Share a Directory with Samba on Debian 13 (Public/Private)

Every time I need to allow access to a Samba directory after reinstalling my Debian system, I follow another tutorial.

I always forget from one time to the next because it can be three years between reboots.

So here's my tutorial, for me and for you, as it will certainly come in handy.

I'll update this tutorial as new Debian versions are released, both for myself and for you.

Our goals today:

• Mount the /mnt/DATA/ directory at boot using disks, the graphical application
• Install Samba
• Configure Samba for a public share accessible in read-only mode (/mnt/DATA/Public)
• Configure Samba for a private share with authentication for read/write access (/mnt/DATA)

1. Before You Start

It's preferable to be in the sudoers list, but it's not mandatory; you can do this as a superuser (using the su command).

I should note that connecting with su is a bad habit I have too often.

2. Verifications

To avoid any confusion, let's check these elements:

• Verify that the public directory exists and has the correct permissions.
• Do the same for the private directory.
• Check if your private user account exists.

Here is the output we obtained in our case:

2. Automatic Mounting

Mounting makes your volume, USB key, or hard drive visible and accessible to the system.

On Linux, depending on distributions, and for security reasons, it's not automatic like on Windows.

Here, in our case, we want it to be.

Back then, I used to edit /etc/fstab until I got the automatic mounting working. It’s a matter of syntax, but with my dyslexia, I often missed things.

In fact, Disks is much more practical for me; you can find it in your GNOME applications:

Once in Disks, you can configure something like this:

The idea is to have automatic mounting and a name that corresponds to what we want.

Let's verify again:

3. Installation of Samba

It’s quite simple: update the system, then use apt to install it:

Check that everything is in place:

4. Writing our smb.conf

4.1. Backup the Original File

Just in case we make a mistake, let's back it up:

For a rollback if needed:

4.2. Writing our smb.conf

Here’s the content we’ll use to replace the original file, with additions and adjustments tailored to our needs:

Key points:

• map to guest = Bad User: an unknown or empty login falls back to a guest account (nobody).
• access based share enum = yes + valid users = stunivers on [DATA]: without logging in, the client should only see [Public].
• force user = stunivers: files created via SMB belong to stunivers on the disk (consistent with your current directory structure).
• guest ok = yes only for [Public].

I really took my time to set up the cleanest configuration possible, ensuring nothing was left exposed.

5. Validate the Syntax of the File

One great thing about Samba is that it won't let you write your smb.conf file and then return silly errors.

The utility testparm, included with Samba, is very useful for validating your smb.conf file:

Normally, the command should return a header similar to this, confirm that the files are okay, and spit out the contents of your smb.conf again.

For those concerned about Weak crypto being allowed, note that Debian allows compatibility even down to SMB 1. On our side, we enforce SMB 3 to take advantage of its security improvements.

6. Create Your Samba User

Samba doesn't know about Stunivers; in fact, the users on your Debian system and those in Samba are distinct.

Therefore, you need to create a Samba user:

7. Access Rights

As you can see, we have a private directory structure /mnt/DATA, and /mnt/DATA/Public or Public is within DATA.

Therefore, it's important that no additional rights are granted to any other Unix group besides Stunivers.

Let’s ensure the permissions are consistent for the stunivers user:

Why use chmod -R and chown -R? There's always a moment when you forget a permission or things don't go as expected.

It may seem radical, but I prefer to be thorough once and for all.

A quick check with ls confirms everything is set:

7. Restart the Services

Restarting the services is crucial because your Samba server defaults to recognizing the old smb.conf file.

Additionally, we need to ensure that our server service starts at boot and force the stop of nmbd (for NetBIOS), which is no longer in use.

If you haven't made any mistakes in your smb.conf and verified with testparm, you should see something like this:

8. Configuration for ufw or firewalld

The idea of a firewall is to allow only what needs to pass in or out.

There are hardware firewalls, essentially boxes where you plug your PC on one side and the internet on the other (don't shoot me, it's a voluntary simplification).

In my case, the PC itself will host our software firewall between the network and us.

A quick tutorial here to install and configure it:

9.

Test from Another PC

You can either do this graphically or via command line as shown here:

10. Quick Troubleshooting Guide