📖 Chapter 05 — SMB Shares

How Windows and Mac actually see your data. Datasets are a ZFS concept; SMB is the bridge.

Learning Objectives

• Explain what SMB is and why both Windows and Mac speak it natively
• Choose between "share per dataset" and "one share, many folders"
• Configure your first SMB share in the TrueNAS web UI
• Connect from Windows, Mac, and Linux

Introduction

Your datasets exist inside the pool. The pool lives inside the TrueNAS server. None of this is visible to your laptop until you create an SMB share — the protocol that exposes ZFS datasets to the rest of the network.

This chapter covers what SMB is, the two ways to lay out your shares, and how to actually connect.

What SMB is

SMB stands for "Server Message Block." It's a network file-sharing protocol that has been around since the 1980s and is now maintained by Microsoft. It is the default file-sharing protocol for both Windows and macOS — no client software required on either.

When you open File Explorer on Windows and type \\NAS\Photos, you're using SMB. When you open Finder on Mac and click "Connect to Server" with smb://NAS/Photos, you're using SMB. Same protocol, same data, same speed.

Linux can also use SMB (via the cifs-utils package) and most NAS appliances (Synology, QNAP, Unraid) also use SMB as their primary file-sharing protocol. It's the lingua franca of network file sharing.

SMB versions

SMB has gone through many versions. The current one to use is SMB3 (also called SMBv3). Modern TrueNAS uses SMB3 by default. Older versions (SMB1, SMB2) have known security issues and should be disabled.

In the TrueNAS web UI, the SMB service settings let you set the minimum and maximum SMB protocol versions. The right answer is: minimum SMB3, maximum SMB3. Don't allow anything older.

Two strategies for share layout

You have a choice when you set up shares. Both are valid. The conversation recommends one, with reasons.

Option A: One share per dataset (recommended)

Each top-level dataset gets its own SMB share. The family sees them as separate network drives:

When TK logs in, he sees all of them. When Mimi logs in, she sees all of them. When Lai logs in, he sees only the ones his permissions allow. The user experience is clean: each share is a top-level thing in File Explorer / Finder.

Option B: One share, many folders

One SMB share, with all the datasets accessible as folders inside it:

The user sees one network drive. Inside it, they navigate to find what they want. Permissions still work (you can't enter a folder you don't have access to), but the navigation is one level deeper.

Which to pick

For TK's family NAS, Option A: one share per dataset. Three reasons from the conversation:

1. Visibility maps cleanly to permissions. If you don't have access to `Private`, you don't even see `\\NAS\Private` in your network list. With Option B, the user sees `\\NAS\Home` and only finds out about access denial when they try to open `Private`. That's worse UX.
2. Mounting is easier. Most modern operating systems can auto-mount network shares at login. Mounting 8 shares at login is no harder than mounting 1, and gives you 8 network drives instead of 1 with 8 folders.
3. Permission debugging is easier. If Mimi can't see Photos, you check the Photos share's permissions. If Mimi can't see a folder inside `\\NAS\Home\Photos`, you check both the share's permissions and the folder's permissions and the dataset's permissions. Three places to look instead of one.

Creating a share in TrueNAS

In the TrueNAS web UI, the path is Shares → SMB → Add. The required fields are:

• Path — the dataset the share exposes. For a "Family" share, this is /mnt/tank/Family.
• Name — the share name as it appears on the network. For a "Family" share, the name is `Family`, and the network path is `\\NAS\Family`.
• Purpose — set to "Default share" for a regular share, "Multi-User Time Machine" for a Mac backup target, "External Share" for a share that points to data outside the pool (e.g. a USB drive).

That's the minimum. The advanced options let you tune:

• Access Based Share Enumeration (ABSE): only show the share to users who can access it. Recommended for `Private` shares. Turn this on per-share.
• Enabled: the share is live. Make sure this is on.
• Allow Guest Access: anyone on the network can read without logging in. Don't enable this for home use. Always require authentication.
• Read Only: the share is view-only. Useful for archives that should never be modified.

Connecting from each OS

From Windows

Open File Explorer. In the address bar, type \\NAS\Photos (replace `NAS` with your TrueNAS hostname or IP). Windows will prompt for credentials. Enter your TrueNAS username and password. Check "Remember my credentials" so you don't have to enter them every time.

To make the share persistent across reboots, right-click it in File Explorer → "Map network drive" → choose a drive letter → check "Reconnect at sign-in".

From macOS

Open Finder → Go → Connect to Server (or press Cmd+K). Type smb://NAS/Photos. Enter your credentials. To make it persistent, add it to your Login Items in System Settings → General → Login Items.

For Time Machine backups to a dedicated share, use the "Multi-User Time Machine" purpose in the share config. macOS will offer the share as a Time Machine destination automatically.

From Linux

Mount via cifs in fstab:

//NAS/Photos /mnt/photos cifs credentials=/etc/samba/creds,uid=1000,gid=1000 0 0

with /etc/samba/creds containing:

username=tk
password=yourpassword

And chmod 600 /etc/samba/creds so only root can read it.

Hidden shares and time machine

Two share types worth knowing about:

• Hidden shares: shares whose name ends with $ don't appear in the network browse list, but can still be accessed by typing the full path. Useful for admin shares like a Time Machine target that you don't want cluttering everyone's network list.
• Time Machine shares: TrueNAS supports Apple's Time Machine protocol via SMB. Configure the share with purpose "Multi-User Time Machine" and the share becomes a Time Machine destination automatically for any Mac user who can access it.

Share permissions vs dataset permissions

This is the part that confuses people. There are two layers of permissions between a user and a file:

1. Share permissions: can the user even see the share? Can they connect to \\NAS\Private?
2. Dataset permissions: once connected, can they read or write files inside?

Both have to allow the operation, or it's denied. So if Mimi can see `\\NAS\Private` (share permissions say yes) but the dataset says "Mimi has no access" (dataset permissions say no), she'll get "Access Denied" when she tries to open it.

Use Access Based Share Enumeration on sensitive shares to hide them entirely from users who can't access them. Then there's no "Access Denied" surprise — the share just doesn't appear in the first place.

Engineering Note

Summary

SMB is the protocol that exposes your ZFS datasets to the rest of the network. One share per dataset is the cleaner pattern for a home NAS. Use SMB3 only. Enable Access Based Share Enumeration on private shares. The share layer and the dataset layer both enforce permissions — both have to allow the operation, or it's denied.

Checklist

• ⬜ Plan your share list: which datasets become shares, what each is named
• ⬜ Verify SMB service is running and limited to SMB3 only
• ⬜ Connect from your own laptop and verify each share is visible and writable
• ⬜ Enable ABSE on private shares

Looking Ahead

Chapter 06 covers users and groups — the accounts that authenticate against SMB and the permission model that determines who can see what. The dataset-and-share design from Chapters 4 and 5 only works if the user model is right.

Ch 05 · v0.1 · drafted from the original ChatGPT conversation, July 2026