Access SAMBA Drive Denied: SSH Ping Working on Two Devices

When SSH connectivity works but Samba access fails, the issue typically stems from misconfigured firewall rules blocking port 445 or incorrect authentication settings in smb.conf. Since ICMP and SSH traffic succeed, network reachability is confirmed, pointing to application-layer restrictions rather than basic connectivity problems. This guide details how to diagnose and resolve these specific permission denied errors on Linux servers.

Differentiating Network Reachability from Service Availability

It is crucial to understand that a successful ping and SSH login prove Layer 3 (Network) and Layer 4 (Transport) connectivity for specific protocols. However, Samba relies on SMB/CIFS protocols which operate over TCP ports 139 and 445. If your server’s firewall allows SSH (port 22) and ICMP but blocks high-numbered TCP ports, clients will connect via SSH but fail when attempting to mount the share. Many users mistakenly assume that because they can log into the machine via terminal, file sharing should automatically work. This is not the case. The operating system treats these as distinct services with independent security policies. You must verify that the firewall explicitly permits inbound connections to the Samba ports. On modern Linux distributions using firewalld, you might see rules allowing ssh but lacking entries for samba or cifs. Similarly, if you are using iptables directly, ensure there are no DROP rules targeting destination port 445.

Verifying Firewall Configuration

The most common culprit for this symptom is an overly restrictive firewall. Start by checking the status of your active firewall service. For systems using firewalld, run the following command to list all allowed services:

sudo firewall-cmd --list-all

Look for ports: or services: in the output. If you do not see port 445/tcp or the service name samba, you need to add it. Use these commands to permanently allow Samba traffic:

sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload

If you are using ufw (Uncomplicated Firewall), check its status with sudo ufw status. You may need to enable the profile or manually allow the port:

sudo ufw allow samba
sudo ufw reload

After adjusting the firewall, test connectivity again. Note that some cloud providers also have security groups at the hypervisor level. Ensure your instance’s security group permits inbound TCP traffic on ports 139 and 445 from your client’s IP address. This is often overlooked because the SSH rule usually exists, leading to false confidence in network accessibility.

Inspecting Samba Authentication Settings

If the firewall is correctly configured, the next likely cause is authentication failure within the Samba configuration itself. Samba maintains its own password database separate from the system’s user accounts. A user might exist on the OS and be able to SSH in, but lack a valid Samba password hash. Check the global section of your /etc/samba/smb.conf file. Look for the map to guest directive. If set to bad user or never, anonymous access is disabled, requiring valid credentials. Verify that the shared directory has the correct permissions defined in the config:

[myshare]
   path = /srv/samba/myshare
   browseable = yes
   read only = no
   valid users = username
   create mask = 0664
   directory mask = 0775

Ensure that the valid users line includes the account you are trying to use. If you recently changed the Linux user password, you must update the Samba password as well. Use the smbpasswd command to add or modify the Samba-specific password:

sudo smbpasswd -a username

Restart the Samba services to apply any configuration changes:

sudo systemctl restart smbd nmbd

Checking SELinux and AppArmor Policies

On enterprise-grade Linux distributions like RHEL, CentOS, or Fedora, SELinux can block Samba access even if firewalls and permissions are correct. SELinux enforces mandatory access controls that restrict what processes can touch which files. If Samba tries to serve files from a directory labeled incorrectly, it will return a permission denied error. Check the SELinux context of your share directory using ls -Z. It should ideally have a context like samba_share_t. If it does not, you can relabel it using the semanage tool:

sudo semanage fcontext -a -t samba_share_t "/srv/samba/myshare(/.*)?"
sudo restorecon -Rv /srv/samba/myshare

You can also check SELinux audit logs for denials related to Samba:

sudo ausearch -m avc -ts recent | grep smbd

For Ubuntu and Debian systems, AppArmor serves a similar function. Check if the Samba daemon is confined and if any profiles are logging denials in /var/log/syslog. While less common than firewall issues, strict MAC (Mandatory Access Control) policies can silently block access without obvious error messages in standard logs.

Testing Client-Side Resolution

Sometimes the issue lies with how the client resolves the server hostname or IP. DNS caching issues or incorrect hosts file entries can cause intermittent failures. Try accessing the share using the direct IP address instead of the hostname to rule out resolution problems. Use the smbclient tool to test connectivity from the command line:

smbclient //IP_ADDRESS/share_name -U username

If this command succeeds, the server is reachable and authenticated properly. The issue then lies with the client’s mounting process or GUI frontend. If it fails, review the error message carefully. A "Connection refused" indicates a firewall or service down issue, while "Access Denied" points to authentication or permission mismatches. For more detailed troubleshooting on connection stability, consider reviewing Troubleshooting SSH Connection Issues on Linux. Additionally, if you encounter symlink-related errors within the share, check Symlinks in Samba Share Created on Linux Client Not Working on Server.

Frequently Asked Questions

Why does my Samba share show as inaccessible even though I can ping the server?

Pinging only verifies ICMP echo requests, which are different from TCP connections used by Samba. Your firewall may be allowing ICMP and SSH traffic while actively blocking TCP ports 139 and 445. You must explicitly configure your firewall to permit SMB/CIFS traffic.

How do I reset my Samba password if I forgot it?

You can reset the Samba password using the smbpasswd command. Run sudo smbpasswd username to change an existing user's password, or sudo smbpasswd -a username to add a new user to the Samba database. This password is separate from your Linux system login password.

What causes "Permission Denied" after entering the correct password?

This usually indicates that the Linux file system permissions on the shared directory are too restrictive, or SELinux/AppArmor is blocking access. Ensure the owning user has read/write rights to the folder and that the valid users directive in smb.conf matches the authenticating user.

Can I disable authentication for a Samba share entirely?

Yes, you can enable guest access by setting map to guest = bad user in the global section and guest ok = yes in the share definition. However, this exposes your data to anyone on the network and is generally discouraged for sensitive information.

Why does Windows fail to map the drive while Linux mounts it successfully?

Windows requires SMB version 2 or higher, while older Linux configurations might default to SMB1. Ensure your smb.conf specifies server min protocol = SMB2. Additionally, Windows may cache old credentials; try clearing the stored passwords in the Windows Credential Manager before remapping.