Building a Raspberry Pi 4 NAS and Media Share with Samba and a USB Drive
Gigabit Ethernet and USB 3.0 make the Raspberry Pi 4 a capable network-attached storage (NAS) box. Plug in a USB hard disk, run Samba, and every Windows PC, Mac, Android phone and smart TV on your home network can open the same folders. It costs far less than a commercial NAS and uses only a few watts.
This tutorial covers the complete setup: preparing and permanently mounting the drive, installing and configuring Samba with a private share and a read-only media share, connecting from clients, and checking transfer speed. Use the 64-bit Lite image, since a NAS needs no desktop.
Planning the Storage
| Decision | Recommendation | Reason |
|---|---|---|
| Drive | External HDD or SSD with its own power, or a 2.5 inch drive on a good supply | The Pi's USB ports share a limited current budget |
| Filesystem | ext4 | Native Linux permissions and reliability; NTFS via ntfs-3g is slower |
| Connection | Blue USB 3.0 port, Pi on wired Ethernet | Wi-Fi throughput is much lower and less consistent |
| Mount point | /srv/nas | A fixed path that does not depend on a logged-in user |
Preparing and Mounting the Drive
Find the drive with lsblk. It is usually /dev/sda. The steps below erase it, so double-check the name and size first.
#!/bin/bash
# prepare_drive.sh - WARNING: erases the drive given as the first argument
# Usage: sudo bash prepare_drive.sh /dev/sda
set -e
DISK="$1"
[ -b "$DISK" ] || { echo "No such block device: $DISK"; exit 1; }
lsblk "$DISK"
read -p "Erase ALL data on $DISK? Type YES: " ans
[ "$ans" = "YES" ] || exit 1
# 1. Create a GPT partition table with one partition using the whole disk
parted -s "$DISK" mklabel gpt mkpart nas ext4 0% 100%
sleep 2
PART="${DISK}1"
# 2. Format as ext4 with the label NAS
mkfs.ext4 -F -L NAS "$PART"
# 3. Create the mount point
mkdir -p /srv/nas
# 4. Add an fstab entry by UUID so the mount survives device renaming.
# nofail lets the Pi still boot if the drive is unplugged.
UUID=$(blkid -s UUID -o value "$PART")
echo "UUID=$UUID /srv/nas ext4 defaults,noatime,nofail 0 2" >> /etc/fstab
# 5. Mount everything in fstab and reload systemd's view of it
systemctl daemon-reload
mount -a
# 6. Create folders and give ownership to the sharing group
groupadd -f nasusers
mkdir -p /srv/nas/private /srv/nas/media
chown -R root:nasusers /srv/nas/private /srv/nas/media
chmod -R 2775 /srv/nas/private /srv/nas/media # setgid keeps the group on new files
df -h /srv/nas
Mounting by UUID matters because USB device names can change between boots when more than one drive is attached. The nofail option prevents the Pi from dropping into emergency mode if the disk is missing.
Installing and Configuring Samba
sudo apt install -y samba sudo usermod -aG nasusers $USER # your Linux user joins the group sudo smbpasswd -a $USER # set a separate Samba password sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak
Samba keeps its own password database, so smbpasswd -a is required even for an existing Linux user. Now append the two share definitions to the end of /etc/samba/smb.conf:
# Private share: read/write for members of the nasusers group only
[private]
path = /srv/nas/private
valid users = @nasusers
read only = no
browseable = yes
# New files get group write permission so all members can edit them
create mask = 0664
directory mask = 2775
force group = nasusers
# Media share: everyone in nasusers can read; only listed users can write
[media]
path = /srv/nas/media
valid users = @nasusers
read only = yes
write list = yourname
browseable = yes
Replace yourname with your account. Check the file with testparm, which reports syntax errors and prints the effective settings, then apply it with sudo systemctl restart smbd.
Connecting from Clients
| Client | How to connect |
|---|---|
| Windows | File Explorer address bar: \\pi4lab\private, or Map network drive |
| macOS | Finder, Go, Connect to Server: smb://pi4lab.local/private |
| Linux desktop | File manager: smb://pi4lab.local/media |
| Android | A file manager with SMB support, or VLC's Local Network browser |
| Smart TV or Kodi | Add an SMB source pointing to the media share |
Enter the Samba username and password when asked. If Windows cannot find the Pi by name, use the IP address instead, for example \\192.168.1.50\media. Modern Windows hides SMB devices from the Network view by default, so typing the path is the reliable method.
Checking Performance
Copy a large video file to the share and watch the transfer rate. To separate network limits from disk limits, test the disk locally on the Pi with dd if=/dev/zero of=/srv/nas/test.bin bs=1M count=1024 oflag=direct status=progress and delete the file afterwards. If the local disk is much faster than the network copy, the network is the bottleneck; check that both devices are on wired gigabit links.
Also confirm the drive is attached at USB 3.0 speed with lsusb -t; a line ending in 5000M means USB 3.0, while 480M means it is running at USB 2.0 speed, usually because it is in a black port or the cable is USB 2.0 only.
Keeping the Drive Healthy
- Install
smartmontoolsand runsudo smartctl -a /dev/sdato read the drive's health counters. Many USB bridges pass these through; some need the option-d sat. - Always shut down with
sudo poweroffbefore unplugging the drive or the Pi, so ext4 can flush its journal. - Use the
noatimemount option shown in the script; it avoids a write every time a file is read. - Schedule a regular copy of the private share to a second drive with
rsync -a --delete, run from cron.
Troubleshooting
- Access denied: the user has no Samba password (
smbpasswd -a) or is not innasusers. Log out and back in afterusermodso the group applies. - Can read but not write to private: Linux permissions override Samba. Re-run the
chownandchmodcommands on the folder. - Share empty after reboot: the drive did not mount. Run
findmnt /srv/nas; if it is missing, check the UUID in/etc/fstabagainstblkid. - Slow transfers and drive disconnects: check
dmesgfor USB resets andvcgencmd get_throttledfor power problems. Use a self-powered drive. - Windows says the connection is insecure: guest access is disabled in Windows; always use a real Samba user as shown here.
Summary
Format the drive as ext4, mount it at /srv/nas by UUID with nofail, create a group-owned folder structure, and expose it through Samba shares restricted to that group. Add each person with smbpasswd -a, test with testparm, and connect from any device using the SMB path. Keep a separate backup, and your Pi 4 becomes a quiet, low-power home file and media server.