How to tune Samba for use on a Mac

Macs have had issues with SMB and Samba on servers that aren’t Macs.

Most forums online tell you to put really insane unsafe settings that make 0 sense. Socket options with static send buffer sizes and receive buffer sizes are something that I wouldn’t recommend anyone use because your server would be more prone to client dropouts than what can actually be achieved.

The real problem is that the default configuration is general. The most basic outline for a SMB server you can have. If you have problems with the norm, then your device is bad. But it’s leaving out the Apple-specific bullshit like attributes and whatnot that help it go faster.

That’s where the fruit module comes into play. It’s simple – Make Apple’s SMB work with this SMB. There’s no reason to include it in the default, but it will make your experience faster by a LOT.

Now – the exact nicks are abstract even to me. I’m not going to look into them much (again, after I’ve done them once years ago). But I will say that these options have indeed boosted my experience.

Let’s get on with it. Here’s what my NAS has.

#======================= Global Settings =======================
[global]
        fruit:copyfile = yes
        fruit:advertise_fullsync = yes
        log level = 2
        ea support = yes
        fruit:encoding = native
        fruit:locking = netatalk
        aio read size = 1
        logging = file
        map hidden = no
        store dos attributes = yes
        unix extensions = no
        fruit:metadata = stream
        min receivefile size = 16384
        log file = /var/log/samba/log.%m
        map to guest = bad user
        client min protocol = SMB3
        fruit:nfc_aces = no
        deadtime = 15
        aio write size = 1
        pam password change = yes
        oplocks = no
        fruit:zero_file_id = yes
        fruit:delete_empty_adfiles = yes
        netbios name = NAS
        keepalive = 30
        getwd cache = yes
        ntlm auth = true
        map readonly = no
        workgroup = WORKGROUP
        server min protocol = SMB3
        fruit:veto_appledouble = no
        fruit:model = MacSamba
        max log size = 5000
        server role = standalone server
        socket options = SO_KEEPALIVE SO_REUSEADDR SO_BROADCAST TCP_NODELAY IPTOS_LOWDELAY IPTOS_THROUGHPUT
        map system = no
        vfs objects = acl_xattr catia fruit streams_xattr
        server multi channel support = yes
        fruit:resource = xattr
        panic action = /usr/share/samba/panic-action %d
        level2 oplocks = no
        fruit:posix_rename = yes
        usershare allow guests = yes
        fruit:aapl = yes
        fruit:wipe_intentionally_left_blank_rfork = yes
        map archive = no
        kernel oplocks = no
        unix password sync = yes
        obey pam restrictions = yes
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        read raw = no
        passwd program = /usr/bin/passwd %u
        use sendfile = yes

There’s a lot here to ingest, so you can paste this into an LLM and have it explain everything for you, but the gist of things is that there’s a lot of useless crap removed, but also a lot of useful crap added and changed.

There’s some confusing stuff, like “read raw = no”? That’s weird. But it helps, and so do some other lines here, like option locks being disabled, extended attributes explicitly added into support, multichannel SMB (I do not get why this isn’t the default at all, I figure all devices support multichannel SMB and if not it can EASILY fall back into single channel mode) as well as actually useful socket options that just broadcast what I presume is the default, but I want to be safe

Try reading the docs or using an LLM to sort-of filter some crap, change it, see if you have some issues and always check logs when you’re doing stuff. I’ve battled-tested this, but you haven’t, so I’m not sure if it’ll work fine-and-dandy for you.

As always, these are just the general configuration declarations, so you’d have to actually summon your own shares and give them the correct configs. Thankfully, you can use Webmin for that, and also use aliases for shares with generally the same stuff (like ACLs and Time Machine support, whose differences only encompass the share name, path, and whatever else is different)

Thanks for reading! I hope you’re THOROUGH with this. This is Mission-Critical stuff that I wouldn’t like people complaining about until they read the entire post.