View source for Password Protected Samba Share

This article describes how to create a basic password protected Samba share on Linux, accessible by only one user. This share can be accessed via Windows, OSX, or Linux.

We'll be making a share called <font color="red">fogshare</font>. It will be accessible via UNC paths in windows as <font color="red">\\x.x.x.x\fogshare</font> where x.x.x.x is the server's IP address. The share will reside on disk at <font color="red">/images/fogshare</font> The user defined with permissions and access is called <font color="red">smalluser</font>

I've chosen to place the share in the /images directory because in an optimal fog partition layout, this directory typically has it's own partition and thus ample space. You may place the share wherever you like, simply by choosing another place to create the directory. Be sure to set permissions on the alternate directory and change the <font color="red">path</font> setting in the Samba configuration file.

On CentOS 7, Fedora, RHEL, Ubuntu, and probably Debian, the process is almost identical.

= Install Samba =

For CentOS 7 and older, RHEL 7 and older, and Fedora 21 and older, install Samba:

<pre>yum install samba samba-client -y</pre>

For Fedora 22 and newer, and probably CentOS 8 and RHEL 8 and newer, install Samba:

<pre>dnf install samba samba-client -y</pre>

For Ubuntu and Debian, install Samba:

<pre>apt-get install samba samba-client -y</pre>

= Start Samba =

Start Samba on Fedora/CentOS/RHEL:

<pre>systemctl start smb</pre>

Start Samba on Ubuntu/Debian:

<pre>service smb start</pre>

= Make the directory =

Make the directory you want to share:
<pre>mkdir /images/fogshare</pre>

= Create user and set password =

Make a user specifically for it:

<pre>useradd smalluser</pre>

Set the user's password:

<pre>passwd smalluser</pre>

Add the user to Samba and set a password for the user, this should match the previous password:

<pre>smbpasswd -a smalluser</pre>

= Set permissions =

Set permissions on the local directory:

<pre>chown smalluser:smalluser /images/fogshare
chmod 770 /images/fogshare</pre>

= Configure Samba =

Setup the samba configuration script:

<pre>vi /etc/samba/smb.conf</pre>

Instructions on using Vi: [[vi]]

Below is the Samba configuration file. Things above [fogshare] are global and apply to all shares. Then below each bracket name, is settings specific to the share with the text inside the bracket being the share name itself. Feel free to copy/paste.

<pre>security = user
passdb backend = tdbsam
unix charset = utf-8
dos charset = cp932

[fogshare]
path = /images/fogshare
read only = no
create mode = 0777
directory mode = 0777
writable = yes
valid users = smalluser</pre>

= Restart Samba =

Then restart Samba in Fedora/CentOS/RHEL:

<pre>systemctl restart smb</pre>

Restart Samba on Ubuntu/Debian:

<pre>service smb restart</pre>

= Access from Windows =

Open File Explorer. In the address bar, type <font color="red">\\x.x.x.x\fogshare</font>
You will be prompted for a user and pass, give the smalluser as username, and the password you setup. You should now have read/write to this share.


= Access from Linux =

== Mount SMB share on the fly - '''not''' permanently ==

This is a fast and easy way to get work done that you don't do very often, and is perfectly acceptable as long as it's done manually and not scripted.

To mount:

<pre>
mkdir /tempMount
mount -t cifs //x.x.x.x/fogshare /tempMount -o username=smalluser -o password=YourPasswordGoesHere,noexec
</pre>

To work with the share, just go into /tempMount and do your thing.
<pre>cd /tempMount</pre>


To unmount:

<pre>umount /tempMount</pre>


== Mount SMB share permanently ==

=== Fewer steps, less secure ===

This method isn't as secure, because the password is contained in the fstab entry.

<pre>mkdir /tempMount
vi /etc/fstab</pre>

Instructions on using Vi: [[vi]]

Add this line to the bottom of /etc/fstab:

<pre>//x.x.x.x/fogshare /tempMount cifs username=smalluser,password=YourPasswordGoesHere,iocharset=utf8,sec=ntlm 0 0</pre>

Then, mount:
<pre>sudo mount -a</pre>

=== More steps, more secure ===

This method is more secure, because we separate out the credentials from the fstab entry.

Create the mount directory:
<pre>mkdir /tempMount</pre>

Create a credentials file, readable by only the person who should be managing it (root).
<pre>vi ~/.smbcredentials</pre>

Instructions on using Vi: [[vi]]

Place these fields into the file.

<pre>
username=foguser
password=YourPasswordGoesHere
</pre>

Save and quit.

Set strict permissions on the file.

<pre>chmod 600 ~/.smbcredentials</pre>

Modify /etc/fstab file:

<pre>vi /etc/fstab</pre>

Instructions on using Vi: [[vi]]

Note: If you did the above steps, you can delete the above line from those steps now.

<pre>//x.x.x.x/fogshare /tempMount cifs credentials=/home/username/.smbcredentials,iocharset=utf8,sec=ntlm 0 0</pre>

Save and close.

Mount the share:

<pre>sudo mount -a</pre>