Set Up Samba File Server on VPS

July 2026 · 7 min read

Samba is an open-source implementation of the SMB/CIFS protocol that enables file sharing between Windows, macOS, and Linux systems since 1992. With Samba running on your VPS, you can create network file shares accessible from Windows machines using File Explorer as if it were a standard network drive, and from Linux systems via mount commands. This makes collaboration easier, simplifies large file transfers, and enables centralized document storage. This guide covers installing Samba, creating user accounts, configuring workgroups, setting up folder shares, and securing access with proper permissions.

Install Samba on Ubuntu

sudo apt update
sudo apt install samba samba-client smbclient cifs-utils -y

# Enable Samba services
sudo systemctl enable --now smbd nmbd
sudo systemctl status smbd

Create User Accounts for Samba Share

Samba authentication relies on Linux user accounts. Each user accessing the share must exist as a Linux user first, then be added to the Samba password database for SMB authentication.

# Create a Linux user (if not already present)
sudo useradd -m -s /usr/sbin/nologin fileuser
# Set Linux password
sudo passwd fileuser

# Add user to Samba database
sudo smbpasswd -a fileuser
# When prompted "New SMB password:", set a password for Samba authentication
# (can differ from Linux password if desired)

Configure Samba (smb.conf)

The main Samba configuration file is /etc/samba/smb.conf. Edit it to define the global section and add share sections:

sudo nano /etc/samba/smb.conf

Find the [global] section and update it with these essential settings (prevents anonymous access):

[global]
   workgroup = WORKGROUP
   server string = VPS File Server
   netbios name = VPSFILER
   security = user
   map to guest = never

   # Disable anonymous login
   guest ok = no

   # Logging
   log file = /var/log/samba/log.%m
   max log size = 5000

   # SMB protocol (use 3.0+ for better security)
   min protocol = SMB2
   max protocol = SMB3

To create a user-restricted share folder, add this section at the end of the file (replace /shared/data with your actual path):

[Shared]
   path = /shared/data
   valid users = fileuser
   read only = no
   browseable = yes
   comment = Shared folder for team
   create mask = 0755
   directory mask = 0755

Create the actual directory and set ownership:

sudo mkdir -p /shared/data
sudo chown fileuser:fileuser /shared/data
sudo chmod 755 /shared/data

Validate and Reload Configuration

Before restarting Samba, validate the config file using testparm to catch syntax errors:

# Check smb.conf syntax
sudo testparm

# If no errors appear, reload Samba
sudo systemctl reload smbd nmbd

Open Firewall Ports

Samba uses port 139 (NetBIOS) and 445 (SMB) to serve clients. Both must be open in the firewall:

# Using ufw
sudo ufw allow 139/tcp
sudo ufw allow 445/tcp

# Using iptables (appends without removing existing rules)
sudo iptables -A INPUT -p tcp --dport 139 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j ACCEPT

Verify That Samba Is Working Correctly

# Check status of Samba services
sudo systemctl status smbd
sudo systemctl status nmbd

# List available shares on the server
sudo smbclient -L localhost

# View registered Samba users
sudo pdbedit -L

# Test access to a share
smbclient //localhost/Shared -U fileuser%PASSWORD

Common Issues & Troubleshooting

Error: "Bad password for user"

The password in the Samba database doesn't match what you entered, or the password was changed in Linux but not updated in Samba. Reset the password:

sudo smbpasswd -a fileuser
# Enter new password twice

Error: "Permission denied" when accessing the share

The folder path in config or the folder's ownership/permissions are incorrect. Check and fix:

ls -ld /shared/data
# Should show: drwxr-xr-x fileuser fileuser
# If not, correct it:
sudo chown fileuser:fileuser /shared/data
sudo chmod 755 /shared/data

Error: "Share not found" or share doesn't appear in File Explorer

The config may have a syntax error or the service hasn't reloaded. Validate and reload:

sudo testparm 2>&1 | grep -i error
sudo systemctl reload smbd nmbd

# Wait a moment then query shares again
sleep 2
smbclient -L localhost

Error: "Connection refused" from Windows

Port 445 is blocked by the firewall or Samba services aren't running. Check both:

sudo systemctl is-active smbd
sudo netstat -tulnp | grep -E '(139|445)'
# Should show :139 and :445 in LISTEN state

Error: "The username or password is incorrect"

Verify the user is enabled in Samba's database:

sudo pdbedit -L fileuser
# Look for [U] flag (enabled) or [DU] flag (disabled)
# If disabled, re-enable:
sudo smbpasswd -e fileuser

Frequently Asked Questions

Do I need a domain controller?

No. For workgroup environments like small offices or teams, using security = user (as shown in this example) is sufficient. Samba authenticates against the local user/password database (pdbedit or /etc/passwd). Active Directory integration requires additional configuration, only needed in large enterprise environments.

Can Samba allow anonymous access without login?

Yes, but it's not recommended for production. If you must allow anonymous access, add this section to smb.conf:

[Share_Public]
   path = /shared/public
   guest ok = yes
   read only = yes
   browseable = yes

Anonymous shares should always be read-only and contain only public files that anyone can access. Never store sensitive data here.

Is Samba safe on an internet-facing VPS?

SMB/CIFS was designed for LAN environments, not the internet. If remote users must access files from outside your office, use a VPN tunnel or SSH tunneling (like sshfs or WireGuard) rather than exposing port 445 publicly. Alternatively, restrict port 445 access to trusted IP addresses only instead of opening it to the world.