Setting Up SMB on Manjaro, End to End

I bought a 2 TB Western Digital Blue drive in that year’s November sale, and that started the whole detour.

Some context on what I needed. I was a university student, and I mostly carried a Windows laptop when I went out, so NTFS was the sensible filesystem for the drive. During holidays I would probably take the drive home with me. I had three requirements for the SMB service:

1. For myself, with full access to the entire disk
2. For my roommates to download some files, read-only
3. For my roommates to download and upload, read-write

With the requirements written down, I started.

Getting ready

Install the software:

sudo yay -S samba

Manjaro seems to ship it these days, so you may not need this at all.

Writing the config file

The config file is not hard to write. Here is mine.

# /etc/samba/smb.conf
# Global configuration
[global]
   # Workgroup
   workgroup = WORKGROUP
   # The server description string
   server string = C5-315 SMB Server
   # This name shows up on the local network
   netbios name = SMB Server
   # Needed for anonymous access
   map to guest = bad user
   # Maps the anonymous account to a local one. nobody already exists on
   # Manjaro, so write it as-is
   guest account = nobody
   # Log file location. If the service misbehaves later, look here first
   log file = /var/log/samba/%m.log
   # Log size in KB. 0 means no limit
   max log size = 0
   # The share security mode many older guides mention is deprecated
   security = user
   # I no longer remember why I wrote this line
   encrypt passwords = yes
   # Turn off the DNS proxy
   dns proxy = no

# Requirement 1: full access to the disk
# The share name
[kaoru-disk]
   # Shown as a tooltip in Windows
   comment = Admin directory
   # The real path on this machine, here the actual mount point of the disk.
   # There is a trap here, covered below
   path = /run/media/kaoru/kaoru-disk/
   # browseable controls whether it is listed, not whether it is reachable
   browseable = yes
   # Makes me the administrator. kaoru is my local account.
   # SMB accounts are tied to Linux accounts, but the passwords can differ
   admin users = kaoru
   # Allow writes
   writeable = yes

# Requirement 2 starts here. Repeated options are not explained again
[book]
   comment = Ebook directory
   path = /run/media/kaoru/kaoru-disk/book/
   public = yes
   guest ok = yes
   browseable = yes
   writeable = no

[movie]
   comment = Movie directory
   path = /run/media/kaoru/kaoru-disk/movie/
   public = yes
   guest ok = yes
   browseable = yes
   writeable = no

[iso]
   comment = System image directory
   path = /run/media/kaoru/kaoru-disk/iso/
   public = yes
   guest ok = yes
   browseable = yes
   writeable = no

[software]
   comment = Software directory
   path = /run/media/kaoru/kaoru-disk/software/
   public = yes
   guest ok = yes
   browseable = yes
   writeable = no

# Requirement 3
[shared]
   comment = Public directory, anonymous upload and download
   path = /run/media/kaoru/kaoru-disk/shared/
   public = yes
   guest ok = yes
   browseable = yes
   # The difference is here: anonymous users can also upload
   writeable = yes

Once the file is written, check it with testparm from the Samba suite:

testparm /etc/samba/smb.conf

Adding a user

My first requirement is that only I have full access, so create an SMB account:

sudo smbpasswd -a kaoru

It then asks for a password. The user you add here has to exist on the system already. kaoru is my own account.

Enable the account to be safe:

sudo smbpasswd -e kaoru

That covers the user. Now the trap.

File permissions

Take the root of the mounted disk:

/run/media/kaoru/kaoru-disk/

Other users usually cannot traverse anything under /run/media/${username}. Without that permission SMB cannot even open the directory, and it reports NT_STATUS_ACCESS_DENIED listing \*.

Once the cause is clear the fix is simple. Change the directory permissions:

sudo chmod 755 /run/media/kaoru

That is the whole thing. You can mount the remote disk from Windows.

A note

If anything is unclear, ask.

---

Updated on the 16th

After watching it for a while I found two problems remained:

1. The network only comes up after logging in at the SDDM screen. I connect over Wi-Fi.
2. The disk is not mounted automatically after boot, and the mount directory still lacks the right permissions.

Here is how I fixed both.

No network before login

This one is easy. Manjaro encrypts the Wi-Fi password per user by default.

Open Settings → Network → Connections → select your network → under General check “All users may connect to this network” → under Wi-Fi Security, store the password for all users (unencrypted).

Reboot, let it boot without logging in, and ping works.

Auto-mounting the disk, and the permission problem

Attach the disk, read its UUID, and copy it down. There are two ways.

The graphical way: open KDE Partition Manager, select the disk, right-click the partition and open its properties. The UUID is what you want. Make sure it is the UUID and not the partition UUID.

The other way is quicker:

ls -l /dev/disk/by-uuid

That lists every disk UUID. Mine looked like this:

$ ls -l /dev/disk/by-uuid
total 0
lrwxrwxrwx 1 root root 10 Nov 16 11:21 3088-EABB -> ../../sda1
lrwxrwxrwx 1 root root 10 Nov 16 11:21 4A96EE3696EE2265 -> ../../sdb2
lrwxrwxrwx 1 root root 10 Nov 16 11:21 f0396684-cc97-48c5-afcc-8860dbb5c366 -> ../../sda2

4A96EE3696EE2265 is the one I needed.

With the UUID in hand, edit the config file.

My original file looked roughly like this:

# /etc/fstab: static file system information.
# Use 'blkid' to print the universally unique identifier for a device; this may
# be used with UUID= as a more robust way to name devices that works even if
# disks are added and removed. See fstab(5).
#
# <file system>             <mount point>  <type>  <options>  <dump>  <pass>
UUID=3088-EABB                            /boot/efi       vfat    umask=0077 0 2
UUID=f0396684-cc97-48c5-afcc-8860dbb5c366 /               ext4    defaults,noatime 0 1
tmpfs                                     /tmp            tmpfs

Add one line:

UUID=4A96EE3696EE2265                     /mnt/kaoru-disk ntfs    defaults 0 0

The UUID on that line is the one you looked up. Create /mnt/kaoru-disk beforehand. ntfs is the filesystem of the disk, so write whatever yours actually uses. Save the file and you are done.

You created /mnt/kaoru-disk yourself, so you control its permissions. 755 is fine. Manjaro’s automatic mount point was /run/media/${user_name}/${disk_name}, recreated on every boot with permissions that did not match what I needed. Mounting by hand puts the mount point under my control, which settles the permission problem as well.

With the mount sorted, edit the Samba config and point each share’s path at the new location. Everything works again.

Related reading

• Disabling VSYNC on an Intel iGPU in Arch, another Linux detour
• See all technical notes
• Shiina Labs open source