To establish a Samba file share between an Ubuntu EC2 instance and a Windows Server EC2 instance, you must configure the Samba daemon on the Linux host to listen on port 445, ensure both instances reside in the same Virtual Private Cloud (VPC) with matching security group rules, and create valid user credentials that match across both operating systems. This setup allows the Windows machine to mount the Linux directory as a network drive using standard SMB/CIFS protocols while maintaining secure access controls through AWS network isolation.
Network Configuration and Security Groups
The most common failure point when connecting EC2 instances is not the software configuration but the network layer. Because EC2 instances are isolated by default, you cannot simply install Samba and expect connectivity. Both the Ubuntu and Windows instances must be launched within the same VPC. If they are in different subnets, ensure that route tables allow traffic between them, though keeping them in the same subnet simplifies troubleshooting significantly.
You must edit the Security Group attached to the Ubuntu EC2 instance. By default, these groups block all inbound traffic except what is explicitly allowed. You need to add an inbound rule for TCP traffic on port 445, which is the standard port for Microsoft-DS (SMB over TCP). It is critical to restrict the source of this rule. Do not set the source to
0.0.0.0/0 unless you are exposing your file server to the entire internet, which is a severe security risk. Instead, specify the private IP address or the CIDR block of the Windows Server's subnet. This ensures that only authorized instances within your trusted infrastructure can attempt to connect to the Samba service.
The Windows Server also needs an outbound rule allowing traffic to the Ubuntu instance on port 445, although default security groups usually permit all outbound traffic. If you have customized the Windows security group, verify that it allows outbound TCP 445. Additionally, ensure that Network Discovery is enabled on the Windows Server if you plan to browse for shares visually, though mapping via IP address does not strictly require discovery services.
Samba Installation and Basic Configuration
Once the network path is verified, install the Samba package on the Ubuntu instance. Use the following commands to update your package list and install the necessary components:
sudo apt update
sudo apt install samba
After installation, you should stop the Samba service to edit its configuration file safely. The main configuration file is located at
/etc/samba/smb.conf. Open this file with a text editor such as
nano or
vim. You will need to define a new share section. A typical basic configuration looks like this:
[MyShare]
path = /srv/samba/myshare
browseable = yes
read only = no
guest ok = no
valid users = ubuntuuser
create mask = 0775
directory mask = 0775
Replace
MyShare with your desired share name, and ensure the
path points to a directory you have created. The
valid users directive specifies which system users can access this share. It is crucial that the user defined here exists on the Ubuntu system. Furthermore, Samba maintains its own password database separate from the system password. You must add the user to the Samba database using the command:
sudo smbpasswd -a ubuntuuser
This command prompts you to set a password specifically for Samba authentication. Note that this password does not have to match the user's login password for SSH or console access, but it must be remembered for accessing the share. After saving the configuration file, restart the Samba services to apply changes:
sudo systemctl restart smbd nmbd
Verify that the service is running and listening on the correct port using
sudo netstat -tlnp | grep :445. If you see output indicating
smbd is listening on 0.0.0.0 or the specific private IP, the service is ready. For more granular permission issues, refer to our guide on
Resolving Samba Permissions Inconsistency Across Multiple Systems.
Windows Client Connection
On the Windows Server EC2 instance, open File Explorer. In the address bar, type the UNC path to the Ubuntu share:
\\\MyShare. Replace
Ubuntu_Private_IP with the actual internal IP address of your Ubuntu instance. Windows will prompt for credentials. Enter the username (
ubuntuuser) and the Samba password you set earlier.
If the connection fails, check the Windows Event Viewer under Applications and Services Logs -> Microsoft -> Windows -> SMBClient for detailed error codes. Common errors include "Access Denied" or "Network Path Not Found." If you receive "Access Denied," verify that the username matches exactly and that the password is correct. If you get "Network Path Not Found," double-check the Security Group rules on the Ubuntu side to ensure port 445 is open from the Windows instance's IP.
To make the connection persistent, right-click the mapped drive in File Explorer and select "Map network drive." Choose a drive letter and check "Reconnect at sign-in." This ensures that the share is available every time you log into the Windows Server. For troubleshooting connection issues, see
Troubleshooting Network-Shared Hard Drive Connection Issues with Samba.
Maintaining Access and Troubleshooting
Periodically, you may encounter issues where the share becomes inaccessible despite no changes being made. This can happen due to credential caching on the Windows side or stale sessions. Clearing cached credentials on Windows involves opening the Credential Manager and removing any entries related to the Ubuntu IP or hostname. Then, try reconnecting.
Ensure that the filesystem permissions on the Ubuntu side align with the Samba configuration. Even if Samba grants access, the underlying Linux directory permissions must allow the user to read or write. Run
ls -l /srv/samba/myshare to check ownership. If the directory is owned by root, the user might still be denied access depending on the
create mask settings. Adjust ownership using
sudo chown -R ubuntuuser:ubuntuuser /srv/samba/myshare if necessary.
Frequently Asked Questions
Why can't I ping the Ubuntu instance from Windows?
EC2 instances often block ICMP echo requests (ping) by default in their security groups for security reasons. This does not affect Samba functionality, which uses TCP port 445. You can verify connectivity by attempting to map the drive directly; if the network path is found, the lack of ping is irrelevant to file sharing.
How do I change the Samba password after initial setup?
You can change the Samba password at any time using the command
smbpasswd ubuntuuser on the Ubuntu terminal. This updates the internal Samba password database without affecting the user's system login password. Ensure you update the credentials in Windows Credential Manager if you have previously saved the old password.
Can I use the public IP to access the share?
It is highly discouraged to expose Samba to the public internet via a public IP. If you must access the share remotely, use a VPN connection to your VPC instead. Exposing port 445 to the world makes your instance vulnerable to ransomware and brute-force attacks. Always keep Samba accessible only via private IPs within your VPC.
What if I get 'Access Denied' even with correct passwords?
Check the underlying Linux directory permissions. Samba checks its own config first, but then hands off access to the Linux kernel. If the directory permissions do not allow the user to write, Samba will deny the request. Ensure the owner of the directory matches the
valid users in
smb.conf or adjust the group permissions accordingly.
How do I list available shares from the Ubuntu side?
You can list all configured shares on the Samba server by running
smbclient -L localhost -U ubuntuuser. This command queries the local Samba daemon and displays all available shares along with their descriptions. This is useful for verifying that your new share appears correctly before attempting to connect from Windows.