# The Sysadmin’s Guide to Secure, Persistent Samba Mounts in Linux

If you’ve ever found yourself fighting with /etc/fstab to get a network share to mount reliably after a reboot, you aren't alone. Between user-space permission locks and credential handling, it’s a classic point of failure for anyone building a home lab.

I recently spent some time cleaning up my own cross-platform network shares between my Linux (CachyOS) and Windows machines, and I learned a few things about moving from a "it works for now" setup to a "this is production-ready" configuration.

The Problem If you’re like me, you might have started by hardcoding credentials in your fstab or relying on insecure guest access (e.g., Set-SmbClientConfiguration -EnableInsecureGuestLogons $true). While that works to get the folder mounted, it’s a security nightmare and can lead to persistent connection loops or "permission denied" errors when the systemd daemon tries to mount the drive before the network is fully initialized.

The Solution: Credential Files & Strict Permissions To fix this, the best practice is to move credentials out of the config file entirely and into a dedicated, root-owned file. Here is how I secured my setup:

1.  Create a Secure Credentials File Instead of putting your username and password in /etc/fstab, create a dedicated directory for your credentials.
    

```shell
# Create the directory if it doesn't exist
sudo mkdir -p /etc/samba/credentials/

# Create your credential file
sudo nano /etc/samba/credentials/myshare.cred
```

Add your credentials to this file:

```plaintext
username=your_username
password=your_password
domain=WORKGROUP
```

#### 2\. Lock Down Permissions

This is the most important step. You want to make sure *only* the root user can read this file.

```shell
sudo chmod 600 /etc/samba/credentials/myshare.cred
```

#### 3\. Update `/etc/fstab`

Now, update your `/etc/fstab` to reference the credential file using an absolute path. This avoids issues where the system tries to look in a home directory that isn't mounted yet.

```plaintext
//server_ip/share /mnt/mountpoint cifs credentials=/etc/samba/credentials/myshare.cred,iocharset=utf8,uid=1000,gid=1000 0 0
```

#### 4\. Finalize and Automate

After saving your changes, always ensure your system acknowledges the new mount configuration:

```shell
sudo systemctl daemon-reload
sudo mount -a
```

### Why this matters

By moving away from hardcoded credentials and guest access, you’ve accomplished three things:

1.  **Security:** Your plaintext password is no longer sitting in a world-readable config file.
    
2.  **Stability:** Using an absolute path to a root-owned file ensures the mount can be processed by systemd regardless of which user is logged in.
    
3.  **Cleanliness:** Your `fstab` is now clean, readable, and professional.
    

Documentation is the difference between a hobbyist and a systems administrator. By spending the time to fix this properly, you stop "fighting" your network and start building infrastructure you can rely on.

*Have you struggled with Samba mounts in the past? Let me know in the comments how you handle your persistent network storage!*