Mount a Storage Server as a network drive: Linux and Windows

Your Storage Server can be mounted on your server just like a local disk. On Linux it then appears as the directory /storage, on Windows as a network drive named storage. Programs, scripts and backup tools simply write to that path, and you no longer have to copy files back and forth by hand.

This guide walks you through all methods step by step, and every one of them is encrypted, because the data travels over the internet: SMB (also known as CIFS or Samba) with SMB 3 encryption or SSHFS on Linux, and SSHFS-Win over SFTP on Windows. It also covers mounting the storage permanently so that it is back after every reboot, and the error messages that come up most often in practice. The Linux commands apply to Debian 12 and 13, Ubuntu 22.04 and 24.04 as well as AlmaLinux and Rocky Linux 9. The Windows steps apply to Windows 10 and 11 and to Windows Server 2016 through 2025.

You will also find the most important commands, already filled in with your hostname and username, in the customer panel under your Storage Server, on the "Mount as Network Drive" card.

Before you start: credentials and access settings

You will find all the details in the customer panel under your Storage Server, in the "Connection Details" section: hostname, username and password. If no password is shown there, generate a new one with "Reset Password". Be aware, though, that this disconnects all existing connections, and servers that already have the storage mounted will need the new password afterwards.

On the same page, the "Access Settings" button opens the toggles for each type of access. Three of them matter for this guide:

• Samba / CIFS for the network drive via SMB (port 445).
• SSH / SFTP / SCP / rsync for SSHFS on Linux and SSHFS-Win on Windows (port 23).
• External Reachability must be switched on, because your server accesses the storage over the internet.

On newly ordered Storage Servers, all three are already enabled. The examples in this article use the values below. Replace them with your own:

The share is called backup on every Storage Server, so the full path is \\u123456.storage.kernelhost.net\backup on Windows and //u123456.storage.kernelhost.net/backup on Linux.

First, check whether your server can reach the storage at all: port 23 for SSHFS and SSHFS-Win, port 445 for SMB. On Linux:

timeout 5 bash -c '</dev/tcp/u123456.storage.kernelhost.net/23' && echo "Port 23 reachable"
timeout 5 bash -c '</dev/tcp/u123456.storage.kernelhost.net/445' && echo "Port 445 reachable"

On Windows, in PowerShell:

Test-NetConnection u123456.storage.kernelhost.net -Port 23

If the output shows TcpTestSucceeded : True, the way is clear. If no connection can be established, check the matching toggle ("SSH / SFTP / SCP / rsync" for port 23, "Samba / CIFS" for port 445), "External Reachability", as well as any firewall on your server that filters outgoing connections. If port 445 is permanently blocked, use SSHFS on Linux instead, as described further down.

Linux: mount the storage at /storage (SMB)

1. Install cifs-utils

The SMB client comes with the cifs-utils package. On Debian and Ubuntu:

apt-get update
apt-get install -y cifs-utils

On AlmaLinux, Rocky Linux and RHEL:

dnf install -y cifs-utils

2. Create the mount point and the credentials file

Create the directory where the storage should appear, and a file for the credentials:

mkdir -p /storage
nano /etc/storage-credentials

Contents of the file:

username=u123456
password=YOUR_PASSWORD

After that, only root should be able to read the file:

chmod 600 /etc/storage-credentials

The reason for a separate file: the password then ends up neither in /etc/fstab, which every user can read, nor in your command history. Special characters in the password are not a problem in this file, and you do not need quotation marks.

3. Mount it manually once and test

mount -t cifs //u123456.storage.kernelhost.net/backup /storage -o credentials=/etc/storage-credentials,seal,iocharset=utf8,uid=0,gid=0,file_mode=0660,dir_mode=0770

The options in detail:

• seal encrypts the connection with SMB 3. Since the data travels over the internet, you should never leave this option out.
• iocharset=utf8 makes sure that accented letters and other special characters in file names come through correctly.
• uid and gid determine which local user and group own the files. If the web server needs to write there, for example, use uid=www-data,gid=www-data.
• file_mode and dir_mode set the permissions that Linux displays for files and directories. The storage itself does not keep any Linux permissions, so these values only apply on your server.

To check that everything works:

df -h /storage
touch /storage/testfile && ls -l /storage && rm /storage/testfile

df now shows the size of your Storage Server instead of the size of the local disk.

4. Mount permanently via /etc/fstab

To make the storage come back automatically after every reboot, add it to /etc/fstab. Unmount the test mount first:

umount /storage
nano /etc/fstab

Add this line at the end (as one single line):

//u123456.storage.kernelhost.net/backup  /storage  cifs  credentials=/etc/storage-credentials,seal,iocharset=utf8,uid=0,gid=0,file_mode=0660,dir_mode=0770,_netdev,nofail,x-systemd.automount  0  0

The three additions at the end are important:

• _netdev tells the system that this is a network drive, which can only be mounted once the network is up.
• nofail prevents your server from hanging at boot if the storage happens to be unreachable.
• x-systemd.automount mounts the storage only on the first access to /storage, and mounts it again automatically after an interruption.

Reload the configuration and mount:

systemctl daemon-reload
mount -a
ls /storage

If mount -a reports no error, the line is correct. After that you can safely test a reboot: thanks to nofail, the server boots even if something is wrong.

Linux alternative: SSHFS over port 23

SSHFS mounts the storage over SSH. That is worthwhile if port 445 is blocked in your setup or if you prefer working with an SSH key rather than a password. The connection is always encrypted. Set up either SMB or SSHFS on /storage, not both at the same time.

Install SSHFS on Debian and Ubuntu:

apt-get install -y sshfs

On AlmaLinux and Rocky Linux, the package is in the EPEL repository:

dnf install -y epel-release
dnf install -y fuse-sshfs

Generate a dedicated key and install it on the storage:

ssh-keygen -t ed25519 -f /root/.ssh/storage_ed25519 -N ""
cat /root/.ssh/storage_ed25519.pub | ssh -p 23 u123456@u123456.storage.kernelhost.net install-ssh-key

When you connect for the first time, confirm the storage's fingerprint with yes and enter the password once. The install-ssh-key command adds the key without overwriting existing keys. From then on, your server logs in without a password.

Mount it manually:

mkdir -p /storage
sshfs -p 23 -o IdentityFile=/root/.ssh/storage_ed25519,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 u123456@u123456.storage.kernelhost.net: /storage

The colon after the hostname stands for your home directory on the storage, which holds the same files you also see through the SMB share. For a permanent mount, this line goes into /etc/fstab:

u123456@u123456.storage.kernelhost.net:  /storage  fuse.sshfs  port=23,IdentityFile=/root/.ssh/storage_ed25519,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3,allow_other,_netdev,nofail,x-systemd.automount  0  0

allow_other also gives users other than root access, the web server for example. reconnect and the two ServerAlive values keep the connection stable when the network briefly hiccups. Then run systemctl daemon-reload and mount -a as above.

Windows: map the storage as the network drive "storage" with encryption

Out of the box, Windows maps network drives over SMB. However, that connection is only encrypted if one side explicitly requires it, and on Windows you cannot rely on that. To make sure nobody can read your data on its way over the internet, you connect the storage on Windows over SFTP, in other words over SSH. For that you need two free open-source programs: WinFsp provides the file system, and SSHFS-Win brings SFTP into File Explorer as a network drive.

1. Install WinFsp and SSHFS-Win

Open PowerShell with "Run as administrator" and paste these commands. They download both installation packages from GitHub and install them without asking for confirmation:

[Net.ServicePointManager]::SecurityProtocol = 'Tls12'
$ProgressPreference = 'SilentlyContinue'
Invoke-WebRequest https://github.com/winfsp/winfsp/releases/download/v2.1/winfsp-2.1.25156.msi -OutFile "$env:TEMP\winfsp.msi" -UseBasicParsing
Invoke-WebRequest https://github.com/winfsp/sshfs-win/releases/download/v3.5.20357/sshfs-win-3.5.20357-x64.msi -OutFile "$env:TEMP\sshfs-win.msi" -UseBasicParsing
Start-Process msiexec.exe -Wait -ArgumentList "/i `"$env:TEMP\winfsp.msi`" /qn /norestart"
Start-Process msiexec.exe -Wait -ArgumentList "/i `"$env:TEMP\sshfs-win.msi`" /qn /norestart"

If winget is available on your machine, for example on Windows 11, winget install -e --id SSHFS-Win.SSHFS-Win is enough as well. WinFsp is installed automatically along with it.

2. Map the drive in File Explorer

1. Open File Explorer and select "This PC" on the left.
2. Choose "Map network drive". On Windows 11 and Windows Server 2025 it sits in the menu behind the three dots, on Windows 10 and Windows Server 2016 to 2022 on the "Computer" tab.
3. Select S: as the drive and enter \\sshfs\u123456@u123456.storage.kernelhost.net!23 as the folder. The !23 at the end is the port. Without it, SSHFS-Win tries port 22.
4. Leave "Reconnect at sign-in" enabled and click "Finish".
5. Enter your password in the sign-in window and enable "Remember my credentials".
6. The drive first appears under a technical name. Right-click it, choose "Rename" and enter storage.

From now on, the storage is available under "This PC" as the drive storage and is reconnected automatically over an encrypted connection every time you sign in.

Using PowerShell

A single command gets it done faster. Run it in a normal PowerShell window, not in one opened with "Run as administrator", because File Explorer does not see drives from an elevated session. Windows prompts you for your password:

net use S: \\sshfs\u123456@u123456.storage.kernelhost.net!23 * /user:u123456 /persistent:yes

Then assign the name storage like this:

(New-Object -ComObject Shell.Application).NameSpace('S:').Self.Name = 'storage'

net use remembers the drive, but not the password. After a reboot, Windows therefore asks for it again the first time you open the drive. If you enable "Remember my credentials" in that window, Windows reconnects the drive from then on without asking. cmdkey does not help here, because SSHFS-Win only accepts credentials from its own sign-in window.

net use shows whether the drive runs through SSHFS-Win: in the line for S:, the network column shows WinFsp.Np. This connection always runs over SSH and is therefore encrypted.

SMB on Windows only with enforced encryption

Starting with Windows 11 24H2 and Windows Server 2025, Windows can require encryption for all outgoing SMB connections. Only then is the classic route via the backup share secure as well. Switch on encryption in a PowerShell window with administrator rights:

Set-SmbClientConfiguration -RequireEncryption $true -Confirm:$false

This setting applies to every SMB connection on the machine. If your server also uses other, older shares without encryption, you will no longer be able to reach them afterwards. Then map the drive in a normal window and check that the output shows Encrypted : True:

Test-NetConnection u123456.storage.kernelhost.net -Port 445
cmdkey /add:u123456.storage.kernelhost.net /user:u123456 /pass
net use S: \\u123456.storage.kernelhost.net\backup /persistent:yes
Get-SmbConnection -ServerName u123456.storage.kernelhost.net | Format-List ServerName,ShareName,Dialect,Encrypted

This method replaces SSHFS-Win. If S: is already connected via SSHFS-Win, disconnect it first with net use S: /delete. On older Windows versions, encryption cannot be enforced. Use SSHFS-Win there, as described above.

For services and scheduled tasks

A drive letter only applies within the logon session of the user who mapped it. Services, scheduled tasks and many backup programs therefore do not see S:. For automatic backups, it is best to use a program that speaks SFTP itself, such as rclone or restic, with the hostname u123456.storage.kernelhost.net, port 23 and your username.

Common errors and their causes

To disconnect, umount /storage is all it takes on Linux, and net use S: /delete on Windows. You delete stored SSHFS-Win credentials in Windows Credential Manager under "Generic Credentials", and those for SMB with cmdkey /delete:u123456.storage.kernelhost.net.

Network drive or backup tool?

A mounted drive is ideal when programs should write directly to a folder, for uploads, exports or archives, for example. For regular backups, tools such as rsync, BorgBackup or restic over SSH on port 23 are often the more robust choice: they only transfer changes, resume interrupted runs and, if you wish, encrypt the data on your server before it leaves. How to build a setup like that is covered in our article on a backup strategy for servers, and the guide to setting up a cron job helps with the schedule.

Tip: if you switch on "ZFS Snapshot Directory" in the Access Settings, the snapshots of your Storage Server appear as the read-only directory .zfs/snapshot. You can then restore individual files simply by copying them, without rolling back an entire snapshot.

Security in brief

• On Linux, always mount with seal or use SSHFS, and on Windows use SSHFS-Win, so that the data is transferred encrypted. Use classic SMB on Windows only with enforced encryption, available from Windows 11 24H2 and Windows Server 2025.
• The credentials file /etc/storage-credentials belongs to root and has the permissions 600.
• Switch off whatever you do not need in the Access Settings. If you only use SSHFS and SSHFS-Win, "Samba / CIFS" can stay off.
• For SSHFS, use a separate key just for the storage, as shown above. How to secure SSH in general is explained in the article Securing SSH and setting up key login.