Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteTo share a directory from an Ubuntu or Debian VPS with Windows, install Samba, create a dedicated directory, define an authenticated share in /etc/samba/smb.conf, give the account matching Linux and Samba permissions, and allow SMB only from trusted networks in both firewall layers. Windows then connects with \server-ipshare.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
A public VPS changes the security decision: do not use an unrestricted guest share or expose SMB to the entire Internet. Use named users, least-privilege filesystem permissions, a private network or VPN where possible, narrow provider and host-firewall rules, updates, and tested backups.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you are building
Samba implements the SMB file-sharing protocol on Linux. A VPS runs the Samba services and stores the files; Windows, Linux, and macOS clients connect over the network. Canonical describes Samba file serving as one of the common ways to network Ubuntu and Windows computers.
This guide uses Samba’s standalone server mode. Each person who connects has a Linux account and a corresponding Samba password. The share definition controls Samba-level access, while normal Linux ownership, mode bits, and POSIX ACLs still decide whether an operation is actually permitted.
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
When a VPS is a good fit
- Several trusted locations need one always-on file repository.
- You need a public or private network path and persistent disk attached to a server.
- You can control both the VPS provider’s network firewall and the operating system firewall.
- You are prepared to maintain user accounts, updates, permissions, monitoring, and backups.
When not to expose it directly
SMB should not be opened broadly on a public address merely to make discovery work. If clients can reach a private network or VPN, keep SMB there. Otherwise, allow only the specific office, home, or host addresses that need access. A web-based file service or managed collaboration system may be a better fit for untrusted Internet users.
Plan the deployment before installing
Choose the operating system and storage
The commands below target Ubuntu or Debian systems using apt. Use a persistent VPS volume for the share; ephemeral boot storage is unsuitable for files you intend to keep. A directory under /srv is appropriate for site-specific data, so this guide uses /srv/samba/share and /srv/samba/private examples.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDecide who should access what
For one person, a dedicated Linux account with a private share is simplest. For a team, create a Linux group, make the directory group-owned, and use set-group-ID and default ACLs so new files inherit the intended collaboration policy. Do not grant write access just because a client can authenticate.
| Design choice | Advantages | Trade-offs and appropriate use |
|---|---|---|
| Authenticated users | Every connection maps to a named identity; access can be revoked per user. | Requires maintaining Linux accounts, Samba credentials, and filesystem permissions. Recommended for a VPS. |
| Guest access | Little account administration for a closed local network. | Any permitted client can use the share; unsuitable for an Internet-facing VPS. |
| Single-user share | Easy ownership and a small attack surface. | Does not scale well when several people need different access. |
| Group-based share | Membership changes can add or remove access without rewriting the share. | Requires careful group ownership, inheritance, and umask/ACL planning. |
| Standalone Samba users | Works without a directory service and is straightforward on one VPS. | Passwords and identities are local to this server; domain or AD integration is more complex but centralizes identity. |
| Local VPS disk | Simple path and predictable Linux permission behavior. | Backups, capacity, and disk failure remain your responsibility. |
| Mounted or object-backed storage | Can add capacity or separate storage from the VPS. | Mount availability, latency, locking behavior, and POSIX-permission support must be verified before relying on it. |
Install Samba on Ubuntu or Debian
- Update package metadata and install the Samba packages:
sudo apt update sudo apt install samba - Confirm that the main configuration file exists at
/etc/samba/smb.conf. Keep a copy of the original before making substantial edits:sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.original - Check the service state. Package defaults may start the daemons automatically; the status command tells you whether they are running:
sudo systemctl status smbd.service nmbd.service
Do not replace the distribution’s entire configuration until you understand which global defaults you are removing. Add or edit only the settings your deployment needs.
Create the share directory and Linux identity
Make a private directory
sudo mkdir -p /srv/samba/private
sudo chown alice:alice /srv/samba/private
sudo chmod 0700 /srv/samba/privateThis example gives only alice access at the Linux filesystem layer. The account must already exist as a system user. If it does not, create it with your normal account-provisioning process, for example:
sudo adduser aliceUse a service-specific account rather than sharing a personal administrator account. A directory’s mode bits are not a substitute for Samba authentication: both layers must allow the requested operation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Prepare a team directory
For several users, create a group and assign the directory to it. The names below are examples; add only people who should have access.
sudo groupadd fileshare
sudo usermod -aG fileshare alice
sudo mkdir -p /srv/samba/team
sudo chown root:fileshare /srv/samba/team
sudo chmod 2770 /srv/samba/teamThe leading 2 in 2770 sets the set-group-ID bit, causing new entries to inherit the directory’s group on filesystems that support it. Existing users may need to start a new session before their supplementary group membership is recognized.
Register the Samba credential
Samba maintains its own password database. The username must match an existing Linux account:
sudo smbpasswd -a aliceEnter a strong, unique password when prompted. Repeat the command for each permitted user. A name in valid users must exist both as a Linux identity and as a Samba identity; creating only one of the two produces confusing authentication or permission failures.
Define an authenticated share in smb.conf
Global settings
Open the central configuration file:
sudo nano /etc/samba/smb.confEnsure the global section identifies the workgroup used by your clients and selects standalone user authentication:
[global]
workgroup = WORKGROUP
security = usersecurity = user is the default standalone mode in Samba’s manual. Domain-oriented modes belong to a different identity architecture; do not mix them into a standalone setup without planning the domain relationship.
Rank #3
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Private single-user share
Add this section below the global settings:
[private]
path = /srv/samba/private
browsable = yes
read only = no
valid users = alice
create mask = 0600
directory mask = 0700path maps the share name to the Linux directory. browsable controls whether clients can list the share. read only = no permits write requests, subject to filesystem permissions. valid users limits who may authenticate to this share. The creation masks keep newly created files and directories private to the account; adjust them only when your collaboration model requires broader access.
Group-based read/write share
A team share can name a group and align Samba-created entries with the Linux group:
[team]
path = /srv/samba/team
browsable = yes
read only = no
valid users = @fileshare
force group = fileshare
create mask = 0660
directory mask = 2770The @fileshare notation refers to the Linux group. Samba authorization and the directory’s group permissions must agree. If users need different read and write rights, create separate shares or apply POSIX ACLs rather than making the whole directory writable.
Why not use a guest example on a VPS
A guest configuration can remove the login prompt, but the basic guest pattern gives broad access to any client that can reach the share on the local network. That is a poor boundary for a public VPS. Keep guest mode for a deliberately isolated network, not as a shortcut around account setup.
Align Linux permissions and POSIX ACLs
Samba cannot grant access that the Linux filesystem denies. Check each parent directory in the path, the share directory itself, ownership, mode bits, and any ACL entries. A user may authenticate successfully and still receive “access denied” because the kernel rejects the file operation.
Inspect the effective permissions
namei -l /srv/samba/private
ls -ld /srv/samba/private
getfacl /srv/samba/privateUse namei -l to inspect traversal permissions on every path component and getfacl when ACLs are in use. Remove accidental world write permissions and avoid placing the share beneath a directory that users cannot traverse.
Recommended Free Tools
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
Use ACLs when mode bits are not enough
POSIX ACLs let you grant a named user or group access without changing the owner. For example, a read/write entry for the fileshare group and inherited defaults can be applied with your distribution’s ACL tools:
sudo setfacl -m g:fileshare:rwx /srv/samba/team
sudo setfacl -d -m g:fileshare:rwx /srv/samba/teamReview the resulting ACL rather than assuming it matches your intention. Default ACLs affect new entries; they do not retroactively repair every existing file. Keep the Samba masks, group ownership, and ACL entries consistent.
Restrict both firewall layers
Host firewall
Ubuntu’s broad example is:
sudo ufw allow sambaThat rule may allow more sources than a public VPS should. Prefer a source-restricted rule for the network that actually contains your clients. For example, if your private client network is 10.20.30.0/24 and the UFW application profile is available:
sudo ufw allow from 10.20.30.0/24 to any app SambaUse the narrowest real network or individual address, enable UFW only after confirming your administrative access will remain allowed, and inspect the resulting policy:
sudo ufw status numberedVPS-provider firewall
Many VPS platforms filter traffic before it reaches the instance. Add an inbound rule there that permits SMB only from the same trusted source ranges, and remove broad “anywhere” rules. A host firewall cannot compensate for an unnecessarily open provider rule, and a provider rule cannot compensate for an incorrectly configured host firewall. Test from an allowed client and from a deliberately unallowed network.
Prefer a private path
If your provider offers private networking, or your organization uses a VPN, bind access to that path and keep the public interface closed. This reduces exposure and avoids relying on Internet-wide SMB reachability. Do not publish credentials or assume that obscuring a share name provides security.
Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Validate the configuration and apply changes
- Ask the locally installed Samba tooling to parse the file and report syntax or parameter errors. On standard installations this is commonly done with:
sudo testparm /etc/samba/smb.conf - Read the reported effective configuration. Check that each
pathexists, the permitted users are spelled correctly, and the intended read/write and mask settings are present. - Restart both services after an installation or service-level change:
sudo systemctl restart smbd.service nmbd.service - For a change that only needs configuration reread, reload the relevant service when appropriate:
sudo systemctl reload smbd.service - Check for startup errors and recent authentication or access-denied messages using your system’s service logs before testing from a client.
A successful syntax check does not prove that a user can read or write a particular file. It only establishes that Samba can parse the configuration; filesystem permissions, firewall reachability, and credentials still need an end-to-end test.
Connect from Windows, Linux, and macOS
Windows
- Open File Explorer and enter
\server-ipprivatein the address bar, replacingserver-ipwith the VPS address reachable from your allowed network. - When prompted, enter the Samba username
aliceand the password created withsmbpasswd. If Windows offers to use a Microsoft account automatically, choose the option to provide different credentials and enter the Samba account explicitly. - Test a small file creation, rename, read, and deletion operation if the share is intended to be writable. Those operations reveal different permission problems.
Ubuntu or another Linux desktop
Use the file manager’s network location entry and enter an SMB address using the server address and share name. Authenticate with the Samba account rather than an unrelated local desktop login. A command-line mount can be useful for automation, but it should store credentials securely and use a controlled mount point; do not place a plaintext password in a world-readable script.
macOS
In Finder, choose the command to connect to a server, enter the SMB address for the VPS and share, and authenticate as the Samba user. If one client succeeds while another fails, compare the exact account, cached credentials, and network path before changing server permissions.
Troubleshoot by symptom
The client cannot reach the server
- Confirm the VPS is running and the Samba services are active.
- Check the provider firewall and UFW source rules; the client address must be in the allowed range.
- Verify that the client is using the correct server address and share name.
- Test from an allowed network rather than assuming a public test location should work.
Authentication is rejected
- Confirm the Linux account exists:
getent passwd alice. - Confirm a Samba credential was added for that exact username with
sudo smbpasswd -a alice. - Check that the account is not disabled and that the share’s
valid usersentry uses the same name or group. - Clear stale client credentials and retry with the Samba password, not a different operating-system password.
Login works but the share says access denied
- Inspect ownership and mode bits on every directory in the path.
- Review ACLs with
getfacland verify that an ACL mask is not reducing the intended rights. - For a group share, confirm the user is a member of the group in a new login session and that the directory has the expected group owner.
- Check whether the share is intentionally read-only or whether creation masks are narrower than the operation you attempted.
Files have unexpected owners or permissions
Review create mask, directory mask, force group, directory set-group-ID, and default ACLs together. Changing only one setting can make newly created entries differ from existing files. Correct the policy, then repair existing entries deliberately rather than applying a blanket permissive mode.
The service fails after an edit
Run the configuration parser again and read the service status and logs. Common causes include a misspelled parameter, an invalid path, a malformed share section, or a user/group name that does not exist. Restore the known-good copy of /etc/samba/smb.conf if necessary, validate it, and restart the services before reintroducing changes one at a time.
Free tools Windows power users keep installed
One-click scans. No signup required.
Operate the server safely after setup
Use least privilege
Give each person only the shares and filesystem rights required for their work. Separate read-only data from writable working areas. Remove a user’s Samba credential and Linux group membership when access is no longer needed, and review the share list periodically.
Patch and monitor
Apply operating-system and Samba security updates through the normal package process. Watch service logs for repeated failed logins, unexpected source addresses, and access errors. Keep administrative SSH access subject to its own restricted policy; opening Samba should not weaken your management controls.
Back up and test restoration
A share is not a backup. Back up the underlying files, preserve ownership and ACL information when those permissions matter, and keep at least one copy independent of the VPS. Periodically restore representative files to a test location and verify that clients can read them with the intended accounts.
Document the access boundary
Record the share names, filesystem paths, allowed networks, account owners, group purpose, backup schedule, and the date of the last access review. This makes a future permission change auditable and reduces the chance that an old firewall exception becomes permanent.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Checklist for a production-ready VPS share
- Samba is installed from the distribution packages and
/etc/samba/smb.confis backed up. - Each share points to persistent storage under an intentional directory.
- Every permitted name exists as both a Linux account or group and, for users, a Samba credential.
- Ownership, mode bits, and ACLs provide the required rights without world access.
- The share uses authenticated access rather than unrestricted guest access.
- The VPS-provider firewall and UFW allow SMB only from trusted client networks or a private/VPN path.
testparm(or the equivalent locally installed validator) reports a valid configuration.- Both the allowed-client test and a denied-network test produce the expected result.
- Windows access works with
\server-ipshare, and read/write behavior matches the policy. - Updates, logging, backups, and restoration tests are scheduled.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
