

[LabShare]
    path = /srv/ubuntu-share-lab
    browseable = yes
    read only = no
    guest ok = no
    valid users = @ubuntu-share-lab
    create mask = 0660
    directory mask = 2770

sudo testparm -s
systemctl is-active smbd.service

Only after testparm succeeds and shows the intended LabShare settings, reload the running smbd with the following command. If the service is inactive, inspect its failure logs first. A create mask limits permissions; it does not promise that every new file receives identical mode bits.

sudo smbcontrol smbd reload-config
sudo ss -lntp

Installing smbclient on the server does not install it on the client. Verify server .20 and permitted Linux client .10 on the host-only network from the VM creation lesson, then run the following installation on client .10. Windows can use File Explorer’s UNC path instead of smbclient.

sudo apt update && sudo apt install smbclient

Test allowed and denied access from the real client

Direct SMB uses TCP 445. Use the following allowance only if the actual lab client is 192.168.56.10 and UFW is being managed. Preserve SSH access and follow the previously checked activation/default-policy procedure. Adding a narrow rule does not restrict an existing broader allowance.

sudo ufw allow from 192.168.56.10 to any port 445 proto tcp
sudo ufw status numbered

Replace the address below with the server’s actual address in the client terminal. In Windows File Explorer, authenticate at a UNC path such as \\server-address\LabShare. Testing localhost on the server does not verify access from another device or firewall enforcement.

smbclient //192.168.56.20/LabShare -U sharelab -c "ls"
smbclient //192.168.56.20/LabShare -U sharedeny -c "ls"

sharelab should list the share, while sharedeny should be denied share access despite having valid Samba credentials. An incorrect-password failure alone does not verify group restrictions. Upload a small new file with the allowed account, download and compare it, and separately check connection denial from an excluded network.

Test writing and reverse the change

lab_dir=$(mktemp -d)
printf "samba-lab\n" > "$lab_dir/check.txt"
cd "$lab_dir"
smbclient //192.168.56.20/LabShare -U sharelab -c "put check.txt check.txt; get check.txt downloaded.txt"
cmp check.txt downloaded.txt

Run this only when the lab share is empty and check.txt does not exist. A successful silent cmp confirms identical transferred content. Use a unique name if necessary. Separate authentication, share authorization, directory permissions, mount state, and AppArmor logs when investigating failure.

To retire the lab, remove only this share section and firewall rule, then validate and reload configuration. Check for other uses and owned files before deleting the new accounts/group. Preserve data before cleaning the directory. Restore the entire configuration backup only after checking for intervening changes.

Ubuntu