Setting up a Samba file server: smb.conf, testparm, and disabling SMB1

Goal

Stand up a Samba share on Linux, validate the configuration before reloading, and choose between a local password database and Active Directory membership for authentication.

Prerequisites

The samba package installed; a directory to share; either local Linux accounts (for smbpasswd) or an Active Directory domain to join (for security = ads).

Steps

1. Edit /etc/samba/smb.conf. The [global] section holds server-wide settings (workgroup, security mode, protocol limits); each share gets its own [sharename] section with at least path and read only.
2. Choose authentication. For a standalone server with local accounts, leave security at its default (auto, which behaves as user on a standalone server) and, as root, create SMB passwords for existing Linux users with smbpasswd -a <user>; Samba keeps these in its own password database (by default the tdbsam backend), separate from /etc/shadow. For a domain member, set security = ads plus realm and workgroup in [global], together with idmap config ranges for winbind: Samba then acts as a domain member in an ADS realm, which requires Kerberos installed and configured, DNS pointing at the domain controllers, synchronised time, and a join with net ads join -U <admin>.
3. Validate before reloading: run testparm -s (without -s it waits for Enter before dumping the definitions). It is a very simple test program that checks an smbd configuration file for internal correctness and reports unknown or invalid parameters. A clean run does not guarantee the shares behave correctly, only that smbd will load the file.
4. Apply the change without restarting the daemon: as root, smbcontrol all reload-config forces the daemon to reload the smb.conf configuration file, and all broadcasts the message to every running smbd, nmbd and winbindd.
5. Confirm SMB1 stays disabled: since Samba 4.11 the default is already server min protocol = SMB2_02, so check with testparm -sv | grep 'server min protocol' that nobody lowered it (for example to NT1); set it explicitly only on older releases. This setting controls the minimum protocol version that the server will allow the client to use.

Expected result

testparm prints no errors and shows the parsed share list; a client mount or smbclient -L localhost -U <user> confirms the share is reachable; smbstatus (as root) lists connected sessions with their protocol version, none of them NT1.

Limits and test basis

testparm's success is not a guarantee a share behaves as intended, only that the file parses — test an actual mount too. Switching an existing standalone server to security = ads requires re-provisioning identity mapping and is disruptive; plan a migration window and back up smb.conf and the smbpasswd file first. smbcontrol's reload does not restart listening sockets, so a bind-address or port change still needs a full restart.