Samba shares, accounts and live connections, with every change previewed
A terminal UI (TUI) for smbd on Linux. A Samba file server: the shares it exports, the accounts that can reach them, and who is connected right now.
v0.2.2betafile-sharingMIT
Every share on one list, worst first: what it exports, who may reach it, and the Unix mode of the directory behind it
A terminal UI for a Samba file server: the shares it exports, the accounts that can reach them, and who is connected right now.
The shares are listed worst first. A path that does not exist, a directory somebody left at mode 0777, a writable share open to guests — each one is a sentence on the row rather than something to work out from testparm and a stat. The configuration comes from testparm -s — what the server resolved rather than what anybody typed — and every share carries the mode, the owner and the SELinux label of the directory behind it.
A change goes through Samba's own parser before it goes anywhere near /etc. A share is edited in a guided form, staged, read back with testparm -s and shown as a diff — and only then confirmed. It is installed with install -m 644 and picked up with a reload that disconnects nobody. Removing a share takes away the drop-in and the one include line that reached it, never the directory it exported.
Samba as an Active Directory domain controller is deliberately out of scope.
Run tui-samba --demo to drive a sample server: every key works, every command is built and previewed for real, and nothing touches your system.
Keys
Key
Action
tab / 1-4
Move between the shares, the accounts, the live connections and the server itself
enter
Open the selected row in full
e
Edit the selected share, checked by testparm and shown as a diff first
n
Add a share to a drop-in of its own, offering to create its directory
X
Remove a share tui-samba wrote, after its name has been typed back
o
Edit the server settings: workgroup, minimum protocol, hosts allow
a
Add a Samba account, its password read from standard input
p
Set the selected account's password
E / D
Enable or disable the selected account
x
Remove the selected account from the Samba database, leaving the Unix one
r
Tell the running server to re-read its configuration
t
Ask the server what an anonymous client on the network sees
/
Filter the rows of the current screen
?
Help
q
Quit
Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.
Compatibility
This tool is a face on the program below, so its version matters. Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as (untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.
samba
smbd ≥ 4.11
Binary
smbd
Minimum
4.11
Probed with
smbd --version
Tested
4.24.6
Needs a version this new
status-jsonsince 4.17
What changes on older versions
samba <4.17
smbstatus --json does not exist, so the connections are read from the text output; the sessions, the shares in use and the open files are all there, and the per-session encryption is whatever those columns carry
samba >=4.17
smbstatus --json is used, so a session's dialect, signing and encryption come from Samba's own document instead of from columns separated by runs of spaces a value may also contain
samba >=4.11
SMB1 is off by default from this release, so a server min protocol below SMB2 is something somebody set on purpose — which is why tui-samba raises it and says nothing about a server on the default
samba >=4.11
testparm --show-all-parameters is not used at all: it prints every parameter Samba has rather than this server's, so the effective configuration comes from testparm -s
samba >=4.11
a machine may have no Samba at all, and that is a normal machine rather than a failure: the tool says so on its first screen and --check reports it as "installed": false and exits 0
Maintain samba? You are welcome to help shape this tool. About → maintainers
Guides
Written after the work, from a machine the commands were actually run on. Every guide that mentions tui-samba is listed here.
tui-dc administers a Samba Active Directory domain from a terminal on the controller; Samba Conductor runs the same kind of domain from a browser, with single sign-on and Google Workspace sync. This page says which one fits which job.
Install
Once per machine, then every tool in the family is one pacman away.
Add the repository
$ curl -fsSL https://pkgs.tui.tools/install.sh | sh
Or run the same thing yourself, one command at a time
A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
Upgrades then arrive with the rest of your system updates.
!
Not published yet. The command is what it will be once the package repository at pkgs.tui.tools is live. Until then, use the static binary or build from source.
Arch Linux (AUR) · tui-samba-bincoming soon
$ paru -S tui-samba-bin
The -bin package installs the released static binary.
Once per machine, then every tool in the family is one apt away.
Add the repository
$ curl -fsSL https://pkgs.tui.tools/install.sh | sh
Or run the same thing yourself, one command at a time
A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
Upgrades then arrive with the rest of your system updates.
!
Not published yet. The command is what it will be once the package repository at pkgs.tui.tools is live. Until then, use the static binary or build from source.
Needs the tui-tools repository, a one-time setup you do once per machine.
openSUSE · tui-sambacoming soon
$ sudo zypper install tui-samba
The rpm repository is shared with dnf; zypper support is not tested yet.
One static binary. Verify it against checksums.txt from the same release.
From source · tui-samba
$ git clone https://github.com/tui-tools/tui-samba
cd tui-samba && make build
sudo install -m0755 bin/tui-samba /usr/local/bin/tui-samba
Needs Go 1.27 or newer.
What it can do to your machine
✓
Preview, then confirm
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
•
Escalates for actions
Reading the configuration usually needs nothing: smb.conf is world-readable. The password database and smbstatus are root-only, and every change escalates through sudo -n, which never prompts: writing or removing a share, creating its directory, reloading, and every smbpasswd call.
✓
No daemon, no state of its own
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
✕
Opens network connections
One key runs smbclient -L localhost -N, which opens a connection to this machine's own SMB port to read the share list an anonymous client is shown. It is previewed and confirmed like every other command, and sends no password. Nothing else here opens a socket.
✓
Static binary
Released statically linked, with no runtime dependencies to install.
✓
Signed release, with provenance
checksums.txt carries a keyless cosign signature from this repository's release workflow, every archive has a CycloneDX SBOM, and every archive, package and the checksum file carry SLSA build provenance. The security page shows the three commands that check it.
Reporting
Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.
## tui-samba v0.2.2
tui-samba 0.2.2: tui-kit v0.4.4
tui-samba 0.2.2 moves to tui-kit v0.4.4: every smbcontrol, smbpasswd and testparm step now runs in its own session without a controlling terminal, so a step that would prompt fails at once instead of hanging behind the UI (passwords keep arriving on standard input through `smbpasswd -s`), and a failed step reports its meaningful line, cleaned of escape codes. Command previews are POSIX shell-quoted, the README screenshots are re-rendered with continuous box borders, and the README banner now carries the kit's stability markers.
Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.
The commits in this release:
## Changelog
* a526116d86c3b95820571f6824bace7fa6b72065 0.2.2: tui-kit v0.4.4 (#19)
* 09f2276b1eb2a5eec9aa0c6a28279fb32bbed05c Bump anchore/sbom-action/download-syft in the github-actions group (#17)
* bdf693ce90bd14629c44d47c96cc9c2ab1ebc09a Bump the github-actions group with 4 updates (#18)
* 0860bc9fbf2fc799ddcb74ca2ceddeb7616581f8 README: link the tool's page on tui.tools (#16)
* 474ebfb96b80c3a0b37c6b3d93746be3622ea15c README: point the install snippet at the current release (#15)
## tui-samba v0.2.1
tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.
Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.
The commits in this release:
## Changelog
* 20d3b88d83f5f2d1c021984fba473d3cd3cff9b9 Bump tui-kit to v0.3.0 (#14)
## tui-samba v0.2.0
Manage, not view (wave 3): create what does not exist, edit what does; lab-validated.
Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.
The commits in this release:
## Changelog
* bcf0f3ed3e61c2779fbfe9db7846f6da32762a2f A code of conduct that fits on one screen (#10)
* 52acc28357e1417249ac3f6c6d7fb2afa3bedac4 Add --report, and a bug form that asks for it (#11)
* ca7d715fbb406981aa3b863de70cbea5e322a750 Bump anchore/sbom-action/download-syft (#4)
* 7ee63f63b733654622e51de7cf555eeec58ad270 Carry the OpenSSF Best Practices badge (#8)
* aadd42fc106d3fcec0e3f73ffe7ecb3469d8c807 Carry the family's gitleaks configuration unchanged (#2)
* 9a7e1fb1f69c2e4f544ef223cedf0354073ee466 Delete shares, edit global settings, create share paths (#13)
* 038653fe7e3988e00933d6df8f99860ed17a8f3c Do not search the distro line for the host name (#12)
* 71f27d876158fc276318207013d4a9487c408f37 Fetch the tag annotation before releasing (#6)
* a9032e7008a11614464ca5242abc7d8dcd6ba131 Pin what CI runs, fuzz the parsers, and say the releases are signed (#3)
* 8e1da2109c2848d92bd7a970e7e3154ceac1b5f5 Print the whole tag message, not only its body (#7)
* 4a4d82e72b03161786ab5fbdb6ab0c083bdcc442 Say beta once (#5)
* af6e6e69f2f3028394f93d8079a40502d30fb753 Take tui-kit v0.2.8: hashed pip install, provenance bundle on the release (#9)
## Changelog
* f04261f091c6b82520c47e9c381d067103b8ed36 Drop cross-repo dispatch; the package repo and the site poll releases
* ce8f4d5bae1ccd71c355f87bbe12f434b8ac8a5d Gate the release on a security job, and sign what it publishes (#1)
* aa902c4b7e38f19521a56a142997135a2fcc8659 Stop telling readers the packages are unpublished
## Changelog
* 2bda73b1ef0ef239a3589bca04e62314e3c14567 Packages are available from pkgs.tui.tools
* bb3f861963571e43390c955c7b54c1fd471c7e8a Re-pin the kit at v0.2.3
* 3a1da992528511c99ce5dfc030a6db7a9d212d60 Record Samba 4.24.6 from a machine that really runs it
* d3f323ecaee9f3cda24a84915d3b24cc7a8cef03 Ship the tool as a .deb, an .rpm and a pacman package
## Changelog
* c8ae2e409f1b75bf402de49367340851387c4fbf Fit the help panel on a 26 row terminal
* 60040d0fc123821997731f9cf8baa2ee28a5408a Initial commit
* d70e4f28473af38279809843a8f4a2239a88e51b Turn the template into tui-samba
