Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 5. Mounting an SMB Share

The Server Message Block (SMB) protocol implements an application-layer network protocol used to access resources on a server, such as file shares and shared printers.

Note

In the context of SMB, you can find mentions about the Common Internet File System (CIFS) protocol, which is a dialect of SMB. Both the SMB and CIFS protocol are supported, and the kernel module and utilities involved in mounting SMB and CIFS shares both use the name cifs.

The cifs-utils package provides utilities to:

  • Mount SMB and CIFS shares
  • Manage NT LAN Manager (NTLM) credentials in the kernel’s keyring
  • Set and display Access Control Lists (ACL) in a security descriptor on SMB and CIFS shares
  • Display session ID, encryption/decrytion keys, SMB-specific file and quota information from a mounted SMB share

5.1. Supported SMB protocol versions
Copier lien

The Linux cifs.ko kernel module supports certain Server Message Block (SMB) protocol versions. There are some security considerations and feature differences among SMB1, SMB2, SMB3, and newer versions for optimal network file sharing.

The cifs.ko kernel module supports the following SMB protocol versions:

  • SMB 1

    Warning

    The SMB1 protocol is deprecated due to known security issues, and is only safe to use on a private network. The main reason that SMB1 is still provided as a supported option is that currently it is the only SMB protocol version that supports UNIX extensions. If you do not need to use UNIX extensions on SMB, use SMB2 or later.

  • SMB 2.0
  • SMB 2.1
  • SMB 3.0
  • SMB 3.1.1
Note

Depending on the protocol version, not all SMB features are implemented.

5.2. UNIX extensions support
Copier lien

Samba uses the CAP_UNIX capability bit in the SMB protocol to provide the UNIX extensions feature. These extensions are also supported by the cifs.ko kernel module. However, both Samba and the kernel module support UNIX extensions only in the SMB 1 protocol.

Prerequisites

  • The cifs-utils package is installed.

Procedure

  1. Set the server min protocol parameter in the [global] section in the /etc/samba/smb.conf file to NT1.

  2. Mount the share by using the SMB 1 protocol by providing the -o vers=1.0 option to the mount command. For example: 

    # mount -t cifs -o vers=1.0,username=<user_name> //<server_name>/<share_name> /mnt/

    By default, the kernel module uses SMB 2 or the highest later protocol version supported by the server. Passing the -o vers=1.0 option to the mount command forces that the kernel module uses the SMB 1 protocol that is required for using UNIX extensions.

Verification

  • Display the options of the mounted share: 

    # mount
     
    ...
//<server_name>/<share_name> on /mnt type cifs (...,unix,...)

    If the unix entry is displayed in the list of mount options, UNIX extensions are enabled.

5.3. Manually mounting an SMB share
Copier lien

You can access files on a remote SMB server temporarily by mounting the share manually with the mount utility.

Note

Manually mounted shares are not mounted automatically again when you reboot the system. To configure that Red Hat Enterprise Linux automatically mounts the share when the system boots, see Mounting an SMB share automatically when the system boots.

Prerequisites

  • The cifs-utils package is installed.

Procedure

  • Use the mount utility with the -t cifs parameter to mount an SMB share: 

    # mount -t cifs -o username=<user_name> //<server_name>/<share_name> /mnt/
     
    Password for <user_name>@//<server_name>/<share_name>:  password

    In the -o parameter, you can specify options that are used to mount the share. For details, see the OPTIONS section in the mount.cifs(8) man page and Frequently used SMB mount options. Below is an example for mounting a share by using an encrypted SMB 3.0 connection.

    To mount the \\server\example\ share as the DOMAIN\Administrator user over an encrypted SMB 3.0 connection into the /mnt/ directory: 

    # mount -t cifs -o username=DOMAIN\Administrator,seal,vers=3.0 //server/example /mnt/
     
    Password for DOMAIN\Administrator@//server_name/share_name:  password

Verification

  • List the content of the mounted share: 

    # ls -l /mnt/
     
    total 4
drwxr-xr-x.  2 root root 8748 Dec  4 16:27 test.txt
drwxr-xr-x. 17 root root 4096 Dec  4 07:43 Demo-Directory

5.4. Mounting an SMB share automatically when the system boots
Copier lien

If access to a mounted SMB share is permanently required on a server, mount the share automatically at boot time.

Prerequisites

  • The cifs-utils package is installed.

Procedure

  1. Add an entry for the share to the /etc/fstab file. For example: 

    //<server_name>/<share_name>  /mnt  cifs  credentials=/root/smb.cred  0 0
    Important

    To enable the system to mount a share automatically, you must store the user name, password, and domain name in a credentials file. For details, see Creating a credentials file to authenticate to an smb share.

    In the fourth field of the row in the /etc/fstab, specify mount options, such as the path to the credentials file. For details, see the OPTIONS section in the mount.cifs(8) man page and Frequently used SMB mount options.

Verification

  • Mount the share by specifying the mount point: 

    # mount /mnt/

In certain situations, such as when mounting a share automatically at boot time, a share should be mounted without entering the user name and password. To implement this, create a credentials file.

Prerequisites

  • The cifs-utils package is installed.

Procedure

  1. Create a file, such as /root/smb.cred, and specify the user name, password, and domain name in that file: 

    username=user_name
password=password
domain=domain_name

  2. Set the permissions to only allow the owner to access the file: 

    # chown user_name /root/smb.cred
     
    # chmod 600 /root/smb.cred

    You can now pass the credentials=file_name mount option to the mount utility or use it in the /etc/fstab file to mount the share without being prompted for the user name and password.

5.6. Performing a multi-user SMB mount
Copier lien

The credentials used to mount a share define default access permissions. For example, if you mount a share by using the DOMAIN\example user, all actions on that share run as that user, no matter which local user performs them. However, in certain situations, the administrator wants to mount a share automatically when the system boots, but users should perform actions on the share’s content by using their own credentials. You can configure this scenario by using the multiuser mount option.

Important

To use the multiuser mount option, you must additionally set the sec mount option to a security type that supports providing credentials in a non-interactive way, such as krb5 or the ntlmssp option with a credentials file.

The root user mounts the share by using the multiuser option and an account that has minimal access to the contents of the share. Regular users can then provide their user name and password to the current session’s kernel keyring by using the cifscreds utility. If the user accesses the content of the mounted share, the kernel uses the credentials from the kernel keyring instead of the one initially used to mount the share.

Using this feature consists of the following steps:

  • Ensure the cifs-utils package is installed.
  • Mount a share with the multiuser option.
  • Optionally, verify if the share was successfully mounted with the multiuser option.
  • Access the share as a user.

5.6.1. Mounting a share with the multiuser option
Copier lien

Before users can access the share with their own credentials, mount the share as the root user by using an account with limited permissions.

Procedure

  1. Create the entry for the share in the /etc/fstab file. For example: 

    //server_name/share_name  /mnt  cifs  multiuser,sec=ntlmssp,credentials=/root/smb.cred  0 0

  2. Mount the share: 

    # mount /mnt/

    If you do not want to mount the share automatically when the system boots, mount it manually by passing -o multiuser,sec=security_type to the mount command. For details about mounting an SMB share manually, see Manually mounting an SMB share.

To verify if a share is mounted with the multiuser option, display the mount options.

Procedure

  • Display the mount options: 

    # mount
     
    ...
//server_name/share_name on /mnt type cifs (sec=ntlmssp,multiuser,...)

    If the multiuser entry is displayed in the list of mount options, the feature is enabled.

5.6.3. Accessing a share as a user
Copier lien

If an SMB share is mounted with the multiuser option, users can provide their credentials for the server to the kernel’s keyring: 

# cifscreds add -u SMB_user_name server_name
 
Password: password

When the user performs operations in the directory that contains the mounted SMB share, the server applies the file system permissions for this user. It does not apply the permissions of the user who initially mounted the share.

Note

Multiple users can perform operations by using their own credentials on the mounted share at the same time.

5.7. Frequently used SMB mount options
Copier lien

Explore frequently used SMB mount options, including configuration details for credential handling, permissions, encryption, security modes, and protocol versions, to optimize secure and efficient SMB share connections in Linux environments.

When you mount an SMB share, the mount options determine:

  • How the connection will be established with the server. For example, which SMB protocol version is used when connecting to the server.
  • How the share will be mounted into the local file system. For example, if the system overrides the remote file and directory permissions to provide access to multiple local users to the content on the server.

To set multiple options in the fourth field of the /etc/fstab file or in the -o parameter of a mount command, separate them with commas.

The following list gives frequently used mount options:

Expand
OptionDescription

credentials=file_name

Sets the path to the credentials file.

dir_mode=mode

Sets the directory mode if the server does not support CIFS UNIX extensions.

file_mode=mode

Sets the file mode if the server does not support CIFS UNIX extensions.

password=password

Sets the password used to authenticate to the SMB server. Alternatively, specify a credentials file by using the credentials option.

seal

Enables encryption support for connections by using SMB 3.0 or a later protocol version. Therefore, use seal together with the vers mount option set to 3.0 or later.

sec=security_mode

Sets the security mode, such as ntlmsspi, to enable NTLMv2 password hashing and enabled packet signing. For a list of supported values, see the option’s description in the mount.cifs(8) man page on your system.

If the server does not support the ntlmv2 security mode, use sec=ntlmssp, which is the default.

For security reasons, do not use the insecure ntlm security mode.

username=user_name

Sets the user name used to authenticate to the SMB server. Alternatively, specify a credentials file by using the credentials option.

vers=SMB_protocol_version

Sets the SMB protocol version used for the communication with the server.

For a complete list, see the OPTIONS section in the mount.cifs(8) man page on your system.

Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Legal Notice

Theme

© 2026 Red HatRetour au début