On a Ubuntu server with a SAMBA share, I am trying to allow access from some IP addresses and deny from others.

I configured smb.conf as follows:

        server string = %h server (Samba, Ubuntu)
        server role = standalone server
        map to guest = Bad User
        obey pam restrictions = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        unix password sync = Yes
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        dns proxy = No
        usershare allow guests = Yes
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb

        hosts allow = 10.4. 10.162. localhost
        hosts deny =

        comment = All Printers
        path = /var/spool/samba
        create mask = 0700
        printable = Yes
        browseable = No

        comment = Printer Drivers
        path = /var/lib/samba/printers

        comment = Data Folder
        path = /data
        force user = devuser
        force group = devgroup
        group = devgroup
        read only = No
        create mask = 0660
        force create mode = 0664
        directory mask = 0774
        directory mode = 0774
        force directory mode = 0774
        guest ok = Yes

Then I reload the config by running sudo smbcontrol all reload-config. Unfortunately I cannot restart the samba service because others are using it heavily.

After reloading the config, I can still access the share from my computer ( although explicitely denied. I tried rebooting my computer and it didn't change. Any ideas?

EDIT: If I set the deny list not in the global section but the share specifically it seems to work.


You will first need to kick everyone off of your samba server if you want modifications to take place. After everyone is offline, you can do a restart on the server and all modifications should take place.

  • Then why is there a "reload-config" option? This reload acutally seems to work for example if I create a new share in the config – Philipp F May 18 '18 at 13:22
  • If a computer with ip X currently modifying a file in a samba share Y , and you are trying to deny access for X to modify any share Y in samba, then first you will need to force X to eject share Y, and then you could hypothetically force Samba to reload its config file. – Barnabas Busa May 18 '18 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.