CentOS 7 Samba Share Configuration Guide

A Complete CentOS 7 Samba Share Configuration Guide

When a CentOS server hosts your website but your operations colleague needs to edit files directly from a Windows machine, the most convenient answer is usually not FTP — it's Samba. Samba implements the SMB/CIFS protocol, letting Windows map a Linux directory as a network drive and read or write to it just like a local folder. Drag-and-drop uploads and in-place edits feel natural.

This guide uses a common web-server layout: we share out /www/wwwroot, and Windows users access it via \\IP\web. All steps assume root privileges.

1. Install Samba

yum install samba samba-client -y

samba-client lets you test the connection locally — for example with smbclient -L localhost -U www to verify the share is visible.

2. Start the Services

systemctl start nmb.service && systemctl start smb.service

nmb.service handles NetBIOS name resolution and host broadcasting, while smb.service provides file and print sharing — both must run. It's also worth enabling them at boot:

systemctl enable nmb.service smb.service

3. Back Up the Configuration File

cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

4. Modify the Configuration File

vi /etc/samba/smb.conf

Content:

[global]
server string = mysite samba
security = user
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd

# web is the share name used when accessing; path is the actual server path
[web]
workgroup = www
netbios name = www
path = /www/wwwroot
browseable = yes
writeable = yes

A few key options explained:

security = user means user-level authentication — clients must log in with a valid Samba account;
encrypt passwords = yes enables encrypted password transport; the old protocol defaults to plaintext, so this must be on;
browseable = yes makes the share appear in "Network Neighborhood", and writeable = yes permits writes.

To restrict access to a specific subnet, add hosts allow = 192.168.1.0/24 inside the [web] section.

5. Create the smbpasswd File

cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd

Note: newer Samba releases no longer recommend wholesale import via mksmbpasswd.sh. A more robust approach is to create the system user first with useradd -s /sbin/nologin www, then run smbpasswd -a www to set the Samba password. The original steps also work; the end result is the same.

Add the www user and set its password:

smbpasswd -a www

Add the www user mapping in /etc/samba/smbusers:

www = network service

6. Restart the Samba Service

systemctl restart smb.service

7. Set Directory Permissions

Set the owner of /www/wwwroot to www and grant the www user full permissions:

chown -R www:www /www/wwwroot && chmod -R 755 /www/wwwroot

Note that 755 gives the owner write access while the group and others are read-only. If several people need to collaborate, switch the group mode to 775 and add everyone to the www group. Misconfigured permissions are the most common reason a client can connect but cannot write.

8. Accessing from Windows

Type \\IP\web into the Windows Explorer address bar; when the login box appears, enter www and its Samba password. You can also pick a drive letter under "Map network drive" so it's always available after login. On macOS, press Cmd+K in Finder and enter smb://IP/web.

One-Click Configuration Install Command (Recommended)

yum install samba samba-client -y && systemctl start nmb.service && systemctl start smb.service
cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

sudo tee /etc/samba/smb.conf <<-'EOF'
[global]
server string = web samba
security = user
encrypt passwords = yes
smb passwd file = /etc/samba/smbpasswd

[web]
workgroup = www
netbios name = www
path = /www/wwwroot
browseable = yes
writeable = yes
EOF

cat /etc/passwd | mksmbpasswd.sh > /etc/samba/smbpasswd
smbpasswd -a www

After entering the www password, continue with the following commands:

echo 'www = network service' >> /etc/samba/smbusers
echo 'systemctl start nmb.service && systemctl start smb.service' >> /etc/rc.d/rc.local && chmod +x /etc/rc.d/rc.local
chown -R www:www /www/wwwroot && chmod -R 755 /www/wwwroot
systemctl restart smb.service && echo "Samba install success."

Appending the start command to /etc/rc.d/rc.local and making it executable ensures Samba comes up after a reboot — handy in simple setups where you'd rather not write a systemd unit.

Security and Multi-User Advice

A shared directory sits directly on your LAN, so a few security points are worth paying attention to:

Don't map root to a Samba account: give each collaborator their own system user and Samba password so you can audit who changed what;
Restrict the subnet: add hosts allow = 192.168.1.0/24 inside the [web] section to keep the share off the public internet;
Share only what's needed: don't expose your whole home directory or root — open the minimum path required;
Revoke accounts promptly: when someone leaves, run smbpasswd -x username to remove their Samba account.

If you want a part of the share to be read-only for anonymous visitors, add map to guest = Bad User under [global] and drop writeable = yes from the share block. That said, guest access is generally not recommended for website directories because it creates a security risk.

Once configured, Linux clients can also mount the share over cifs so servers, desktops, and laptops all use the same directory:

yum install cifs-utils -y
mount -t cifs //server-ip/web /mnt/web -o username=www,password=your-password

A Typical Multi-User Scenario

Say a three-person team needs to share /www/wwwroot: the designer needs read-write access while the two backend developers only read. Split it into two shares:

[web]
path = /www/wwwroot
valid users = designer, dev1, dev2
read only = yes

[web-write]
path = /www/wwwroot
valid users = designer
writeable = yes

Give the designer's account writeable = yes and keep the others read-only, then pair it with chmod -R 750 /www/wwwroot, making the designer the owner and putting everyone else in the same group. This supports collaboration without letting one accidental delete wreck the site.

Troubleshooting Common Issues

Windows reports a network error: check that the firewall allows the Samba ports (TCP 139/445, UDP 137/138):
```
firewall-cmd --permanent --add-service=samba && firewall-cmd --reload
```
Can connect but can't write: confirm the directory owner and permissions per step 7. CentOS 7 also ships with SELinux enforcing by default — if you see permission errors, enable the relevant boolean:
```
setsebool -P samba_export_all_rw on
```
Configuration changes don't take effect: Samba caches its config, so you must systemctl restart smb.service after editing smb.conf, and validate the syntax with:
```
testparm
```
Older devices can't connect (old printers, NVRs, old TVs, etc.): these devices typically support only SMB1, while modern Samba disables the legacy protocol by default. If you truly need compatibility, add server min protocol = NT1 under [global] — but SMB1 has known security flaws, so use it only on an isolated LAN and keep it disabled on public-facing networks.
"File in use" and can't save: when several people edit the same file at once, Samba holds a lock. Run smbstatus to see all active connections and locked files, so you can quickly find who's holding the target open:
```
smbstatus
```
When troubleshooting permission or authentication issues, you can also tail the access log in real time — auth failures and missing paths are all recorded there, which beats guessing one item at a time:
```
journalctl -u smb -f
```

Once the Samba server is configured, other machines can mount the share via cifs; see mounting Samba shares between CentOS servers. For more server configuration and operations content, see the cloud servers category.

Reference: Samba official documentation https://www.samba.org/samba/docs/; original post: https://www.cnblogs.com/cqzhuomi/articles/17283676.html (cnblogs.com CQZHUOMI, repost)