Building a Raspberry Pi 4 NAS and Media Share with Samba and a USB Drive

Gigabit Ethernet and USB 3.0 make the Raspberry Pi 4 a capable network-attached storage (NAS) box. Plug in a USB hard disk, run Samba, and every Windows PC, Mac, Android phone and smart TV on your home network can open the same folders. It costs far less than a commercial NAS and uses only a few watts.

This tutorial covers the complete setup: preparing and permanently mounting the drive, installing and configuring Samba with a private share and a read-only media share, connecting from clients, and checking transfer speed. Use the 64-bit Lite image, since a NAS needs no desktop.

Planning the Storage

DecisionRecommendationReason
DriveExternal HDD or SSD with its own power, or a 2.5 inch drive on a good supplyThe Pi's USB ports share a limited current budget
Filesystemext4Native Linux permissions and reliability; NTFS via ntfs-3g is slower
ConnectionBlue USB 3.0 port, Pi on wired EthernetWi-Fi throughput is much lower and less consistent
Mount point/srv/nasA fixed path that does not depend on a logged-in user

Preparing and Mounting the Drive

Find the drive with lsblk. It is usually /dev/sda. The steps below erase it, so double-check the name and size first.

prepare_drive.sh - partition, format and permanently mount a USB drive
#!/bin/bash
# prepare_drive.sh - WARNING: erases the drive given as the first argument
# Usage: sudo bash prepare_drive.sh /dev/sda
set -e
DISK="$1"
[ -b "$DISK" ] || { echo "No such block device: $DISK"; exit 1; }
lsblk "$DISK"
read -p "Erase ALL data on $DISK? Type YES: " ans
[ "$ans" = "YES" ] || exit 1

# 1. Create a GPT partition table with one partition using the whole disk
parted -s "$DISK" mklabel gpt mkpart nas ext4 0% 100%
sleep 2
PART="${DISK}1"

# 2. Format as ext4 with the label NAS
mkfs.ext4 -F -L NAS "$PART"

# 3. Create the mount point
mkdir -p /srv/nas

# 4. Add an fstab entry by UUID so the mount survives device renaming.
#    nofail lets the Pi still boot if the drive is unplugged.
UUID=$(blkid -s UUID -o value "$PART")
echo "UUID=$UUID  /srv/nas  ext4  defaults,noatime,nofail  0  2" >> /etc/fstab

# 5. Mount everything in fstab and reload systemd's view of it
systemctl daemon-reload
mount -a

# 6. Create folders and give ownership to the sharing group
groupadd -f nasusers
mkdir -p /srv/nas/private /srv/nas/media
chown -R root:nasusers /srv/nas/private /srv/nas/media
chmod -R 2775 /srv/nas/private /srv/nas/media   # setgid keeps the group on new files

df -h /srv/nas

Mounting by UUID matters because USB device names can change between boots when more than one drive is attached. The nofail option prevents the Pi from dropping into emergency mode if the disk is missing.

Installing and Configuring Samba

sudo apt install -y samba
sudo usermod -aG nasusers $USER          # your Linux user joins the group
sudo smbpasswd -a $USER                  # set a separate Samba password
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

Samba keeps its own password database, so smbpasswd -a is required even for an existing Linux user. Now append the two share definitions to the end of /etc/samba/smb.conf:

Share definitions appended to /etc/samba/smb.conf
# Private share: read/write for members of the nasusers group only
[private]
   path = /srv/nas/private
   valid users = @nasusers
   read only = no
   browseable = yes
   # New files get group write permission so all members can edit them
   create mask = 0664
   directory mask = 2775
   force group = nasusers

# Media share: everyone in nasusers can read; only listed users can write
[media]
   path = /srv/nas/media
   valid users = @nasusers
   read only = yes
   write list = yourname
   browseable = yes

Replace yourname with your account. Check the file with testparm, which reports syntax errors and prints the effective settings, then apply it with sudo systemctl restart smbd.

Connecting from Clients

ClientHow to connect
WindowsFile Explorer address bar: \\pi4lab\private, or Map network drive
macOSFinder, Go, Connect to Server: smb://pi4lab.local/private
Linux desktopFile manager: smb://pi4lab.local/media
AndroidA file manager with SMB support, or VLC's Local Network browser
Smart TV or KodiAdd an SMB source pointing to the media share

Enter the Samba username and password when asked. If Windows cannot find the Pi by name, use the IP address instead, for example \\192.168.1.50\media. Modern Windows hides SMB devices from the Network view by default, so typing the path is the reliable method.

Checking Performance

Copy a large video file to the share and watch the transfer rate. To separate network limits from disk limits, test the disk locally on the Pi with dd if=/dev/zero of=/srv/nas/test.bin bs=1M count=1024 oflag=direct status=progress and delete the file afterwards. If the local disk is much faster than the network copy, the network is the bottleneck; check that both devices are on wired gigabit links.

Also confirm the drive is attached at USB 3.0 speed with lsusb -t; a line ending in 5000M means USB 3.0, while 480M means it is running at USB 2.0 speed, usually because it is in a black port or the cable is USB 2.0 only.

Keeping the Drive Healthy

  • Install smartmontools and run sudo smartctl -a /dev/sda to read the drive's health counters. Many USB bridges pass these through; some need the option -d sat.
  • Always shut down with sudo poweroff before unplugging the drive or the Pi, so ext4 can flush its journal.
  • Use the noatime mount option shown in the script; it avoids a write every time a file is read.
  • Schedule a regular copy of the private share to a second drive with rsync -a --delete, run from cron.

Troubleshooting

  • Access denied: the user has no Samba password (smbpasswd -a) or is not in nasusers. Log out and back in after usermod so the group applies.
  • Can read but not write to private: Linux permissions override Samba. Re-run the chown and chmod commands on the folder.
  • Share empty after reboot: the drive did not mount. Run findmnt /srv/nas; if it is missing, check the UUID in /etc/fstab against blkid.
  • Slow transfers and drive disconnects: check dmesg for USB resets and vcgencmd get_throttled for power problems. Use a self-powered drive.
  • Windows says the connection is insecure: guest access is disabled in Windows; always use a real Samba user as shown here.

Summary

Format the drive as ext4, mount it at /srv/nas by UUID with nofail, create a group-owned folder structure, and expose it through Samba shares restricted to that group. Add each person with smbpasswd -a, test with testparm, and connect from any device using the SMB path. Keep a separate backup, and your Pi 4 becomes a quiet, low-power home file and media server.