Samba file sharing scenario:
• 3 private shares
• Each mapped to one user only
• Force ownership of all files to that user
• 1 public share (read/write for everyone)
• No interactive login allowed

1. Install Samba:
sudo apt update
sudo apt install samba

1a. Enable service:
sudo systemctl enable smbd
sudo systemctl start smbd

2. Create a base directory:
sudo mkdir -p /srv/samba/{user1,user2,user3,public}

3. Create Non-Login System Users
• Disable shell access
• Disable home directory creation

sudo useradd -M -s /usr/sbin/nologin user1
sudo useradd -M -s /usr/sbin/nologin user2
sudo useradd -M -s /usr/sbin/nologin user3

3a. Verify:
getent passwd user1

3b. You should see:
user1:x:1001:1001::/home/user1:/usr/sbin/nologin

✔ Cannot SSH
✔ Cannot log in locally

Public Folder:

Create a shared group:
sudo groupadd smbpublic
sudo usermod -aG smbpublic user1
sudo usermod -aG smbpublic user2
sudo usermod -aG smbpublic user3

Set ownership:
sudo chown root:smbpublic /srv/samba/public
sudo chmod 2775 /srv/samba/public

Explanation:
• 2 sets the SGID bit
• New files inherit group smbpublic
• 775 allows group write

5. Add Samba Passwords
sudo smbpasswd -a user1
sudo smbpasswd -a user2
sudo smbpasswd -a user3

5a. Enable them:
sudo smbpasswd -e user1
sudo smbpasswd -e user2
sudo smbpasswd -e user3

6. Configure Samba
sudo nano /etc/samba/smb.conf

6a. Ensure in [global] section:
security = user
map to guest = never

6b. Private Shares (Ownership Forced). Add:

[user1]
path = /srv/samba/user1
valid users = user1
read only = no
browseable = yes
force user = user1
create mask = 0600
directory mask = 0700

[user2]
path = /srv/samba/user2
valid users = user2
read only = no
browseable = yes
force user = user2
create mask = 0600
directory mask = 0700

[user3]
path = /srv/samba/user3
valid users = user3
read only = no
browseable = yes
force user = user3
create mask = 0600
directory mask = 0700

✔ force user ensures all files are owned by that user
✔ Even if accessed from Windows as that user

7. Public Share. Add:

[public]
path = /srv/samba/public
valid users = @smbpublic
read only = no
browseable = yes
force group = smbpublic
create mask = 0664
directory mask = 2775

Explanation:
• Any authenticated user in smbpublic can read/write
• Group ownership is forced
• SGID keeps group consistent

8. Test Configuration
sudo testparm

If no errors:
sudo systemctl restart smbd

9. Firewall (if enabled)
sudo ufw allow samba

10. What You Now Have:

Share Access Ownership Behavior
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
user1 user1 only All files owned by user1
user2 user2 only All files owned by user2
user3 user3 only All files owned by user3
public All users Group-owned, shared

✔ No SSH login
✔ No shell access
✔ Clean forced ownership
✔ Proper group inheritance