Ubuntu 20.04 Server / Samba / Install and create a shared folder

Install Samba on Ubuntu 20.04 Server and configure a share, users and filesystem permissions to read and write files from Windows File Explorer. This example creates a standalone file server restricted to authenticated Samba users in a dedicated group, rather than a passwordless guest share.

Check the scope and install Samba

Samba shares Linux files with Windows and other systems using SMB (Server Message Block). This guide creates one share using local accounts, not an Active Directory domain controller or domain member. Do not overwrite an existing domain environment’s [global] settings with this example.

You need sudo privileges, sufficient storage, and connectivity from Windows to the server’s private IP or a correctly resolving hostname. The example server is 192.168.10.20 and the allowed network is 192.168.10.0/24; replace them for your environment. Ubuntu 20.04 standard support ended in 2025, so check security-maintenance coverage in Canonical’s Ubuntu 20.04 support information.

Install the packages and check the server version. smbclient is a client tool for testing shares. The Ubuntu Samba file-server guide covers the installation basics.

sudo apt update
sudo apt install samba smbclient
smbd --version
systemctl status smbd.service

On an existing server, inspect current shares and users first, then back up /etc/samba/smb.conf. Use another backup name if it already exists. This example assumes a new empty share directory; it does not recursively change ownership or permissions on existing data.

sudo cp -a /etc/samba/smb.conf /etc/samba/smb.conf.before-team-share
sudo testparm -s

Create the user, group and shared directory

1. Check whether the example account smbuser and group smbteam already exist. If so, inspect their purpose and members before reuse, or choose different names and update every corresponding setting.

getent passwd smbuser
getent group smbteam

2. For a new setup where neither name exists, create the group and file-sharing account, then register a Samba password. The final command sets the password used from Windows.

sudo groupadd smbteam
sudo useradd -M -s /usr/sbin/nologin -G smbteam smbuser
sudo smbpasswd -a smbuser

This file-sharing account has no home directory or interactive login shell. Linux login passwords set with passwd and Samba credentials registered with smbpasswd are separate. To use an existing Linux account, do not create it again: add it with sudo usermod -aG smbteam USERNAME, then register that name in Samba. See the Ubuntu 20.04 smbpasswd manual for account requirements.

3. Create the new share directory. This command sets its owner, group and mode; inspect existing permissions first if the path already contains data.

sudo install -d -o root -g smbteam -m 2770 /srv/samba/team
ls -ld /srv/samba/team
id smbuser

2770 grants the owner and group read, write and directory traversal permissions, excluding other users. The leading 2 is the setgid bit used for group inheritance. Check the owning group is smbteam and smbuser belongs to it. Both Linux permissions and Samba policy must allow access; do not solve permission issues with chmod 777.

Configure an authenticated share

Open /etc/samba/smb.conf with sudoedit /etc/samba/smb.conf and add the following section while preserving existing settings. If [Team] already exists, review it instead of duplicating it. The share name Team differs from its filesystem path.

[Team]
    path = /srv/samba/team
    browseable = yes
    read only = no
    guest ok = no
    valid users = @smbteam
    force group = smbteam
    create mask = 0660
    force create mode = 0660
    directory mask = 2770
    force directory mode = 2770

guest ok = no disallows guests; valid users = @smbteam permits authenticated members of that group. read only = no allows writes at the Samba layer but does not bypass Linux permissions. force group sets the group used for share operations.

The masks limit permission bits on new objects, while force modes add bits needed for group collaboration. The example targets 0660 for new files and 2770 for new directories; existing files are not changed retroactively. Separate ACLs (Access Control Lists) or permission modules require their own review. See the Ubuntu 20.04 smb.conf manual for these parameters.

Validate, apply and check the firewall

1. Check the configuration. Fix errors before applying it. A successful testparm means the configuration can be loaded, not that authentication or file operations will succeed.

sudo testparm -s

Check [Team], its path and access restrictions in the output. The testparm manual also requires separate checks of actual operation. A restart may disconnect existing shares, so identify users and schedule maintenance first.

2. After validation succeeds, apply the service configuration and check both startup and running status.

sudo systemctl enable --now smbd.service
sudo systemctl restart smbd.service
systemctl is-active smbd.service
systemctl is-enabled smbd.service
sudo ss -ltnp | grep ':445'

3. If the firewall is active, allow TCP 445 only from the required internal network. Replace the example range, decide the intended scope first and inspect existing rules for conflicts.

sudo ufw status verbose
sudo ufw allow from 192.168.10.0/24 to any port 445 proto tcp

Adding a rule does not enable an inactive UFW firewall. Do not run ufw enable without reviewing remote-management rules. Check router and cloud rules separately and do not forward SMB directly from the Internet. Direct address access here does not require opening all legacy NetBIOS discovery ports. See the UFW manual for rule syntax.

Test authentication and directory listing on the server itself. Enter the password at the prompt rather than putting it in a command. Check the Team listing and directory contents, then test Windows separately. The smbclient manual explains the commands.

smbclient -L 127.0.0.1 -U smbuser
smbclient //127.0.0.1/Team -U smbuser -c 'ls'

Connect from Windows and test file operations

1. Open Windows File Explorer and enter the following path in the address bar. Replace 192.168.10.20 with the server’s actual address. Direct access can work even if the server is absent from the Network list.

\\192.168.10.20\Team

2. At the credentials prompt, enter smbuser and the password registered with smbpasswd -a. Do not confuse it with your Windows account or PIN. If a different account is selected automatically, choose another account and supply the server’s Samba user.
3. Create a test folder and file, edit the contents and reopen it. Delete the test file and check another permitted user can modify the intended files. Do not use important existing files for testing.

For additional users, prepare individual Linux accounts and Samba credentials and add them to smbteam. Use personal accounts rather than one shared password. After changing groups or permissions, close existing connections and test a fresh SMB session.

For frequent use, choose This PC → Map network drive in File Explorer, select a drive letter and enter \\192.168.10.20\Team as the folder. Select different credentials if needed. See Microsoft’s network-drive mapping guidance for version-specific menu locations.

Windows guest restrictions or SMB signing requirements may reject old anonymous shares. This example uses authenticated access; do not use SMB1 installation, insecure guest access or disabled signing as workarounds. If your organization restricts authentication such as NTLM, use a configuration compatible with domain and server policy. See Microsoft’s SMB signing documentation for version and edition conditions.

Diagnose access errors and remove the share

First test TCP 445 from Windows PowerShell. TcpTestSucceeded being True does not validate credentials or file permissions. If False, inspect address, routing, firewall and listening service first. See Microsoft’s Test-NetConnection documentation for the options.

Test-NetConnection -ComputerName 192.168.10.20 -Port 445

For rejected passwords, check Samba registration, username and group restrictions. If login succeeds but writing fails, inspect parent traversal and group ownership with namei -l /srv/samba/team, ls -ld /srv/samba/team and id smbuser, alongside Samba read-only settings. Check sudo journalctl -u smbd.service -n 50 --no-pager and /var/log/samba/ for server logs.

If Windows keeps using old credentials, inspect connections with net use. Close open files, disconnect only the affected share as below and reconnect. Other shares on the same server may retain different credentials; inspect those connections and the server’s Credential Manager entries too. Do not delete unrelated network drives in bulk.

net use \\192.168.10.20\Team /delete

To stop this share, remove or revert only [Team] in smb.conf, validate with testparm -s and restart smbd.service during maintenance. Remove only the matching UFW rule if no longer needed. Check remaining connections, and preserve data and Linux accounts separately from removing the share.

sudo ufw delete allow from 192.168.10.0/24 to any port 445 proto tcp

Before restoring the whole configuration backup, compare whether other shares changed since it was taken. To disable only the Samba account, use sudo smbpasswd -d smbuser, but do not assume existing sessions end immediately. Verify rejection of new connections and remaining sessions separately.