How to mount an SMB/CIFS share on Linux

Files on a Windows, NAS, or Samba server become ordinary Linux paths once an SMB/CIFS share is mounted on the client. A temporary mount keeps the password in a protected credentials file and leaves boot-time configuration alone, and it is ready when the intended server/share source is attached and the intended local user can read the share, and write to it when the server allows that.

mount.cifs comes from the cifs-utils package and hands the share to the Linux kernel cifs filesystem driver. A root-owned credentials file keeps the password out of shell history, while uid, gid, file_mode, and dir_mode make the mounted tree appear with usable Linux ownership and permissions when the server does not provide Unix ownership metadata.

Use a manual mount for temporary access, for testing a share before adding /etc/fstab, or for proving client options during troubleshooting. It lasts until it is unmounted or the client restarts. Replace the sample server, share, mount point, user, UID, and GID with values from the client and SMB server, and unmount the path when the temporary access is no longer needed.

1. Install the cifs-utils package, which provides the CIFS mount helper.

   $ sudo apt install cifs-utils

   cifs-utils also replaces the older smbfs package. On distributions without apt, install cifs-utils with the system package manager.

2. Create a protected directory for SMB credentials.

   $ sudo mkdir -p -m 750 /etc/samba/credentials

3. Create the credentials file for the share account.

   $ sudoedit /etc/samba/credentials/team-share

   /etc/samba/credentials/team-share

   username=alex
   password=replace-with-share-password
   domain=WORKGROUP

   Omit domain= when the account is local to the server or the server does not require a workgroup or domain value. Spaces around the equals sign make the mount fail with mount error(13): Permission denied, so each line stays a plain key=value pair.

4. Restrict the credentials file so only root can read it.

   $ sudo chmod 600 /etc/samba/credentials/team-share

5. Create the local mount point.

   $ sudo mkdir /mnt/team

6. Identify the UID and GID of the local user who will use the share.

   $ id alex
   uid=1001(alex) gid=1001(alex) groups=1001(alex)

   The SMB server still enforces access through the account in the credentials file. The uid and gid values control how files appear to local Linux processes after the share is mounted.

7. Mount the share at the local mount point.

   $ sudo mount -t cifs //files.example.net/team /mnt/team -o credentials=/etc/samba/credentials/team-share,uid=1001,gid=1001,file_mode=0660,dir_mode=0770

   Let the client negotiate the SMB dialect unless the server requires a specific version. List the server's shares first when the exact share name is unknown.
   Related: How to force an SMB protocol version
   Related: How to browse SMB shares with smbclient

8. Verify that Linux mounted the expected CIFS source.

   $ findmnt /mnt/team
   TARGET    SOURCE                   FSTYPE OPTIONS
   /mnt/team //files.example.net/team cifs   rw,relatime,vers=3.1.1,cache=strict,upcall_target=app,username=alex,domain=WORKGROUP,uid=1001,forceuid,gid=1001,forcegid,addr=172.20.0.2,file_mode=0660,dir_mode=0770,soft,nounix,serverino,mapposix,reparse=nfs,nativesocket,symlink=native,rsize=4194304,wsize=4194304,bsize=1048576,echo_interval=60,actimeo=1,closetimeo=1

9. List the files in the mounted share.

   $ ls -l /mnt/team
   total 4
   -rw-rw---- 1 alex alex 15 Nov  6 16:35 quarterly-plan.txt

   With dir_mode=0770, local accounts other than the mapped user and group get Permission denied here. The sudo -u alex prefix runs a command as the mapped user from a different account.

10. Read a file from the mounted share.

    $ cat /mnt/team/quarterly-plan.txt
    Q4 plan draft.

11. Create a temporary file on the mounted share.

    $ touch /mnt/team/manual-mount-check.txt

    Skip this write test and the next step when the share should not be written to.

12. Remove the temporary file.

    $ rm /mnt/team/manual-mount-check.txt

13. Unmount the share when temporary access is finished.

    $ sudo umount /mnt/team