Samba¶

Samba serves Windows-style file shares from Linux. The config is /etc/samba/smb.conf; testparm -s prints the effective configuration with defaults filled in, which is the version to read. Reload with sudo systemctl restart smbd nmbd.

Shares¶

testparm -s 2>/dev/null | grep -E '^\[|path|guest|read only|writable|writeable|create mask|directory mask'

Every [section] other than [global] is a share. The README says which shares should exist and who uses them. For each:

Setting	Value	Why
A share the README doesn't name	remove the whole section	It's a door
`guest ok`	`no`	No access without an account
`map to guest` (global)	`never`	A bad password isn't quietly turned into guest access
`writable` / `read only`	`read only = yes` unless the README says users write to it
`guest ok = yes` together with `writable = yes`	never	Anonymous uploads: anyone on the network can drop files (or malware) on the server
`create mask`, `directory mask`, `force create mode`	`0640` / `0750`, never `0777`	New files aren't world-writable
`valid users`	the README's users or group (`@staff`)	Only listed accounts see the share
`browseable`	`no` for shares that shouldn't be advertised
`[homes]`	remove unless the README wants home directories shared
`[printers]`, `[print$]`	remove unless it's a print server

Protocol and authentication (global)¶

Setting	Value	Why
`server min protocol`	`SMB2` (or `SMB3`)	SMB1 is the protocol WannaCry used
`ntlm auth`	`ntlmv2-only` (never `yes` or `ntlmv1-permitted`)	NTLMv1 hashes are crackable
`server signing`	`mandatory`	Blocks relay attacks
`smb encrypt`	`desired` or `required`	Traffic is encrypted
`restrict anonymous`	`2`	No anonymous listing of shares or users
`log level`	`1` with `log file = /var/log/samba/log.%m`	Connections are logged
`hosts allow`	the README's network, e.g. `192.168.1. 127.`	Only the local network can talk to it

sudo tee -a /etc/samba/smb.conf > /dev/null <<'EOF'

[global]
   server min protocol = SMB2
   ntlm auth = ntlmv2-only
   server signing = mandatory
   smb encrypt = desired
   restrict anonymous = 2
   map to guest = never
EOF
sudo testparm -s > /dev/null && sudo systemctl restart smbd nmbd

A second [global] section at the end merges with the first, and later values win. testparm warns about anything it didn't understand.

Samba users¶

Samba has its own password database. sudo pdbedit -L lists the accounts; each should be a README user who needs the share. sudo smbpasswd -x user removes one; sudo smbpasswd -a user adds one.

Verify¶

testparm -s 2>/dev/null | grep -E 'min protocol|ntlm auth|guest ok|map to guest|0777|writable|read only'
sudo pdbedit -L
smbclient -L localhost -N          # anonymous listing should be refused

Example¶

testparm -s shows [public] path = /srv/public, guest ok = yes, writable = yes, create mask = 0777 and ntlm auth = yes in global. The README lists one share, [staff], for the staff group. Remove [public] entirely (and check /srv/public for what was uploaded), set ntlm auth = ntlmv2-only, server min protocol = SMB2, fix [staff] to valid users = @staff, create mask = 0640.

Try it¶

Create a guest-writable share, connect anonymously with smbclient, upload a file. Then set guest ok = no and try again.
Run testparm -s and find where each of your changes landed.

Build it¶

A samba-check.sh that runs testparm -s and prints every share with its guest ok, writable, and create mask.

Next¶

DNS Server