Welcome to my website

Samba share

Category: Linux | Published: 30 June 2025 11:59:32

Last Updated: 26 July 2026 20:58:31

Guide: Simple Samba Share with Guest Access (Read-Only)



This guide explains how to create a simple Samba share on a Linux server. The share is accessible without a username or password and is read-only.

This setup is useful for sharing public files on a trusted local network, such as manuals, photos, ISO files, or media files.

Important security note

Guest access means that anyone who can reach your server on the network can read the files in this share. Only use this on a trusted private network. Do not expose this share to the internet.

What is Samba?



Samba is an open-source software suite that allows Linux and Unix systems to share files with Windows, macOS, and other SMB/CIFS clients. In practice, it lets your Linux server act as a Windows-compatible file server.

Step 1: Install Samba



On Debian or Ubuntu-based systems, install Samba with:


sudo apt update
sudo apt install samba


Enable and start the Samba service:


sudo systemctl enable --now smbd


Optional: if you need older NetBIOS network browsing, also enable `nmbd`:


sudo systemctl enable --now nmbd


On Fedora, CentOS Stream, or RHEL-based systems, install Samba with:


sudo dnf install samba samba-client


Enable and start the Samba service:


sudo systemctl enable --now smb


Optional: if you need older NetBIOS network browsing, also enable `nmb`:


sudo systemctl enable --now nmb


Step 2: Back up the Samba configuration



Before changing the Samba configuration, create a backup of the original file:


sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak


Step 3: Create the shared directory



In this guide, the shared directory is:


/srv/samba/public


Create the directory:


sudo mkdir -p /srv/samba/public


Set ownership to `root`:


sudo chown -R root:root /srv/samba/public


Set read and execute permissions for everyone:


sudo chmod -R 755 /srv/samba/public


This means:

  • The owner, `root`, can read, write, and enter the directory.
  • Other users, including guest users, can read files and enter the directory.
  • Guest users cannot upload, edit, or delete files through Samba because the share will be configured as read-only.


Add a test file:


echo "Samba read-only guest share is working." | sudo tee /srv/samba/public/readme.txt


Step 4: Configure Samba



Open the Samba configuration file:


sudo nano /etc/samba/smb.conf


Find the `[global]` section and make sure it contains these settings:


[global]
    workgroup = WORKGROUP
    security = user
    map to guest = Bad User


Explanation:

  • workgroup = WORKGROUP: The Windows workgroup name. In many home networks this is still `WORKGROUP`.
  • security = user: The normal and recommended Samba security mode.
  • map to guest = Bad User: Unknown users are mapped to the guest account instead of being rejected immediately.


You usually do not need to set `guest account = nobody`, because Samba already has a default guest account. If your distribution requires a specific guest account, check it with:


testparm -s


Step 5: Add the read-only guest share



At the end of `/etc/samba/smb.conf`, add this share:


[Public]
    path = /srv/samba/public
    comment = Public read-only guest share
    browseable = yes
    read only = yes
    guest ok = yes


Explanation:

  • [Public]: The name of the share as shown to clients.
  • path: The local directory that Samba shares.
  • comment: A description of the share.
  • browseable = yes: Makes the share visible when browsing the server.
  • read only = yes: Prevents users from changing files through Samba.
  • guest ok = yes: Allows access without a Samba username and password.


Save and close the file.

In nano:

  • Press Ctrl + O to save.
  • Press Enter to confirm.
  • Press Ctrl + X to exit.


Step 6: Check the Samba configuration



Before restarting Samba, check the configuration for errors:


testparm


If there are no errors, you can continue.

Step 7: Restart Samba



On Debian or Ubuntu-based systems:


sudo systemctl restart smbd


If you enabled `nmbd`, restart it too:


sudo systemctl restart nmbd


On Fedora, CentOS Stream, or RHEL-based systems:


sudo systemctl restart smb


If you enabled `nmb`, restart it too:


sudo systemctl restart nmb


Step 8: Configure the firewall



If you use UFW on Ubuntu or Debian, allow Samba:


sudo ufw allow samba
sudo ufw reload


Do not run `sudo ufw enable` unless you are sure your firewall rules are correct. Enabling UFW on a remote server can lock you out if SSH is not allowed.

If you use firewalld on Fedora, CentOS Stream, or RHEL:


sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload


Step 9: Fedora/RHEL note about SELinux



On Fedora, CentOS Stream, or RHEL, SELinux may block Samba from reading the shared directory unless the correct context is set.

If SELinux is enabled, run:


sudo semanage fcontext -a -t samba_share_t "/srv/samba/public(/.*)?"
sudo restorecon -Rv /srv/samba/public


If the `semanage` command is not available, install the required package:


sudo dnf install policycoreutils-python-utils


Step 10: Test from the Linux server



You can test the share locally with:


smbclient -L localhost -N


You should see the `Public` share in the output.

You can also try connecting to it:


smbclient //localhost/Public -N


Inside the `smbclient` prompt, run:


ls


You should see the test file.

Step 11: Test from Windows



On a Windows PC, open File Explorer and enter the server address in the address bar.

Example:


\\192.168.1.100


Replace `192.168.1.100` with the IP address of your Linux server.

You should see the share named:


Public


Open it. You should be able to read files, but not create, edit, or delete them.

Important Windows note: insecure guest access



Modern Windows versions may block guest access by default. If that happens, Windows may ask for credentials or refuse the connection.

This is a Windows security feature. Enabling insecure guest logons lowers security, so only do this on trusted private networks.

Option A: Enable insecure guest logons with Group Policy



This works on Windows Pro, Enterprise, and Education editions.

  1. Press Win + R.
  2. Type gpedit.msc and press Enter.
  3. Go to Computer Configuration → Administrative Templates → Network → Lanman Workstation.
  4. Open Enable insecure guest logons.
  5. Set it to Enabled.
  6. Click OK.
  7. Restart the Windows PC.


Option B: Enable insecure guest logons with Registry Editor



Use this method on Windows Home, or when Group Policy Editor is not available.

  1. Press Win + R.
  2. Type regedit and press Enter.
  3. Go to this location:



HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters


  1. Create a new DWORD (32-bit) Value.
  2. Name it AllowInsecureGuestAuth.
  3. Set its value to 1.
  4. Restart the Windows PC.


Troubleshooting



Check the Samba configuration:


testparm


Check whether Samba is running on Debian or Ubuntu:


systemctl status smbd


Check whether Samba is running on Fedora, CentOS Stream, or RHEL:


systemctl status smb


Check the server IP address:


ip addr


Check whether the share is visible locally:


smbclient -L localhost -N


Check permissions on the shared directory:


ls -ld /srv/samba/public
ls -l /srv/samba/public


Expected directory permissions should look similar to:


drwxr-xr-x root root /srv/samba/public


Conclusion



You now have a simple read-only Samba share with guest access. This is useful for sharing public files on a trusted local network.

For sensitive data, do not use guest access. Create Samba users and protect the share with authentication instead.

Back to Knowledge Base