Configuring a Secure Samba File Share on Linux for Home Network File Storage

August 6, 2026

Introduction: The Project

With multiple devices connected to my home network, and the need to work on projects from different desktops and laptops depending on where I am, it makes sense to have a central location for storing files and backups. A Linux server can provide that centralized storage while allowing authorized devices on the home network to access the files when needed.

For this project, the file share must:

Require authentication for access
Not be exposed to the internet
Restrict access to authorized users and trusted devices
Provide a central location for storing files and backups

On a home network, the goal is to limit access to trusted systems, authenticate users, and avoid exposing unnecessary services outside the LAN.

The Plan

Diagram showing LAN Topology

The plan is to install Samba, for SMB file sharing on Linux, on a Ubuntu desktop computer with 1TB of usable storage space configured in a RAID 10. Although RAID provides redundancy against certain disk failures, it is not a substitute for a separate backup.

Authentication will be required, and anonymous or guest access will not be allowed. The file share will be limited to the local network, with firewall rules allowing SMB connections only from devices on the LAN.

Finally, the backup location on the server will be stored in a separate directory from the rest of the filesystem. This will give the share a clearly defined purpose and help limit access to the specific files and directories that need to be shared.

Verify the Server's Network Config

First, identify the server's IP address and network interface.
From the terminal, run:

ip addr

hostname -I

For additional routing information, run:

ip route

Note - The server should have a predictable IP address, either through a static IP configuration or a DHCP reservation. (for info on how to set a static IP, click here)

For setup we will need the following

the server's LAN IP address
the network interface connected to the home network
the local subnet

For example:
Server IP: 192.168.0.2
Network: 192.168.0.0/24

Installing Samba on Debian-based Linux

First, update the repositories with:

sudo apt update

Then, install the Samba package with:

sudo apt install samba

When the install is complete, check that the Samba service is running with:

systemctl status smbd

If the service is not running, enable and start it with:

sudo systemctl enable --now smbd

This command does two things- "enable" configures the service to start automatically at boot and "--now" starts the service immediately.

Finally, verify that Samba is listening with:

sudo ss -tulpn | grep -E '139|445'

(note: ss is used to dump socket statistics, ref: https://man7.org/linux/man-pages/man8/ss.8.html)

Create a Dedicated Backup Directory

Create a directory to store the shared data under /srv (short for service). The /srv directory is intended for site-specific data served by the system.

sudo mkdir -p /srv/samba/network_share

(name the folder whatever makes sense for your use case ex: /srv/samba/backups if, in your case, the share is for backups)
A dedicated location is preferable to sharing something like '/home/user' or '/' because the share has a clearly defined purpose and scope.

Alright, lets take a quick breather to go over what we've done so far. At this point, Samba is installed and the location for the shared data has been created. Before configuring the share itself, I want to establish who should be allowed to access it and what permissions that account should have.

Set Up a Dedicated User

At this point, there are a couple common options for a user account.
Either we configure an existing Linux user with a separate password or create a dedicated system user with access to only the Samba share. The latter will follow the security principle of least privilege. The account used to access the Samba share should have access to the share directory and nothing else.
For my purposes, I'll create a dedicated system user.
First, create a system user with no interactive login with the following command

sudo useradd --system --no-create-home --shell /usr/sbin/nologin sambashareuser

Then assign ownership to the previously created shared directory

sudo chown -R sambashareuser:sambashareuser /srv/samba/network_share

After assigning ownership I'll set the permissions such that only the file owner (in this case sambashareuser) can read, write, and execute it, while completely blocking access for everyone else.

sudo chmod 700 /srv/samba/network_share

Finally, I'll add the new user to Samba and enable the new user with the following commands

sudo smbpasswd -a sambashareuser

enter a password when prompted then to enable the user

sudo smbpasswd -e sambashareuser

Backup the Default Samba Configuration

Always create a backup of configuration files before making changes, in case something goes south

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup

Verify the backup was created successfully with

ls -l /etc/samba

Review the Existing Samba Configuration

Before making any changes let's review the existing configuration file with the following command

sudo less /etc/samba/smb.conf

Another command that is specific to Samba and used to validate the Samba configuration is

testparm

and to specifically see the effective configuration use

testparm -s

Configure the Share

Edit the Samba configuration file with nano

sudo nano /etc/samba/smb.conf

I added the following parameters at the end of the file

[network_share]
   path = /srv/samba/network_share  
   browseable = yes  
   read only = no  
   guest ok = no  
   valid users = sambashareuser

Before restarting any network services, always validate the configuration first

testparm

Following this simple line of events - Edit > Validate > Restart/reload > Test - will typically result in less headaches

Restrict Samba to the Home Network

Now on to one of the most important security sections of this project. Using the info I gathered in the verifying section, I'll allow only hosts on the network of 192.168.0.0/24 (for more information regarding IP addressing and CIDR notation click here) Edit the Samba config file again with nano and add the following just below the [global] in the file

hosts allow = 192.168.0.0/24

(add a screenshot here of the change)

Save and verify the file again with

testparm

Configure the Firewall

I'll first verify if UFW is active with

sudo ufw status

If the firewall is inactive, activate it with

sudo ufw enable

NOTE - if you're connected to the server via SSH, you'll want to first allow SSH connections with the following commands

sudo ufw allow ssh

It's standard practice to also add the following for a baseline security structure

sudo ufw default deny incoming

sudo ufw default allow outgoing

Now that the firewall is enabled, I can allow Samba from only the local network with

sudo ufw allow from 192.168.0.0/24 to any app Samba

and verify with

sudo ufw status numbered

Restart Samba and Check Log Files

Now that we have validated our changes we can restart Samba with the following command

sudo systemctl restart smbd

and check the service is running with

systemctl status smbd

If there is some error(my luck), check the log files with

sudo journalctl -u smbd

Topics: Linux Samba Networking Security