Samba

Synopsis #

Samba is a suite of programs that implements the SMB (Server Message Block) protocol including modern SMB dialects; CIFS refers to an older dialect. It allows Unix systems to share files and printers with Windows clients, and vice versa. Samba can function as a standalone file server, a member of a Windows domain, but the OpenBSD release port disables the Active Directory domain-controller role.

The OpenBSD base system does not include Samba. It is available via the ports and packages system.

Installation #

To install Samba:

doas pkg_add samba

This will install the Samba server binaries, configuration files, and documentation. The package includes smbd(8) for file and printer sharing and nmbd(8) for NetBIOS name resolution and browsing. For a basic server, smbd alone is often enough.

Configuration #

Samba is configured through /etc/samba/smb.conf. This file must be created before starting the daemons. A minimal configuration to export a public share might look as follows:

Configuration #

[global]
   workgroup = WORKGROUP
   server string = OpenBSD Samba Server
   security = user
   map to guest = Bad User
   guest account = nobody
   log file = /var/log/samba/log.%m
   max log size = 1000
   passdb backend = tdbsam
   load printers = no
   printing = bsd
   disable spoolss = yes

[public]
   path = /srv/smb/public
   public = yes
   writable = yes
   printable = no
   guest ok = yes

This defines a shared directory at /srv/smb/public, accessible to anonymous users with write access. In more secure environments, guest ok = no should be used and access controlled via user authentication.

Samba uses its own user database. System users must be added to it with:

doas smbpasswd -a username

Ensure that the shared directory exists and has proper permissions:

doas mkdir -p /srv/smb/public
doas chown -R nobody:nogroup /srv/smb/public
doas chmod 0777 /srv/smb/public

These permissions allow local guest-account writes; SMB authentication still depends on the guest mapping and client policy. Modern Windows clients may reject guest sessions. Adjust as appropriate for authenticated sharing.

Service Management #

The package supplies rc scripts. Validate the configuration and start the file server:

testparm -s
doas rcctl enable smbd
doas rcctl start smbd

Enable and start nmbd as well only if NetBIOS naming/browsing is needed. Use rcctl restart smbd after changes requiring a restart.

Client Access #

On Unix clients, access to Samba shares can be tested using smbclient, part of the samba package:

doas pkg_add samba
smbclient //hostname/public -U username

On Windows, open File Explorer and enter:

\\hostname\public

Replace hostname with the Samba server’s IP address or NetBIOS name.

Authentication prompts will appear unless guest access is configured.

Printer Sharing #

Printer support is limited and typically requires integration with a print spooler such as cupsd or lpd. For a basic file server, disable unneeded printer support with:

load printers = no
disable spoolss = yes

This reduces the attack surface and prevents misleading printer listings in client environments.

Firewall Considerations #

The SMB protocol uses multiple ports:

• TCP 139: NetBIOS Session Service
• TCP 445: Direct SMB over TCP
• UDP 137: NetBIOS Name Service
• UDP 138: NetBIOS Datagram Service

If using pf(4), pass rules must be written to allow traffic to these ports from client hosts:

pass in on $int_if proto tcp from any to (self) port { 139, 445 }
pass in on $int_if proto udp from any to (self) port { 137, 138 }

Do not expose these services to the Internet.

Security Considerations #

Samba is a large and complex daemon and has historically had several vulnerabilities. It is strongly recommended to:

• Limit access to trusted networks
• Disable unnecessary features (e.g., printing, guest access)
• Regularly update the package
• Use firewalls to restrict access
• Avoid running Samba on Internet-facing interfaces

For production environments requiring strong access control and integration with centralized authentication, consider running Samba in standalone mode only or using alternatives such as rsync or NFS depending on client needs.

Differences Compared to NFS #

Samba is ideal for heterogeneous environments with Windows clients. NFS is better suited for Unix-only networks.