Samba

Samba 是用於 Linux 和 Unix的標準 Windows 互操作性程序套件。自 1992 年以來，Samba 為所有使用 SMB/CIFS 協議的客戶端提供了安全、穩定和快速的文件和打印服務，例如所有版本的 DOS 和 Windows、OS/2、Linux 和許多其他系統。

要通過 Samba 共享文件，請參閱#伺服器部分；要訪問其他機器上通過 Samba 共享的文件，請參見#客戶端部分。

Latest versions of Samba no longer offer older authentication methods and protocols which are still used by some older clients (IP cameras, etc). These devices usually require Samba server to allow NTMLv1 authentication and NT1 version of the protocol, known as CIFS. For these devices to work with latest Samba, you need to add these two configuration parameters into [global] section:

server min protocol = NT1
ntlm auth = yes

Anonymous/guest access to a share requires just the first parameter. If the old device will access with username and password, you also need the add the second line too.

Enable Spotlight searching[編輯 | 編輯原始碼]

Spotlight allows supporting clients (e.g. MacOS Finder) to quickly search shared files.

Install and start/enable OpenSearch. Install fs2es-indexer^AUR, configure the directories you want to index in /etc/fs2es-indexer/config.yml, and start/enable fs2es-indexer.service for periodic indexing.

Edit smb.conf as described in the Samba wiki to enable Spotlight per share, and restart smb.service to apply the changes.

客戶端配置[編輯 | 編輯原始碼]

要使用類似 ftp 的命令行界面，請安裝軟件包 smbclient^包。常用命令請參考 smbclient(1)。

如需更輕量級的替代品（沒有可用共享查詢等功能），可安裝 cifs-utils^包，其提供了 /usr/bin/mount.cifs。

部分桌面環境可能提供了圖形界面，搭配文件管理器的用法請參考#文件管理器配置。

注意：

smbclient^包 requires a /etc/samba/smb.conf file (see #Installation), which you can create as an empty file using the touch utility.
安裝 cifs-utils^包或 smbclient^包後，請加載 cifs 內核模塊或重啟以避免掛載失敗。

顯示可用共享[編輯 | 編輯原始碼]

下面命令會顯示伺服器上的可用共享:

$ smbclient -L hostname -U%

smbtree 可用顯示共享目錄樹，不建議再有大量計算機的網絡上使用此功能。可用它檢查共享名是否可用。

另外，使用 $ smbtree -N 會以樹狀圖顯示所有可用共享，它使用了廣播查詢，因此不建議在有大量設備的網絡中使用，但有助於檢查共享名是否可用。使用 -N（-no-pass）選項可以忽略密碼輸入請求。

注意： smbtree 使用了 SMB1 和 NetBIOS，意味着它們必須已在伺服器上啟用，且需要在客戶端的 smb.conf 文件中設置 client min protocol = NT1，否則 smbtree 只會顯示空輸出。

NetBIOS/WINS 主機名[編輯 | 編輯原始碼]

Samba clients handle NetBIOS host names automatically by default (the behavior is controlled by the name resolve order option in smb.conf). Other programs (including mount.cifs) typically use Name Service Switch, which does not handle NetBIOS by default.

The smbclient^包 package provides a libnss driver to resolve NetBIOS host names. To use it, install it along with the samba^包 package (which provides the winbindd daemon), start/enable winbind.service and add wins to the hosts line in nsswitch.conf(5):

/etc/nsswitch.conf

...
hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns wins
...

注意： Due to a current mistake in winbind.service, you may have to modify the unit file as described in this bug-report

Now, during host resolving (e.g. when using mount.cifs or just ping netbios-name), winbindd will resolve the host name by sending queries using NetBIOS Name Service (NBNS, also known as WINS) protocol.

By default it sends a broadcast query to your local network. If you have a WINS server, you can add wins server = wins-server-ip to smb.conf and restart winbind.service, then winbindd and other Samba clients will send unicast queries to the specified IP.

If you want to resolve your local host name (specified in the netbios name option in smb.conf), start/enable nmb.service, which will handle incoming queries.

You can test WINS resolution with nmblookup. By default it sends broadcast queries to your local network regardless of the wins server option.

Note that WINS resolution requires incoming traffic originating from port 137.

Disable NetBIOS/WINS support[編輯 | 編輯原始碼]

When not using NetBIOS/WINS host name resolution, it may be preferred to disable this protocol:

/etc/samba/smb.conf

[global]
  disable netbios = yes
  dns proxy = no

Finally disable/stop winbind.service.

手動掛載[編輯 | 編輯原始碼]

使用 mount.cifs 作為掛載類型 type，下面列出的選項並不是全部都需要：

# mount --mkdir -t cifs //SERVER/sharename /mnt/mountpoint -o username=username,password=password,workgroup=workgroup,iocharset=utf8,uid=username,gid=group

其中 uid 和 gid 對應了被授予特定路徑讀寫權限的本地（例如客戶端）用戶/用戶組。

注意：

If the uid and gid being used does not match the user of the server, the forceuid and forcegid options may be helpful. However note permissions assigned to a file when forceuid or forcegid are in effect may not reflect the real (server) permissions. See the File And Directory Ownership And Permissions section in mount.cifs(8) § FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS for more information.
To mount a Windows share without authentication, use "username=*".

本文或本章節的事實準確性存在爭議。

原因： Regardless of recommendation, there's no substantial evidence for the claimed I/O error risk. The warning was added without comment or reference in 2013 and challenged without defense in 2018. It's unclear whether it's true at all.（在 Talk:Samba#Unfounded warning regarding I/O errors and manual mounting? 中討論）

注意： 請注意這裏有 s,其它文件系統一般用的是 user。

使用 uid 和 gid 掛載選項時，請注意文件權限，否则会出现 I/O 错误。}}

注意： 使用 uid 和/或 gid 作為掛載選項可能會導致 I/O 錯誤，建議轉而設置並檢查文件權限與屬性。

SERVER — 伺服器名稱
sharename — 共享目錄
mountpoint — 本地掛載點
[-o options] — 詳情請參考 {{man|8|mount.cifs}。

注意：

結尾不要加 /. //SERVER/sharename/ 無法工作.
如果掛載工作不穩定，出現卡頓和掉線問題，請嘗試用 vers= 設置不同的 SMB 協議版本。例如，掛載 Vista 用 vers=2.0。
如果掛載了 cifs 的機器上出現關機超時，請參考 wpa_supplicant#Problem with mounted network shares (cifs) and shutdown。

保存共享密碼[編輯 | 編輯原始碼]

不建議將密碼保存在所有人都可讀的文件中，一個更安全的方式是創建憑證文件，例如寫入到 /etc/samba/credentials：

/etc/samba/credentials/share

username=myuser
password=mypass

將掛載命令中的 username=myuser,password=mypass 替換為 credentials=/etc/samba/credentials/share。

應僅根用戶允許有憑證文件的讀寫權限：

# chown root:root /etc/samba/credentials
# chmod 700 /etc/samba/credentials
# chmod 600 /etc/samba/credentials/share

自動掛載[編輯 | 編輯原始碼]

注意： You may need to enable systemd-networkd-wait-online.service or NetworkManager-wait-online.service (depending on your setup) to proper enable booting on start-up.

Using NetworkManager and GIO/gvfs[編輯 | 編輯原始碼]

NetworkManager can be configured to run a script on network status change. This script uses the gio command so that it mounts the Samba shares automatically, the same way your file manager does, as explained below. The script also safely unmounts the Samba shares before the relevant network connection is disabled by listening for the pre-down and vpn-pre-down events. Make the script is executable after creating it.

/etc/NetworkManager/dispatcher.d/30-samba.sh

#!/bin/sh

# Find the connection UUID with "nmcli con show" in terminal.
# All NetworkManager connection types are supported: wireless, VPN, wired...
WANTED_CON_UUID="CHANGE-ME-NOW-9c7eff15-010a-4b1c-a786-9b4efa218ba9"

# The user the share will be mounted under
USER="yourusername"
# The path that appears in your file manager when you manually mount the share you want
SMB_URL="smb://servername/share"

# Get runtime user directory. If it does not exist, do nothing and just exit
XDG_RUNTIME_DIR=$(loginctl show-user --property=RuntimePath --value "$USER") || exit 0

if [ "$CONNECTION_UUID" = "$WANTED_CON_UUID" ]; then
    
    # Script parameter $1: network interface name, not used
    # Script parameter $2: dispatched event
    
    case "$2" in
        "up"|"vpn-up")
            su $USER -c "DBUS_SESSION_BUS_ADDRESS=unix:path=$XDG_RUNTIME_DIR/bus gio mount $SMB_URL"
            ;;
        "pre-down"|"vpn-pre-down")
            su $USER -c "DBUS_SESSION_BUS_ADDRESS=unix:path=$XDG_RUNTIME_DIR/bus gio mount -uf $SMB_URL"
            ;;
    esac
fi

Create a symlink inside /etc/NetworkManager/dispatcher.d/pre-down to catch the pre-down events:

# ln -s /etc/NetworkManager/dispatcher.d/30-samba.sh /etc/NetworkManager/dispatcher.d/pre-down.d/30-samba.sh

注意： Since this script uses the user bus, it will only work if the user has active sessions. This means that the share will not mount automatically after boot if the connection is established before you are logged in.

作為掛載路徑[編輯 | 編輯原始碼]

This is a simple example of a cifs mount entry that requires authentication:

/etc/fstab

//SERVER/sharename /mnt/mountpoint cifs _netdev,nofail,username=myuser,password=mypass 0 0

注意：

See examples below on better security for authentication credentials
Spaces in sharename should be replaced by \040 (ASCII code for space in octal). For example, //SERVER/share name on the command line should be //SERVER/share\040name in /etc/fstab.
To allow users to mount it as long as the mount point resides in a directory controllable by the user; i.e. the user's home, append the users mount option. The option is users (plural). For other filesystem types handled by mount, this option is usually user; sans the "s".

提示：Use x-systemd.automount if you want them to be mounted only upon access. See Fstab#Remote file system for details.

作為 systemd 單元[編輯 | 編輯原始碼]

在 /etc/systemd/system 下創建一個新的 .mount 文件，例如：mnt-myshare.mount。詳細信息請查看 systemd.mount(5)。

注意： 請確保文件名與你要使用的掛載點對應。例如 mnt-myshare.mount 只能用於掛載位於 /mnt/myshare 下的共享，否則可能會出現像這樣的報錯：systemd[1]: mnt-myshare.mount: Where= setting does not match unit name. Refusing。

What= 要使用的共享路徑

Where= 將共享掛載到的位置

Options= 共享掛載選項

注意：

網絡掛載單元會自動獲取 remote-fs-pre.target、network.target 和 network-online.target 中 After 部分的依賴，並在沒有設置 nofail 掛載選項的情況下會獲得對 remote-fs.target 的 Before 依賴。對於後者，還會添加一個 Wants 單元。
將 noauto 添加到 Options 可以防止在啟動階段自動掛載（除非被其它單元拉起）。
如果你想用主機名而不是 IP 來連接共享伺服器，需要在 After 中加入 nss-lookup.target。這可以避免在測試時正常，但啟動時掛載報錯的情況出現。

/etc/systemd/system/mnt-myshare.mount

[Unit]
Description=Mount Share at boot

[Mount]
What=//server/share
Where=/mnt/myshare
Options=_netdev,credentials=/etc/samba/credentials/myshare,iocharset=utf8,rw
Type=cifs
TimeoutSec=30

[Install]
WantedBy=multi-user.target

提示：

遇到無法連通的主機時，將 ForceUnmount=true 添加到 [Mount] 以允許強制卸載共享。
如果你的共享使用了只讀權限的組，可以添加 uid=username 或者 gid=group 到 Options= 來指定擁有寫入權限的用戶/用戶組。

要使用 mnt-myshare.mount，需啟動該單元，然後通過啟用使其在系統啟動時運行。

自動化掛載[編輯 | 編輯原始碼]

可以使用如下單元來在訪問時自動掛載共享（類似 autofs）：

/etc/systemd/system/mnt-myshare.automount

[Unit]
Description=Automount myshare

[Automount]
Where=/mnt/myshare

[Install]
WantedBy=multi-user.target

禁用/停止 mnt-myshare.mount，然後啟用/啟動 mnt-myshare.automount 來在訪問掛載路徑時自動掛載共享。

提示：添加 TimeoutIdleSec 以啟用自動掛載。詳細信息可參考 systemd.automount(5)。

smbnetfs[編輯 | 編輯原始碼]

注意： smbnetfs needs an intact Samba server setup. See above on how to do that.

First, check if you can see all the shares you are interested in mounting:

$ smbtree -U remote_user

If that does not work, find and modify the following line in /etc/samba/smb.conf accordingly:

domain master = auto

Now restart smb.service and nmb.service.

If everything works as expected, install smbnetfs^包.

Then, add the following line to /etc/fuse.conf:

user_allow_other

Now copy the directory /etc/smbnetfs/.smb to your home directory:

$ cp -a /etc/smbnetfs/.smb ~

Then create a link to smb.conf:

$ ln -sf /etc/samba/smb.conf ~/.smb/smb.conf

If a username and a password are required to access some of the shared folders, edit ~/.smb/smbnetfs.auth to include one or more entries like this:

~/.smb/smbnetfs.auth

auth			"hostname" "username" "password"

It is also possible to add entries for specific hosts to be mounted by smbnetfs, if necessary. More details can be found in ~/.smb/smbnetfs.conf.

If you are using the Dolphin or GNOME Files, you may want to add the following to ~/.smb/smbnetfs.conf to avoid "Disk full" errors as smbnetfs by default will report 0 bytes of free space:

~/.smb/smbnetfs.conf

free_space_size 1073741824

When you are done with the configuration, you need to run

$ chmod 600 ~/.smb/smbnetfs.*

Otherwise, smbnetfs complains about 'insecure config file permissions'.

Finally, to mount your Samba network neighbourhood to a directory of your choice, call

$ smbnetfs mount_point

Daemon[編輯 | 編輯原始碼]

The Arch Linux package also maintains an additional system-wide operation mode for smbnetfs. To enable it, you need to make the said modifications in the directory /etc/smbnetfs/.smb.

Then, you can start and/or enable the smbnetfs daemon as usual. The system-wide mount point is at /mnt/smbnet/.

autofs[編輯 | 編輯原始碼]

See Autofs for information on the kernel-based automounter for Linux.

文件管理器配置[編輯 | 編輯原始碼]

GNOME Files、Nemo、Caja、Thunar 和 PCManFM[編輯 | 編輯原始碼]

為了通過 GNOME Files，Nemo，Caja，Thunar 或 PCManFM 訪問 samba 共享，需安裝 gvfs-smb^包軟件包。

按 Ctrl+l 然後在地址欄輸入 smb://servername/share 以訪問您的共享。

共享很可能掛載到了文件系統中的 /run/user/your_UID/gvfs 或 ~/.gvfs 位置下。

KDE[編輯 | 編輯原始碼]

KDE 有內建的瀏覽 Samba 共享的能力。為了使用 KDE 系統設置的 GUI，你需要安裝 kdenetwork-filesharing^包軟件包。

KDE 應用（例如 Dolphin）自帶 Samba 共享瀏覽功能。在地址欄輸入 smb://servername/share就可以瀏覽文件。如果你想在非 KDE 應用訪問文件，可以安裝 kio-fuse^包。

To use a GUI in the KDE System Settings, you will need to install the kdenetwork-filesharing^包 package.

其它圖形環境[編輯 | 編輯原始碼]

There are a number of useful programs, but they may need to have packages created for them. This can be done with the Arch package build system. The good thing about these others is that they do not require a particular environment to be installed to support them, and so they bring along less baggage.

pyneighborhood^AUR
LinNeighborhood, RUmba, xffm-samba plugin for Xffm are not available in the official repositories or the AUR. As they are not officially (or even unofficially supported), they may be obsolete and may not work at all.

提示與技巧[編輯 | 編輯原始碼]

Discovering network shares[編輯 | 編輯原始碼]

If nothing is known about other systems on the local network, and automated tools such as smbnetfs are not available, you can manually probe for Samba shares.

First, install the nmap^包 and smbclient^包 packages.

Use nmap to scan your local network to find systems with TCP port 445 open, which is the port used by the SMB protocol. Note that you may need to use -Pn or set a custom ping scan type (e.g. -PS445) because Windows systems are usually firewalled.

$ nmap -p 445 "192.168.1.*"

Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-13 12:00 UTC
Nmap scan report for 192.168.1.1
Host is up (0.0011s latency).

PORT    STATE  SERVICE
445/tcp open  microsoft-ds

Nmap scan report for 192.168.1.2
Host is up (0.00011s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap done: 256 IP addresses (2 hosts up) scanned in 2.45 seconds

The first result is another system; the second happens to be the client from where this scan was performed.

Now you can connect to their IP addresses directly, but if you want to use NetBIOS host names, you can use nmblookup(1) to check for NetBIOS names. Note that this will not work if NetBIOS is disabled on the server.

$ nmblookup -A 192.168.1.1

Looking up status of 192.168.1.1
        PUTER           <00> -         B <ACTIVE>
        HOMENET         <00> - <GROUP> B <ACTIVE>
        PUTER           <03> -         B <ACTIVE>
        PUTER           <20> -         B <ACTIVE>
        HOMENET         <1e> - <GROUP> B <ACTIVE>
        USERNAME        <03> -         B <ACTIVE>
        HOMENET         <1d> -         B <ACTIVE>
        MSBROWSE        <01> - <GROUP> B <ACTIVE>

Regardless of the output, look for <20>, which shows the host with open services.

Use smbclient(1) to list which services are shared on these systems. You can use NetBIOS host name (PUTER in this example) instead of IP when available. If prompted for a password, pressing enter should still display the list:

$ smbclient -L \\192.168.1.1

Sharename       Type      Comment
---------       ----      -------
MY_MUSIC        Disk
SHAREDDOCS      Disk
PRINTER$        Disk
PRINTER         Printer
IPC$            IPC       Remote Inter Process Communication

Server               Comment
---------            -------
PUTER

Workgroup            Master
---------            -------
HOMENET               PUTER

Remote control of Windows computer[編輯 | 編輯原始碼]

Samba offers a set of tools for communication with Windows. These can be handy if access to a Windows computer through remote desktop is not an option, as shown by some examples.

Send shutdown command with a comment:

$ net rpc shutdown -C "comment" -I IPADDRESS -U USERNAME%PASSWORD

A forced shutdown instead can be invoked by changing -C with comment to a single -f. For a restart, only add -r, followed by a -C or -f.

Stop and start services:

$ net rpc service stop SERVICENAME -I IPADDRESS -U USERNAME%PASSWORD

To see all possible net rpc command:

$ net rpc

疑難解答[編輯 | 編輯原始碼]

啟動 Samba SMB/CIFS 伺服器失敗[編輯 | 編輯原始碼]

可能的解決方法：

通過 testparm(1) 檢查 smb.conf 中的配置問題。
在 /var/cache/samba/ 中配置正確的權限，然後重啟 smb.service：

# chmod 0755 /var/cache/samba/msg

SELinux 權限問題[編輯 | 編輯原始碼]

SELinux 默認不允許 samba 訪問用戶的主目錄。要解決此問題，執行：

# setsebool -P samba_enable_home_dirs 1

類似地，samba_export_all_ro 和 samba_export_all_rw 使 Samba 擁有讀取或「讀和寫」所有文件的能力。

AppArmor 權限問題[編輯 | 編輯原始碼]

如果使用了一個在家目錄或用戶共享目錄之外的共享路徑，請在 /etc/apparmor.d/local/usr.sbin.smbd 中將其加入白名單。例如：

/etc/apparmor.d/local/usr.sbin.smbd

"/data/" rk,
"/data/**" lrwk,

No dialect specified on mount[編輯 | 編輯原始碼]

The client is using an unsupported SMB/CIFS version that is required by the server.

See #Restrict protocols for better security for more information.

Unable to overwrite files, permissions errors[編輯 | 編輯原始碼]

本文或本章節的事實準確性存在爭議。

原因： An user should set/check for server/client permissions, instead of using incorrect/possible insecure flags.（在 Talk:Samba 中討論）

Possible solutions:

Append the mount option nodfs to the /etc/fstab entry.
Add msdfs root = no to the [global] section of the server's /etc/samba/smb.conf.

Windows clients keep asking for password even if Samba shares are created with guest permissions[編輯 | 編輯原始碼]

Set map to guest inside the global section of /etc/samba/smb.conf:

map to guest = Bad Password

If you are still using Samba < 4.10.10, use Bad User instead of Bad Password.

Windows 10 1709 和更高版本的連接性問題 - "Windows cannot access" 0x80004005[編輯 | 編輯原始碼]

This error affects some machines running Windows 10 version 1709 and later. It is not related to SMB1 being disabled in this version but to the fact that Microsoft disabled insecure logons for guests on this version for some, but not others.

To fix, open Group Policy Editor (gpedit.msc). Navigate to Computer configuration\administrative templates\network\Lanman Workstation > Enable insecure guest logons and enable it. Alternatively,change the following value in the registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"AllowInsecureGuestAuth"=dword:1

Error: Failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL[編輯 | 編輯原始碼]

If you are a home user and using samba purely for file sharing from a server or NAS, you are probably not interested in sharing printers through it. If so, you can prevent this error from occurring by adding the following lines to your /etc/samba/smb.conf:

/etc/samba/smb.conf

[global]
  load printers = No
  printing = bsd
  printcap name = /dev/null
  disable spoolss = Yes

Restart the samba service, smb.service, and then check your logs:

# cat /var/log/samba/smbd.log

and the error should now no longer be appearing.

Sharing a folder fails[編輯 | 編輯原始碼]

It means that while you are sharing a folder from Dolphin (file manager) and everything seems ok at first, after restarting Dolphin the share icon is gone from the shared folder, and also some output like this in terminal (Konsole) output:

‘net usershare’ returned error 255: net usershare: usershares are currently disabled

To fix it, enable usershare as described in #啟用 Usershares.

"Browsing" network fails with "Failed to retrieve share list from server"[編輯 | 編輯原始碼]

And you are using a firewall (iptables) because you do not trust your local (school, university, hotel) network. This may be due to the following: When the smbclient is browsing the local network it sends out a broadcast request on udp port 137. The servers on the network then reply to your client but as the source address of this reply is different from the destination address iptables saw when sending the request for the listing out, iptables will not recognize the reply as being "ESTABLISHED" or "RELATED", and hence the packet is dropped. A possible solution is to add:

iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns

to your iptables setup.

For Uncomplicated Firewall, you need to add nf_conntrack_netbios_ns to the end of the following line in /etc/default/ufw

IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_irc nf_nat_irc"

and then run the following commands as root:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper
ufw allow CIFS
ufw reload

To make this change persistent across reboots, add the following line at the end of /etc/ufw/sysctl.conf:

net.netfilter.nf_conntrack_helper=1

Protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE[編輯 | 編輯原始碼]

The client probably does not have access to shares. Make sure clients' IP address is in hosts allow = line in /etc/samba/smb.conf.

Another problem could be, that the client uses an invalid protocol version. To check this try to connect with the smbclient where you specify the maximum protocol version manually:

$ smbclient -U <user name> -L //<server name> -m <protocol version: e. g. SMB2> -W <domain name>

If the command was successful then create a configuration file:

~/.smb/smb.conf

[global]
  workgroup = <domain name>
  client max protocol = SMB2

Connection to SERVER failed: (Error NT_STATUS_UNSUCCESSFUL)[編輯 | 編輯原始碼]

You are probably passing a wrong server name to smbclient. To find out the server name, run hostnamectl on the server and look at "Transient hostname" line

Connection to SERVER failed: (Error NT_STATUS_CONNECTION_REFUSED)[編輯 | 編輯原始碼]

Make sure that the server has started. The shared directories should exist and be accessible.

Protocol negotiation failed: NT_STATUS_CONNECTION_RESET[編輯 | 編輯原始碼]

Probably the server is configured not to accept protocol SMB1. Add option client max protocol = SMB2 in /etc/samba/smb.conf. Or just pass argument -m SMB2 to smbclient.

Password Error when correct credentials are given (error 1326)[編輯 | 編輯原始碼]

Samba 4.5 has NTLMv1 authentication disabled by default. It is recommend to install the latest available upgrades on clients and deny access for unsupported clients.

If you still need support for very old clients without NTLMv2 support (e.g. Windows XP), it is possible force enable NTLMv1, although this is not recommend for security reasons:

/etc/samba/smb.conf

[global]
  lanman auth = yes
  ntlm auth = yes

If NTLMv2 clients are unable to authenticate when NTLMv1 has been enabled, create the following file on the client:

/home/user/.smb/smb.conf

[global]
  sec = ntlmv2
  client ntlmv2 auth = yes

This change also affects samba shares mounted with mount.cifs. If after upgrade to Samba 4.5 your mount fails, add the sec=ntlmssp option to your mount command, e.g.

mount.cifs //server/share /mnt/point -o sec=ntlmssp,...

See the mount.cifs(8) man page: ntlmssp - Use NTLMv2 password hashing encapsulated in Raw NTLMSSP message. The default in mainline kernel versions prior to v3.8 was sec=ntlm. In v3.8, the default was changed to sec=ntlmssp.

Mapping reserved Windows characters[編輯 | 編輯原始碼]

Starting with kernel 3.18, the cifs module uses the "mapposix" option by default. When mounting a share using unix extensions and a default Samba configuration, files and directories containing one of the seven reserved Windows characters : \ * < > ? are listed but cannot be accessed.

Possible solutions are:

Use the undocumented nomapposix mount option for cifs

# mount.cifs //server/share /mnt/point -o nomapposix

Configure Samba to remap mapposix ("SFM", Services for Mac) style characters to the correct native ones using fruit

/etc/samba/smb.conf

[global]
  vfs objects = catia fruit
  fruit:encoding = native

Manually remap forbidden characters using catia

/etc/samba/smb.conf

[global]
  vfs objects = catia
  catia:mappings = 0x22:0xf022, 0x2a:0xf02a, 0x2f:0xf02f, 0x3a:0xf03a, 0x3c:0xf03c, 0x3e:0xf03e, 0x3f:0xf03f, 0x5c:0xf05c, 0x7c:0xf07c, 0x20:0xf020

The latter approach (using catia or fruit) has the drawback of filtering files with unprintable characters.

Folder shared inside graphical environment is not available to guests[編輯 | 編輯原始碼]

This section presupposes:

Usershares are configured following previous section
A shared folder has been created as a non-root user from GUI
Guests access has been set to shared folder during creation
Samba service has been restarted at least once since last /etc/samba/smb.conf file modification

For clarification purpose only, in the following sub-sections is assumed:

Shared folder is located inside user home directory path (/home/yourUser/Shared)
Shared folder name is MySharedFiles
Guest access is read-only.
Windows users will access shared folder content without login prompt

Verify correct samba configuration[編輯 | 編輯原始碼]

Run the following command from a terminal to test configuration file correctness:

$ testparm

Verify correct shared folder creation[編輯 | 編輯原始碼]

Run the following commands from a terminal:

$ cd /var/lib/samba/usershares
$ ls

If everything is fine, you will notice a file named mysharedfiles

Read the file contents using the following command:

$ cat mysharedfiles

The terminal output should display something like this:

/var/lib/samba/usershares/mysharedfiles

path=/home/yourUser/Shared
comment=
usershare_acl=S-1-1-0:r
guest_ok=y
sharename=MySharedFiles

Verify folder access by guest[編輯 | 編輯原始碼]

Run the following command from a terminal. If prompted for a password, just press Enter:

$ smbclient -L localhost

If everything is fine, MySharedFiles should be displayed under Sharename column

Run the following command in order to access the shared folder as guest (anonymous login)

$ smbclient -N //localhost/MySharedFiles

If everything is fine samba client prompt will be displayed:

smb: \>

From samba prompt verify guest can list directory contents:

smb: \> ls

If the NTFS_STATUS_ACCESS_DENIED error is displayed, the issue is likely to be with Unix directory permissions. Ensure that your samba user has access to the folder and all parent folders. You can test this by sudoing to the user and attempting to list the mount directory, and all of its parents.

Mount error: Host is down[編輯 | 編輯原始碼]

This error might be seen when mounting shares of Synology NAS servers. Use the mount option vers=1.0 to solve it.

Template:主要

Software caused connection abort[編輯 | 編輯原始碼]

File managers that utilizes gvfs-smb^包 can show the error Software caused connection abort when writing a file to a share/server. This may be due to the server running SMB/CIFS version 1, which many routers use for USB drive sharing (e.g. Belkin routers). To write to these shares specify the CIFS version with the option vers=1.0. E.g.:

/etc/fstab

//SERVER/sharename /mnt/mountpoint cifs _netdev,guest,file_mode=0777,dir_mode=0777,vers=1.0 0 0

This can also happen after updating Samba to version 4.11, which deactivates SMB1 as default, and accessing any Samba share. You can reenable it by adding

/etc/samba/smb.conf

[global]
client min protocol = CORE

Connection problem (due to authentification error)[編輯 | 編輯原始碼]

Be sure that you do not leave any space characters before your username in Samba client configuration file as follows:

~/.samba

username= user
password=pass

The correct format is:

~/.samba

username=user
password=pass

Windows 1709 及更高版本無法在「網絡」視圖中發現 Samba 伺服器[編輯 | 編輯原始碼]

隨着 Windows 10 1511 版本的推出，對 SMBv1 的支持以及由此的 NetBIOS 設備發現被默認禁用。根據實際版本不同，從1709版本（"秋季創意者更新"）開始的 Windows 版本不允許再安裝 SMBv1 客戶端。這導致運行 Samba 的主機無法在資源管理器的「網絡（網上鄰居）」視圖中被列出。雖然並無連接問題，而且 Samba 仍然可以正常運行，但用戶可能想讓他們的 Samba 主機被 Windows 自動列出。wsdd^AUR 實現了一個 Web Service Discovery 宿主守護進程。這使得（Samba）主機，比方說你的本地 NAS 設備，能夠被像 Windows 這樣的 Web Service Discovery 客戶端找到。默認設置應該適用於大多數用例，你要做的就是啟用 wsdd.service。

默認配置（在組 "WORKGROUP "中使用機器主機名公示自己）應適用於絕大多數情況。如果有需要，你可以通過在 /etc/conf.d/wsdd 中添加額外的參數來改變配置選項（詳見wsdd的手冊頁）。

wsdd2^AUR 的功能相同，但它是用 C 語言而不是 Python 編寫的。默認情況下，它將在 smb.conf 中尋找 netbios name 和 workgroup 值。

GNOME Files not showing Windows machines (version 1709 or up) with shared folders in Network view[編輯 | 編輯原始碼]

See GNOME/Files#Windows machines (version 1709 or up) with shared folders don't show up in Network view.

iOS/iPadOS Files can no longer copy-to Samba share on Arch Linux beginning with iOS/iPadOS 14.5[編輯 | 編輯原始碼]

Beginning with iOS/iPadOS 14.5 attempting to transfer from a device running iOS/iPadOS using the "Files" app to a samba share on Arch Linux will result in the error:

The operation couldn't be completed
Operation canceled

To correct this problem, add add the following to the global section of your smb.conf and restart smb.service. Comment optional:

## addition for iOS/iPadOS 14.5+ Files transfer-to server
vfs object = fruit streams_xattr

See https://apple.stackexchange.com/q/424681 Apple.Stackexchange.com - "The operation couldn't be completed"/"Operation canceled" error message when saving to a Samba share via Files app.

Slow initial connections from certain clients without other performance problems[編輯 | 編輯原始碼]

Some SMB clients, such as Solid Explorer for Android, take significantly longer to connect to Samba if they fail to resolve the NetBIOS name. Enabling nmb.service will greatly speed up initial connections if this is the case. Since this is a bug in the client software, please report such cases to the authors of conflicting software.

伺服器[編輯 | 編輯原始碼]

安裝[編輯 | 編輯原始碼]

啟用並啟動服務[編輯 | 編輯原始碼]

使伺服器可被發現[編輯 | 編輯原始碼]

配置防火牆[編輯 | 編輯原始碼]

UFW 規則[編輯 | 編輯原始碼]

firewalld 服務[編輯 | 編輯原始碼]

基礎配置[編輯 | 編輯原始碼]

用戶管理[編輯 | 編輯原始碼]

添加用戶[編輯 | 編輯原始碼]

查詢用戶[編輯 | 編輯原始碼]

更改 samba 用戶的密碼[編輯 | 編輯原始碼]

創建匿名共享[編輯 | 編輯原始碼]

高級配置[編輯 | 編輯原始碼]

Enable symlink following[編輯 | 編輯原始碼]

為 macOS 客戶端啟用服務端複製[編輯 | 編輯原始碼]

啟用 Usershare[編輯 | 編輯原始碼]

設置並強制應用權限[編輯 | 編輯原始碼]

限制協議以增強安全性[編輯 | 編輯原始碼]

使用原生 SMB 傳輸加密[編輯 | 編輯原始碼]

禁用打印機共享[編輯 | 編輯原始碼]

防止 Samba 共享特定後綴的文件[編輯 | 編輯原始碼]

提高吞吐量[編輯 | 編輯原始碼]

Enable access for old clients/devices[編輯 | 編輯原始碼]

Enable Spotlight searching[編輯 | 編輯原始碼]

客戶端配置[編輯 | 編輯原始碼]

顯示可用共享[編輯 | 編輯原始碼]

NetBIOS/WINS 主機名[編輯 | 編輯原始碼]

Disable NetBIOS/WINS support[編輯 | 編輯原始碼]

手動掛載[編輯 | 編輯原始碼]

保存共享密碼[編輯 | 編輯原始碼]

自動掛載[編輯 | 編輯原始碼]

Using NetworkManager and GIO/gvfs[編輯 | 編輯原始碼]

作為掛載路徑[編輯 | 編輯原始碼]

作為 systemd 單元[編輯 | 編輯原始碼]

自動化掛載[編輯 | 編輯原始碼]

smbnetfs[編輯 | 編輯原始碼]

Daemon[編輯 | 編輯原始碼]

autofs[編輯 | 編輯原始碼]

文件管理器配置[編輯 | 編輯原始碼]

GNOME Files、Nemo、Caja、Thunar 和 PCManFM[編輯 | 編輯原始碼]

KDE[編輯 | 編輯原始碼]

其它圖形環境[編輯 | 編輯原始碼]

提示與技巧[編輯 | 編輯原始碼]

Discovering network shares[編輯 | 編輯原始碼]

Remote control of Windows computer[編輯 | 編輯原始碼]

疑難解答[編輯 | 編輯原始碼]

啟動 Samba SMB/CIFS 伺服器失敗[編輯 | 編輯原始碼]

SELinux 權限問題[編輯 | 編輯原始碼]

AppArmor 權限問題[編輯 | 編輯原始碼]

No dialect specified on mount[編輯 | 編輯原始碼]

Unable to overwrite files, permissions errors[編輯 | 編輯原始碼]

Windows clients keep asking for password even if Samba shares are created with guest permissions[編輯 | 編輯原始碼]

Windows 10 1709 和更高版本的連接性問題 - "Windows cannot access" 0x80004005[編輯 | 編輯原始碼]

Error: Failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL[編輯 | 編輯原始碼]

Sharing a folder fails[編輯 | 編輯原始碼]

"Browsing" network fails with "Failed to retrieve share list from server"[編輯 | 編輯原始碼]

Protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE[編輯 | 編輯原始碼]

Connection to SERVER failed: (Error NT_STATUS_UNSUCCESSFUL)[編輯 | 編輯原始碼]

Connection to SERVER failed: (Error NT_STATUS_CONNECTION_REFUSED)[編輯 | 編輯原始碼]

Protocol negotiation failed: NT_STATUS_CONNECTION_RESET[編輯 | 編輯原始碼]

Password Error when correct credentials are given (error 1326)[編輯 | 編輯原始碼]

Mapping reserved Windows characters[編輯 | 編輯原始碼]

Folder shared inside graphical environment is not available to guests[編輯 | 編輯原始碼]

Verify correct samba configuration[編輯 | 編輯原始碼]

Verify correct shared folder creation[編輯 | 編輯原始碼]

Verify folder access by guest[編輯 | 編輯原始碼]

Mount error: Host is down[編輯 | 編輯原始碼]

Software caused connection abort[編輯 | 編輯原始碼]

Connection problem (due to authentification error)[編輯 | 編輯原始碼]

Windows 1709 及更高版本無法在「網絡」視圖中發現 Samba 伺服器[編輯 | 編輯原始碼]

GNOME Files not showing Windows machines (version 1709 or up) with shared folders in Network view[編輯 | 編輯原始碼]

iOS/iPadOS Files can no longer copy-to Samba share on Arch Linux beginning with iOS/iPadOS 14.5[編輯 | 編輯原始碼]

Slow initial connections from certain clients without other performance problems[編輯 | 編輯原始碼]

更多參考[編輯 | 編輯原始碼]