The Right Way™ to Mount SMB/CIFS Shares on a Linux Server

The Problem

You’ve set up an SMB mount on your server using the official Ubuntu or some other Wiki’s guide. Some application, service or script on your server depends on this file share.

All seems great and the file share mounts at boot during your tests. Then, one day, there’s an unexpected restart of the server stack, and everything falls apart. The server loses the mount point.

What gives? Well, it seems that many guides out there do not handle the case where the client (mounter) of the file share comes online after the file server itself. It’s easy enough to miss this case during manual testing if your file server is always online.

Let’s fix that!

The Right Way™ to set up an SMB mount

This method will ensure that our headless Linux client server will –

• Automatically reconnect the share when the fileserver boots late
• Automount the share as needed
• Not hang at boot if the share is unavailable

We will also apply generally safe best practices for security and permissions when mounting the share.

\ Written for Ubuntu 24.04

This guide focuses on Ubuntu server 24.04, but you can use the general steps with Rocky/RHEL as well. Just look up the equivalent packages/commands for your system.

1 - Install system packages

Enable CIFS/SMB client support with cifs-utils

apt update
apt install -y cifs-utils 
apt install -y linux-image-generic # utf8 charset support in ubuntu 24.04

Missing utf8 charset support when mounting

If the system is Ubuntu 24.04 you’ll run into an error when mounting. Additional system headers are needed for utf8 charset support when mounting. Installing the linux-image-generic package fixes the problem.

2 - Credentials file

Storing the password in cleartext in the fstab is a bad idea so we’ll make things more secure by at least storing it in a protected credentials file on the system.

\myshare.creds

username=SMB_USER
password=SMB_PASSWORD

nvim /etc/samba/myshare.creds
# permissions
chmod 600 /etc/samba/myshare.creds
chown root:root /etc/samba/myshare.creds

3 - Security best practices

Now is a good time to review your share security. Here are some best practices I’ve picked up.

Creating good share passwords

Since we’re storing share passwords in plaintext (but protected) files, these should never be actual passwords used for anything else. Imagine if a system was compromised and you used the same password across multiple servers and systems?

Generate random throwaway, one-time-use passwords that you’ll use in this file and never again with the SSL command –

\ Random key generation with openssl

openssl rand -hex 32 # random 32byte hexadecimal string

Dedicated SMB user per mount

When you have a number of servers which mount volumes (sometimes the same share) over SMB, it’s a good idea to have a dedicated user and password for each server accessing that share. Ideally you will only give the minimum necessary access to the user. This is the Principle of Least Privilege. eg: if an application only needs to read a file system, then give the user read only permissions.

4 - Create mount point

Create the folder to mount to, and use your editor of choice (neovim for me) to create an fstab entry –

mkdir -p /mnt/myshare
nvim /etc/fstab 

\ /etc/fstab

# (this is all one line, remove the \)
//SERVER/myshare  /mnt/myshare  cifs credentials=/etc/samba/myshare.creds,uid=www-data,gid=www-data,dir_mode=0775,file_mode=0664,\
    soft,nofail,x-systemd.automount,x-systemd.requires=network-online.target,_netdev  0  0

The important parts

Compared to a regular fstab entry for SMB, the important difference here is the use of x-systemd.automount, x-systemd.requires=network-online.target and the associated options. This solves our problem of missing mount points after boot.

5 - Apply and test

Reload systemd with the new configuration

systemctl daemon-reload
systemctl restart remote-fs.target

Checking the automount now exists

This is a manual check you can use to see that automount was detected and added by systemd.

systemctl list-units --type automount

You should see a line with loaded active waiting for your mountpoint in the output.

You can also check for a specific automount’s status much like other systemd units with eg: systemctl status mnt-myshare.automount

6 - Extras (optional)

Once created the systemd mountpoint can be edited. You can do various things here like change the timeout for automounting, before a retry occurs, eg –

# edit
systemctl edit --full mnt-myshare.mount
# apply
systemctl daemon-reload
systemctl restart mnt-myshare.automount

\ .mount file

[Mount]
TimeoutSec=15
RetrySec=10

Comments