Samba client in LXC

What this does

The container speaks CIFS over the network and mounts the share on its own. The Proxmox host is just the network bridge — it does not see or manage the mount.

# Credentials stored in the CT (root:0600):
#   /etc/samba/credentials/<server>_<share>.cred

# What the script writes inside the CT:
pct exec <ctid> -- mount -t cifs //<server>/<share> /mnt/share \
                         -o "rw,file_mode=0664,dir_mode=0775,iocharset=utf8,
                             credentials=/etc/samba/credentials/<srv>_<sh>.cred"

Opening the tool

From ProxMenux's main menu, open Storage & Share Manager → Configure Samba Client in LXC (only privileged). ProxMenux first asks you to pick the target CT (and starts it if stopped); aborts if unprivileged. Once the CT is selected you see this sub-menu:

How the script runs (Mount flow)

┌─────────────────────────────────────────────┐
│  PHASE 1 — Pick CT, server, auth, share     │
│  (nothing touched yet)                      │
└──────────────────┬──────────────────────────┘
                   ▼
      Privileged-CT gate (share-common.func)
      ├─ pct list — pick CT
      ├─ Auto-start if stopped
      └─ Reads /etc/pve/lxc/<ctid>.conf
         └─ unprivileged: 1  → abort with help message
                   │
                   ▼
      Install Samba client packages (in CT)
      └─ pct exec apt-get install -y \
                   cifs-utils smbclient
         (skipped if already installed)
         Verifies: smbclient + mount.cifs both present
         Creates /etc/samba/credentials (mode 0700)
                   │
                   ▼
      Server selection (3 modes)
      ├─ Auto-discover (nmap from HOST on /24,
      │    ports 139/445, then nmblookup -A
      │    for NetBIOS names → "NETBIOS (ip)")
      ├─ Manual: type IP or hostname
      └─ Recent: parses /etc/fstab for previously
         used CIFS servers (one-click selection)
                   │
                   ▼
      Authentication (2 modes)
      ├─ User + password
      │   ├─ Username (whiptail inputbox)
      │   ├─ Password (passwordbox, hidden)
      │   ├─ Confirm password
      │   └─ ACTIVE VALIDATION against the server:
      │       creates a temp credentials file,
      │       runs smbclient -L with -A,
      │       distinguishes "guest fallback" from
      │       real auth success, retries on failure
      └─ Guest: validate guest access first
         (smbclient -L -N must succeed)
                   │
                   ▼
      Share selection
      ├─ Server returns shares → menu
      │   (filters out IPC$, ADMIN$, print$;
      │    for guest: only shares the user
      │    confirmed accessible during validation)
      └─ No shares / blocked → manual input
                   │
                   ▼
      Validate the chosen share still exists
                   │
                   ▼
      Mount-point picker (3 options)
      ├─ 1. Create new folder in /mnt
      │      (default: same name as the share)
      ├─ 2. Select existing folder in /mnt
      └─ 3. Enter custom path
                   │
                   ▼
      Mount-options preset (3 options)
      ├─ 1. Read/write
      │      rw,file_mode=0664,dir_mode=0775,
      │      iocharset=utf8
      ├─ 2. Read-only
      │      ro,file_mode=0444,dir_mode=0555,
      │      iocharset=utf8
      └─ 3. Custom — type your own option string
                   │
                   ▼
      Permanent mount? (yes/no)
      └─ yes → write entry to /etc/fstab
                   │
   ┌──────── Cancel   OR   Confirm ────┐
   ▼                                   ▼
Exit, nothing        ┌─────────────────┴─────────────────┐
was changed          │  PHASE 2 — Mount and persist       │
                     └─────────────────┬─────────────────┘
                                       ▼
                       Create mount point if missing
                       (pct exec mkdir -p <path>)
                                       ▼
                       If something is already mounted there,
                       offer to unmount first
                                       ▼
                       For user auth: write credentials file
                       /etc/samba/credentials/<srv>_<sh>.cred
                       (root:0600 inside the CT)
                                       ▼
                       pct exec mount -t cifs \
                            //<server>/<share> <mp> \
                            -o <opts>,credentials=<file>
                       (or  -o <opts>,guest  for guest)
                                       ▼
                       Smoke test: write a 0-byte file
                       and delete it (.test_write)
                       └─ no write access → "read-only"
                                       ▼
                       If "permanent" was chosen:
                       └─ Append to /etc/fstab inside CT:
                            //<srv>/<sh>  <mp>  cifs \
                              <opts>,credentials=…,
                              _netdev,
                              x-systemd.automount,noauto  0 0
                       (any prior entry for this mp is removed first)
                                       ▼
                       Print summary (server / share / mp /
                       auth mode / permanent yes-no)

Where the password lives

ProxMenux never stores the password in plain text in the mount command or in /etc/fstab. Instead it writes a credentials file inside the CT:

Path:    /etc/samba/credentials/<server>_<share>.cred
Owner:   root
Mode:    0600

Content:
    username=<your-username>
    password=<your-password>

Reference in /etc/fstab:
    //<server>/<share>  /mnt/<path>  cifs  rw,...,
        credentials=/etc/samba/credentials/<server>_<share>.cred,
        _netdev,x-systemd.automount,noauto  0  0

Mount options explained

Manual equivalent

Replicate the whole flow by hand — every command runs inside the CT via pct exec <ctid> -- or directly via pct enter <ctid>:

# 1. install the Samba client (one-time)
apt-get update
apt-get install -y cifs-utils smbclient

# 2. test reachability
ping -c 1 -W 3 10.0.0.50
nc   -z -w 3 10.0.0.50 445
smbclient -L 10.0.0.50 -U user

# 3. write the credentials file (root-only)
mkdir -p /etc/samba/credentials
chmod 700 /etc/samba/credentials
cat > /etc/samba/credentials/10.0.0.50_share.cred <<EOF
username=user
password=s3cret
EOF
chmod 600 /etc/samba/credentials/10.0.0.50_share.cred

# 4. mount it (one-shot)
mkdir -p /mnt/share
mount -t cifs //10.0.0.50/share /mnt/share \
  -o "rw,file_mode=0664,dir_mode=0775,iocharset=utf8,credentials=/etc/samba/credentials/10.0.0.50_share.cred"

# 5. make it permanent (safe boot defaults)
cat >> /etc/fstab <<EOF
//10.0.0.50/share  /mnt/share  cifs  rw,file_mode=0664,dir_mode=0775,iocharset=utf8,credentials=/etc/samba/credentials/10.0.0.50_share.cred,_netdev,x-systemd.automount,noauto  0 0
EOF
systemctl daemon-reload

Guest variant — no credentials file needed:

mount -t cifs //10.0.0.50/public /mnt/public \
  -o "rw,file_mode=0664,dir_mode=0775,iocharset=utf8,guest"

# fstab equivalent
echo "//10.0.0.50/public  /mnt/public  cifs  rw,file_mode=0664,dir_mode=0775,iocharset=utf8,guest,_netdev,x-systemd.automount,noauto  0 0" \
     >> /etc/fstab

View current mounts

Lists every CIFS mount point active inside the CT (mount -t cifs) plus every CIFS line in the CT's /etc/fstab. For each fstab entry the live mount status is shown — useful to spot permanent mounts that did not come up at boot.

Unmount Samba share

Combines the live mounts and the fstab entries into one list, lets you pick one, and removes the corresponding line from /etc/fstab plus the matching credentials file. The script does not run umount on the live mount — instead it tells you a CT reboot is needed for the unmount to take effect.

Test Samba connectivity

Diagnostic pass inside the CT: confirms cifs-utils is installed, lists current CIFS mounts, then for every server referenced in fstab checks ping → ports 139/445 → guest listing. "Requires authentication" on the guest test is normal for any server that doesn't expose public shares.

Troubleshooting

Related

• LXC Mount Points (Host ↔ Container) — the alternative for unprivileged CTs: mount on host, bind into CT.
• NFS client in LXC — sibling page, same pattern for NFS shares.
• Samba server in LXC — the inverse: expose folders from a CT over Samba.
• Samba / CIFS as Proxmox storage — register the share in Proxmox itself instead of inside a single CT.