iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To set up Samba on an Ubuntu or Debian VPS, install the Samba package, create a dedicated directory under /srv, define an authenticated share in /etc/samba/smb.conf, create matching Linux and Samba identities, apply filesystem permissions, restrict SMB traffic in both firewalls, and connect with a Windows UNC path such as \server-ipshare.
A public VPS changes the security decision: do not use an unrestricted guest share or expose SMB to the entire Internet. Use named accounts, least-privilege permissions, a source allowlist or private network, regular updates, and tested backups.
What Samba does on a Linux VPS
Samba implements the SMB file-sharing protocol on Linux. It lets Windows, Linux, and macOS clients open files on a directory hosted by the VPS as though it were a network share. Canonical describes Samba file serving as one of the common ways to network Ubuntu and Windows computers.
The VPS supplies persistent storage and a network endpoint; Samba supplies the share protocol; Linux ownership, mode bits, and POSIX ACLs still decide whether an authenticated user can actually read or change a file. A successful login alone does not override filesystem permissions.
#1 Best Overall
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Choose the access model before installing
| Decision | Safer default for a VPS | When another choice is reasonable |
|---|---|---|
| Authentication | Named Samba users backed by Linux accounts | Guest access only on a tightly isolated, trusted private network |
| Permissions | One user for a small share, or a Linux group for several users | POSIX ACLs when different users need different read/write rights |
| Network control | Provider firewall plus the VPS host firewall, both restricted to trusted source ranges | A private network or VPN can avoid exposing SMB on a public address |
| Storage | Local persistent VPS storage with a tested backup plan | Mounted or object-backed storage when its filesystem and locking behavior are known to work with Samba |
| Identity integration | Standalone Samba mode with security = user |
Domain or Active Directory integration when an existing identity service is required |
Requirements and a safe deployment plan
- An Ubuntu or Debian VPS with administrative access through
sudo. - Persistent storage sized for the files you intend to keep. Ephemeral disks are unsuitable for a file server unless your provider explicitly guarantees persistence.
- A stable DNS name or IP address reachable by the permitted clients.
- A list of users and the client networks that should be allowed to connect.
- Control of both the VPS provider’s network firewall and the operating system firewall.
- A backup destination separate from the VPS and a schedule for testing restores.
Keep the share on a dedicated path rather than exposing a user’s home directory. The Ubuntu filesystem guidance identifies /srv as the place for site-specific data, so /srv/samba/share is a clear, maintainable location.
Install Samba on Ubuntu or Debian
- Update package metadata and install Samba:
sudo apt update
sudo apt install sambaThe central configuration file is /etc/samba/smb.conf. Keep a copy of the original before editing:
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.origThe package installs the Samba daemons and their service definitions. You can inspect their state with:
sudo systemctl status smbd.service nmbd.serviceDo not make the VPS discoverable to every Internet host merely because the service is installed. Network access is controlled separately, and that control is part of the deployment.
Create the share directory and Linux identity
Create a dedicated directory
sudo mkdir -p /srv/samba/private
sudo chown alice:alice /srv/samba/private
sudo chmod 0770 /srv/samba/privateThis example gives the Linux account alice ownership and prevents unauthorised users on the VPS from traversing the directory. If the directory will be shared by a team, use a dedicated Linux group instead of assigning ownership to one person.
Create or verify the Linux account
Samba users must correspond to system accounts. Verify that the account exists:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
id aliceIf it does not, create a service-appropriate account and set a Linux password according to your access policy:
sudo adduser aliceThe Linux password and Samba password are separate credentials. A user can authenticate to Samba only after a Samba password has been added.
Define an authenticated share in smb.conf
Edit the configuration file:
sudo nano /etc/samba/smb.confKeep the existing global settings unless you have a reason to change them, then add a share section like this:
[global]
workgroup = WORKGROUP
security = user
[private]
path = /srv/samba/private
browsable = yes
read only = no
valid users = alice
create mask = 0660
directory mask = 0770What each directive controls
workgroupnames the Windows workgroup for environments that use workgroup browsing. It is not an Internet security boundary.security = userselects standalone user authentication. In standalone mode this is the normal user-security model and requires a valid username and password.pathmaps the share name to the Linux directory. The share will be reached as\server-ipprivate.browsable = yesallows clients that support browsing to display the share. It does not grant permission.read only = nopermits writes at the Samba layer. Linux permissions must also permit the requested operation.valid users = alicelimits the share to the named identity. Every name in this list must exist both as a Linux account and as a Samba account.create maskanddirectory maskconstrain permissions on newly created files and directories. Adjust them to your users and umask policy rather than copying them blindly.
For a read-only share, set read only = yes and make the Linux directory non-writable for the service users. For several users, replace the single account with a group-based design and set group ownership on the directory.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAdd the Samba credential
Add alice to Samba’s account database:
sudo smbpasswd -a aliceEnter the Samba password when prompted. The command fails or produces an unusable account if the Linux user does not already exist. Repeat it for each authorised user; do not share one person’s credential among a team.
To disable a Samba account without deleting the Linux account, use Samba’s account-management commands according to the version installed on the VPS. Remove access from both the share definition and the filesystem when a user should no longer reach the data.
Rank #3
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Set ownership, modes, and ACLs deliberately
Samba’s valid users list is only one layer. The kernel checks the path’s owner, group, mode bits, and any POSIX ACL before allowing an operation.
Single-user share
sudo chown -R alice:alice /srv/samba/private
sudo find /srv/samba/private -type d -exec chmod 0770 {} ;
sudo find /srv/samba/private -type f -exec chmod 0660 {} ;This pattern gives alice full access while keeping files inaccessible to unrelated local users. Review inherited permissions when files are copied into the directory by another process.
Group-based share
sudo groupadd sambashare
sudo usermod -aG sambashare alice
sudo chown -R root:sambashare /srv/samba/private
sudo chmod 2770 /srv/samba/privateThe set-group-ID bit on the directory makes new entries inherit the sambashare group. Add every authorised Linux account to that group, then include those names in valid users or use a group-qualified access rule. Users may need to start a new session before their supplementary group membership is visible.
Use POSIX ACLs for mixed rights
When one user needs read/write access and another needs read-only access, POSIX ACLs provide finer control than a single owner/group mode. Apply the ACLs to the directory and confirm the effective permissions with the system’s ACL inspection tools. Keep the Samba access list and the ACL policy aligned; granting a name in Samba cannot bypass a denying filesystem ACL.
Validate and apply the configuration
Validate the complete configuration with the Samba validation utility installed on the VPS before restarting services:
sudo testparmRead any syntax or permission warnings and correct them before continuing. A successful validation does not prove that every user can write; it confirms that Samba can parse the configuration.
Recommended Free Tools
Rank #4
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Apply changes by restarting the services:
sudo systemctl restart smbd.service nmbd.serviceWhen a change only requires rereading configuration, a reload can reduce disruption:
sudo systemctl reload smbd.serviceUse the service status and system journal if a daemon does not start:
sudo systemctl status smbd.service nmbd.service
sudo journalctl -u smbd.service -u nmbd.service --since "10 minutes ago"Restrict SMB in both firewalls
A public VPS commonly has two independent network controls: the provider’s firewall and the host firewall. Configure both so that only the client networks you trust can reach SMB. A rule in only one layer is not a complete policy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Host firewall example with UFW
Ubuntu’s broad example is sudo ufw allow samba, but that exposes the service to every source permitted by the VPS network. For a known client subnet, restrict the rule instead:
sudo ufw allow from 203.0.113.0/24 to any port 445 proto tcp
sudo ufw status numberedThe address above is a documentation-range example. Replace it with the real office, VPN, or private-network range that should connect. Mirror the same source restriction in the provider firewall. If your clients require legacy NetBIOS browsing, determine whether that is necessary on your private network rather than opening legacy discovery services to the public Internet.
Prefer private connectivity where possible
A private network or VPN keeps SMB off the public interface and usually gives you a narrower, easier-to-audit allowlist. If a public address is unavoidable, permit only the required source ranges, avoid catch-all rules, and review them whenever a user or office network changes.
Best Value
- One Place for All Your Data - Consolidate scattered files from multiple computers, phones and external drives into one accessible hub with 100% ownership
- Professional File Collaboration - Share projects with clients, sync documents across teams and maintain version control without Dropbox fees
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- DIY Surveillance System - Transform IP cameras into a professional monitoring solution with motion alerts, recording schedules and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Connect from Windows, Ubuntu, and macOS
Windows
- Open File Explorer.
- Enter
\server-ipprivatein the address bar, replacingserver-ipwith the VPS address or resolvable hostname. - Provide the Samba username
aliceand the Samba password when prompted. - Confirm that you can create a test file only if the share and Linux permissions are intended to be writable.
Use the server’s IP address for the first test. Name resolution and workgroup browsing introduce separate variables that can obscure a basic connectivity problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Ubuntu or another Linux desktop
In the file manager, choose the network location option and enter an SMB address in the form smb://server-ip/private. Authenticate with the Samba account. A command-line mount can be useful for scripted clients, but store credentials securely and avoid putting a password directly in a shell history.
macOS
In Finder, choose Go then Connect to Server, enter smb://server-ip/private, and authenticate as the Samba user. If the connection works by IP but not by hostname, investigate DNS or local name resolution rather than Samba permissions.
Diagnose the most common failures
| Symptom | Likely layer | Checks and corrective action |
|---|---|---|
| Connection times out | Network path or firewall | Check the VPS provider rule, UFW status, routing, and whether the client source address is in the allowlist. |
| Connection is refused | Service state or listening interface | Inspect systemctl status smbd.service and the journal, then correct configuration errors and restart. |
| Username or password is rejected | Samba identity | Confirm the Linux account exists, run sudo smbpasswd -a username or reset its Samba password, and ensure the name appears in valid users. |
| Share opens but files cannot be read or written | Linux permissions or ACLs | Inspect ownership, mode bits, directory traversal permissions, group membership, and ACLs. Samba settings cannot override a filesystem denial. |
| Share is missing from a browse list | Discovery and naming | Connect directly with the UNC or SMB path. Browsing is optional and can fail even when authenticated access works. |
| Configuration changes have no effect | Unapplied configuration | Run sudo testparm, then reload or restart the relevant service and check its status. |
Guest shares: why the usual example is unsafe on a public VPS
A guest configuration can appear convenient because clients do not enter credentials. Ubuntu’s basic guest example warns that it gives full access to any client on the local network. On an Internet-reachable VPS, the equivalent exposure is substantially broader and is not an acceptable default.
Use named users instead. If a guest share is required for a private lab network, isolate that network, restrict the provider and host firewalls to it, make the directory read-only where possible, and understand that every permitted client receives the same anonymous access.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Operate the VPS as a file server
Updates and change control
Apply operating-system and Samba security updates regularly. Before changing smb.conf, copy the working file, run testparm, and schedule a reload or restart during a suitable maintenance window. Keep a record of which users, groups, directories, and firewall ranges are authorised.
Backups and recovery
RAID or provider snapshots are not a complete backup strategy. Copy important data to a separate destination, retain versions where accidental deletion matters, and periodically restore a representative file and its permissions. Document the Samba configuration, Linux account list, ACLs, and firewall rules so the service can be rebuilt on a replacement VPS.
Storage and capacity
Monitor free space and inode availability on the filesystem containing the share. A full volume can look like a Samba permission or write failure. If you attach another volume, mount it persistently and verify that it is present before Samba starts; otherwise the share path could resolve to an empty directory on the root filesystem.
A repeatable deployment checklist
- Confirm the VPS has persistent storage, a reachable address, and a backup destination.
- Install Samba with
sudo apt install samba. - Create
/srv/samba/privateor another dedicated share path. - Create or verify each Linux account.
- Set ownership, mode bits, and ACLs for the intended users.
- Add each account with
sudo smbpasswd -a username. - Add an authenticated share section to
/etc/samba/smb.conf. - Run
sudo testparmand correct every error or warning you understand before proceeding. - Restart or reload
smbd.serviceand, when used,nmbd.service. - Allow SMB only from trusted source ranges in the provider and host firewalls.
- Test a direct Windows, Linux, or macOS connection with the share path.
- Test both an allowed operation and a denied operation, then verify backups and recovery.
Final security decision
A Samba VPS is practical when clients need familiar SMB access and you can control the network path. The dependable design is an authenticated standalone share, a dedicated /srv directory, matching Linux and Samba identities, explicit filesystem permissions, and firewall rules limited to trusted networks. Treat guest access and unrestricted public SMB exposure as exceptions that require isolation, not as setup shortcuts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
