How to mount a windows 11 smb share on truenas scale?

TrueNAS General
1

My TrueNAS CORE box mounts a Windows 11 SMB share, checks for file changes using rsync, creates a ZFS snapshot, and then syncs all changed files from Windows to TrueNAS.

Because TrueNAS CORE only supports SMB1, I want to migrate to TrueNAS SCALE.

How can I mount these Windows 11 SMB shares on a TrueNAS SCALE box?

2

Scale can’t mount smb shares. You should do it the other way around. Create the smb share in truenas and connect your windows box to that share via mapped network drive.

3

My TrueNAS box can do that, but only for SMB1.

For many years, my NAS has been reading my PCs from read-only shares, and my family can access all the older file versions on read-only shares on the NAS. THAT IS SECURE!

Why would I want to give that up and expose all PCs and backups with read-write access?

Locking down root while exposing all data to the world is NOT Security.

4

Well Scale can’t… Other then ceating different users with different permissions and different share acls there’s no officially supported way to do what you want to do.

5

The “correct” way to do this is for the client PCs to connect to a shared folder on the server and push their file changes to the server, not have the server pull them from the clients.

I know it means you’ll be retooling your backup mechanism, but it’s the better way of doing things.

6

well, your correct way enables a ransomware to encrypt nas data , think about that

7

Okay, you do you.

Advice has been offered, up to you whether you take it. Good luck :+1:

1 Like
8

then please, tell my how to deny a ransomware or any other software to delete or encrypt the data on the nas?

9

Okay, thinking out loud:

  • anti-virus on the client computers, don’t let the ransomware in in the first place
  • you’re already taking ZFS snapshots (and backups, tested, right?)
  • don’t have the backup tasks connect to the server with the same credentials your users use to connect for day-to-day operations. Ransomware on a PC will likely be running in the same userspace as the logged in user and hijacking SMB connections they’ve made. So have the backup processes on those PCs rsync over SSH with key-based auth and passwords disabled using a dedicated backup account
  • If your users want to browse and retrieve backed up files, give them read-only SMB access to the server

That’s how I’d do it.

10

There’s a good thread here on backup client software if you don’t like/want the rsync/ssh option:

Same thing applies, though: use different credentials for your backups to what your users use.

11

thanks , rsync over SSH with key-based auth is aswell a good solution

12

https://youtu.be/8AjuEG_Ug4g?is=rDjdAzpkN7UqNqXS it’s exactly what you need in terms of protection against RM.

A one more thing… you can do “pulled” replication to another nas to protect against physical theft or other form of physical destruction. At best in a different location over VPN.

13

Snapshots are your friends.

2 Likes
14

Thanks again.
Just for your information, I’ve been using TrueNAS with ZFS snapshots and encryption since 2014. Unfortunately, 2026 will be the last year I use it.

15

I had (somewhat) the same requirement. My solution is a docker container with an SMB client connecting to my Windows PC’s and using rclone to pull the remote data and store it on a TrueNAS dataset bind-mounted in the container. The same container also uses rclone over SSH to do the same for my Linux systems.

16

..not so sure about that…

AFAIK TrueNAS Core has supported SMB2/SMB3 for a long time.
Even back when it was still called FreeNAS, I believe SMB2 was already introduced around version 9.2 (or 9.3 ?)

17

If you know about and use snapshots I don’t understand why you bring up ransomware as a reason why pulling data to the server is better than pushing, for you.

1 Like
18

Thanks again! I’ll probably go with CachyOS.
In my setup, I want the server to be in control rather than the client and to keep exposure to a minimum. In the meantime, I’m running WSL with read-only mounts and using rsync.
thx