--- /dev/null
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 18. Interdomain Trust Relationships</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.68.1"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="securing-samba.html" title="Chapter 17. Securing Samba"><link rel="next" href="msdfs.html" title="Chapter 19. Hosting a Microsoft Distributed File System Tree"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 18. Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 18. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:mimir@samba.org">mimir@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="InterdomainTrusts.html#id2587256">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2587328">Trust Relationship Background</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2587606">Native MS Windows NT4 Trusts Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2587643">Creating an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2587740">Completing an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2587825">Interdomain Trust Facilities</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2588034">Configuring Samba NT-Style Domain Trusts</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2588374">Samba as the Trusting Domain</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2588570">NT4-Style Domain Trusts with Windows 2000</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2588720">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2588732">Browsing of Trusted Domain Fails</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2588778">Problems with LDAP ldapsam and Older Versions of smbldap-tools</a></span></dt></dl></dd></dl></div><p>
+<a class="indexterm" name="id2587034"></a>
+<a class="indexterm" name="id2587041"></a>
+<a class="indexterm" name="id2587048"></a>
+<a class="indexterm" name="id2587054"></a>
+<a class="indexterm" name="id2587061"></a>
+<a class="indexterm" name="id2587068"></a>
+<a class="indexterm" name="id2587075"></a>
+<a class="indexterm" name="id2587082"></a>
+<a class="indexterm" name="id2587089"></a>
+Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
+will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
+adopt Active Directory or an LDAP-based authentication backend. This chapter explains
+some background information regarding trust relationships and how to create them. It is now
+possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba
+trusts.
+</p><p>
+<a class="indexterm" name="id2587106"></a>
+<a class="indexterm" name="id2587113"></a>
+<a class="indexterm" name="id2587120"></a>
+<a class="indexterm" name="id2587127"></a>
+<a class="indexterm" name="id2587134"></a>
+The use of interdomain trusts requires use of <span><strong class="command">winbind</strong></span>, so the
+<span><strong class="command">winbindd</strong></span> daemon must be running. Winbind operation in this mode is
+dependent on the specification of a valid UID range and a valid GID range in the <code class="filename">smb.conf</code> file.
+These are specified respectively using:
+</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2587168"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587181"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table><p>
+<a class="indexterm" name="id2587193"></a>
+<a class="indexterm" name="id2587200"></a>
+<a class="indexterm" name="id2587207"></a>
+<a class="indexterm" name="id2587214"></a>
+The range of values specified must not overlap values used by the host operating system and must
+not overlap values used in the passdb backend for POSIX user accounts. The maximum value is
+limited by the upper-most value permitted by the host operating system. This is a UNIX kernel
+limited parameter. Linux kernel 2.6-based systems support a maximum value of 4294967295
+(32-bit unsigned variable).
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+<a class="indexterm" name="id2587232"></a>
+<a class="indexterm" name="id2587239"></a>
+<a class="indexterm" name="id2587246"></a>
+The use of winbind is necessary only when Samba is the trusting domain, not when it is the
+trusted domain.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2587256"></a>Features and Benefits</h2></div></div></div><p>
+<a class="indexterm" name="id2587264"></a>
+<a class="indexterm" name="id2587271"></a>
+Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
+trust relationships. This imparts to Samba scalability similar to that with MS Windows NT4.
+</p><p>
+<a class="indexterm" name="id2587284"></a>
+<a class="indexterm" name="id2587291"></a>
+<a class="indexterm" name="id2587298"></a>
+<a class="indexterm" name="id2587305"></a>
+<a class="indexterm" name="id2587312"></a>
+Given that Samba-3 can function with a scalable backend authentication database such as LDAP, and given its
+ability to run in primary as well as backup domain control modes, the administrator would be well-advised to
+consider alternatives to the use of interdomain trusts simply because, by the very nature of how trusts
+function, this system is fragile. That was, after all, a key reason for the development and adoption of
+Microsoft Active Directory.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2587328"></a>Trust Relationship Background</h2></div></div></div><p>
+<a class="indexterm" name="id2587336"></a>
+<a class="indexterm" name="id2587343"></a>
+<a class="indexterm" name="id2587350"></a>
+<a class="indexterm" name="id2587357"></a>
+<a class="indexterm" name="id2587364"></a>
+<a class="indexterm" name="id2587371"></a>
+MS Windows NT3/4-type security domains employ a nonhierarchical security structure.
+The limitations of this architecture as it effects the scalability of MS Windows networking
+in large organizations is well known. Additionally, the flat namespace that results from
+this design significantly impacts the delegation of administrative responsibilities in
+large and diverse organizations.
+</p><p>
+<a class="indexterm" name="id2587388"></a>
+<a class="indexterm" name="id2587394"></a>
+<a class="indexterm" name="id2587401"></a>
+<a class="indexterm" name="id2587408"></a>
+<a class="indexterm" name="id2587414"></a>
+Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
+of circumventing the limitations of the older technologies. Not every organization is ready
+or willing to embrace ADS. For small companies the older NT4-style domain security paradigm
+is quite adequate, and so there remains an entrenched user base for whom there is no direct
+desire to go through a disruptive change to adopt ADS.
+</p><p>
+<a class="indexterm" name="id2587432"></a>
+<a class="indexterm" name="id2587439"></a>
+<a class="indexterm" name="id2587446"></a>
+<a class="indexterm" name="id2587452"></a>
+<a class="indexterm" name="id2587459"></a>
+<a class="indexterm" name="id2587466"></a>
+<a class="indexterm" name="id2587473"></a>
+With Windows NT, Microsoft introduced the ability to allow different security domains
+to effect a mechanism so users from one domain may be given access rights and privileges
+in another domain. The language that describes this capability is couched in terms of
+<span class="emphasis"><em>trusts</em></span>. Specifically, one domain will <span class="emphasis"><em>trust</em></span> the users
+from another domain. The domain from which users can access another security domain is
+said to be a trusted domain. The domain in which those users have assigned rights and privileges
+is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
+so if users in both domains are to have privileges and rights in each others' domain, then it is
+necessary to establish two relationships, one in each direction.
+</p><p>
+<a class="indexterm" name="id2587503"></a>
+<a class="indexterm" name="id2587510"></a>
+<a class="indexterm" name="id2587517"></a>
+<a class="indexterm" name="id2587524"></a>
+<a class="indexterm" name="id2587531"></a>
+Further, in an NT4-style MS security domain, all trusts are nontransitive. This means that if there are three
+domains (let's call them red, white, and blue), where red and white have a trust relationship, and white and
+blue have a trust relationship, then it holds that there is no implied trust between the red and blue domains.
+Relationships are explicit and not transitive.
+</p><p>
+<a class="indexterm" name="id2587547"></a>
+<a class="indexterm" name="id2587554"></a>
+<a class="indexterm" name="id2587561"></a>
+<a class="indexterm" name="id2587568"></a>
+<a class="indexterm" name="id2587575"></a>
+<a class="indexterm" name="id2587582"></a>
+<a class="indexterm" name="id2587588"></a>
+New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default.
+Also, all inter-ADS domain trusts are transitive. In the case of the red, white, and blue domains, with
+Windows 2000 and ADS, the red and blue domains can trust each other. This is an inherent feature of ADS
+domains. Samba-3 implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
+security domains in similar manner to MS Windows NT4-style domains.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2587606"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div></div><p>
+<a class="indexterm" name="id2587614"></a>
+<a class="indexterm" name="id2587624"></a>
+<a class="indexterm" name="id2587630"></a>
+There are two steps to creating an interdomain trust relationship. To effect a two-way trust
+relationship, it is necessary for each domain administrator to create a trust account for the
+other domain to use in verifying security credentials.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2587643"></a>Creating an NT4 Domain Trust</h3></div></div></div><p>
+<a class="indexterm" name="id2587651"></a>
+<a class="indexterm" name="id2587658"></a>
+<a class="indexterm" name="id2587665"></a>
+<a class="indexterm" name="id2587672"></a>
+<a class="indexterm" name="id2587679"></a>
+For MS Windows NT4, all domain trust relationships are configured using the
+<span class="application">Domain User Manager</span>. This is done from the Domain User Manager Policies
+entry on the menu bar. From the <span class="guimenu">Policy</span> menu, select
+<span class="guimenuitem">Trust Relationships</span>. Next to the lower box labeled
+<span class="guilabel">Permitted to Trust this Domain</span> are two buttons, <span class="guibutton">Add</span>
+and <span class="guibutton">Remove</span>. The <span class="guibutton">Add</span> button will open a panel in which
+to enter the name of the remote domain that will be able to assign access rights to users in
+your domain. You will also need to enter a password for this trust relationship, which the
+trusting domain will use when authenticating users from the trusted domain.
+The password needs to be typed twice (for standard confirmation).
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2587740"></a>Completing an NT4 Domain Trust</h3></div></div></div><p>
+<a class="indexterm" name="id2587748"></a>
+<a class="indexterm" name="id2587755"></a>
+<a class="indexterm" name="id2587762"></a>
+<a class="indexterm" name="id2587769"></a>
+<a class="indexterm" name="id2587776"></a>
+<a class="indexterm" name="id2587783"></a>
+A trust relationship will work only when the other (trusting) domain makes the appropriate connections
+with the trusted domain. To consummate the trust relationship, the administrator launches the
+Domain User Manager from the menu selects <span class="guilabel">Policies</span>, then select
+<span class="guilabel">Trust Relationships</span>, and clicks on the <span class="guibutton">Add</span> button
+next to the box that is labeled <span class="guilabel">Trusted Domains</span>. A panel opens in which
+must be entered the name of the remote domain as well as the password assigned to that trust.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2587825"></a>Interdomain Trust Facilities</h3></div></div></div><p>
+<a class="indexterm" name="id2587833"></a>
+<a class="indexterm" name="id2587840"></a>
+<a class="indexterm" name="id2587847"></a>
+<a class="indexterm" name="id2587854"></a>
+<a class="indexterm" name="id2587861"></a>
+<a class="indexterm" name="id2587868"></a>
+A two-way trust relationship is created when two one-way trusts are created, one in each direction.
+Where a one-way trust has been established between two MS Windows NT4 domains (let's call them
+DomA and DomB), the following facilities are created:
+</p><div class="figure"><a name="trusts1"></a><p class="title"><b>Figure 18.1. Trusts overview.</b></p><div class="mediaobject"><img src="images/trusts1.png" alt="Trusts overview."></div></div><div class="itemizedlist"><ul type="disc"><li><p>
+ DomA (completes the trust connection) <em class="parameter"><code>Trusts</code></em> DomB.
+ </p></li><li><p>
+ DomA is the <em class="parameter"><code>Trusting</code></em> domain.
+ </p></li><li><p>
+ DomB is the <em class="parameter"><code>Trusted</code></em> domain (originates the trust account).
+ </p></li><li><p>
+ Users in DomB can access resources in DomA.
+ </p></li><li><p>
+ Users in DomA cannot access resources in DomB.
+ </p></li><li><p>
+ Global groups from DomB can be used in DomA.
+ </p></li><li><p>
+ Global groups from DomA cannot be used in DomB.
+ </p></li><li><p>
+ DomB does appear in the logon dialog box on client workstations in DomA.
+ </p></li><li><p>
+ DomA does not appear in the logon dialog box on client workstations in DomB.
+ </p></li></ul></div><div class="itemizedlist"><ul type="disc"><li><p>
+ Users and groups in a trusting domain cannot be granted rights, permissions, or access
+ to a trusted domain.
+ </p></li><li><p>
+ The trusting domain can access and use accounts (users/global groups) in the
+ trusted domain.
+ </p></li><li><p>
+ Administrators of the trusted domain can be granted administrative rights in the
+ trusting domain.
+ </p></li><li><p>
+ Users in a trusted domain can be given rights and privileges in the trusting
+ domain.
+ </p></li><li><p>
+ Trusted domain global groups can be given rights and permissions in the trusting
+ domain.
+ </p></li><li><p>
+ Global groups from the trusted domain can be made members in local groups on
+ MS Windows domain member machines.
+ </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2588034"></a>Configuring Samba NT-Style Domain Trusts</h2></div></div></div><p>
+<a class="indexterm" name="id2588042"></a>
+This description is meant to be a fairly short introduction about how to set up a Samba server so
+that it can participate in interdomain trust relationships. Trust relationship support in Samba
+is at an early stage, so do not be surprised if something does not function as it should.
+</p><p>
+<a class="indexterm" name="id2588057"></a>
+<a class="indexterm" name="id2588064"></a>
+<a class="indexterm" name="id2588071"></a>
+<a class="indexterm" name="id2588078"></a>
+Each of the procedures described next assumes the peer domain in the trust relationship is controlled by a
+Windows NT4 server. However, the remote end could just as well be another Samba-3 domain. It can be clearly
+seen, after reading this document, that combining Samba-specific parts of what's written in the following
+sections leads to trust between domains in a purely Samba environment.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="samba-trusted-domain"></a>Samba as the Trusted Domain</h3></div></div></div><p>
+<a class="indexterm" name="id2588105"></a>
+<a class="indexterm" name="id2588112"></a>
+<a class="indexterm" name="id2588119"></a>
+<a class="indexterm" name="id2588126"></a>
+<a class="indexterm" name="id2588132"></a>
+In order to set the Samba PDC to be the trusted party of the relationship, you first need
+to create a special account for the domain that will be the trusting party. To do that,
+you can use the <span><strong class="command">smbpasswd</strong></span> utility. Creating the trusted domain account is
+similar to creating a trusted machine account. Suppose, your domain is
+called SAMBA, and the remote domain is called RUMBA. The first step
+will be to issue this command from your favorite shell:
+</p><p>
+</p><pre class="screen">
+<code class="prompt">root# </code> <strong class="userinput"><code>smbpasswd -a -i rumba</code></strong>
+New SMB password: <strong class="userinput"><code>XXXXXXXX</code></strong>
+Retype SMB password: <strong class="userinput"><code>XXXXXXXX</code></strong>
+Added user rumba$
+</pre><p>
+
+where <code class="option">-a</code> means to add a new account into the
+passdb database and <code class="option">-i</code> means to “<span class="quote">create this
+account with the Interdomain trust flag</span>”.
+</p><p>
+<a class="indexterm" name="id2588201"></a>
+<a class="indexterm" name="id2588208"></a>
+<a class="indexterm" name="id2588215"></a>
+<a class="indexterm" name="id2588222"></a>
+The account name will be “<span class="quote">rumba$</span>” (the name of the remote domain).
+If this fails, you should check that the trust account has been added to the system
+password database (<code class="filename">/etc/passwd</code>). If it has not been added, you
+can add it manually and then repeat the previous step.
+</p><p>
+<a class="indexterm" name="id2588246"></a>
+<a class="indexterm" name="id2588252"></a>
+<a class="indexterm" name="id2588259"></a>
+<a class="indexterm" name="id2588266"></a>
+After issuing this command, you will be asked to enter the password for the account. You can use any password
+you want, but be aware that Windows NT will not change this password until 7 days following account creation.
+After the command returns successfully, you can look at the entry for the new account (in the standard way as
+appropriate for your configuration) and see that the account's name is really RUMBA$ and it has the
+“<span class="quote">I</span>” flag set in the flags field. Now you are ready to confirm the trust by establishing it from
+Windows NT Server.
+</p><p>
+<a class="indexterm" name="id2588289"></a>
+<a class="indexterm" name="id2588296"></a>
+<a class="indexterm" name="id2588303"></a>
+<a class="indexterm" name="id2588310"></a>
+<a class="indexterm" name="id2588317"></a>
+Open <span class="application">User Manager for Domains</span> and from the <span class="guimenu">Policies</span> menu, select
+<span class="guimenuitem">Trust Relationships...</span>. Beside the <span class="guilabel">Trusted domains</span> list box,
+click the <span class="guimenu">Add...</span> button. You will be prompted for the trusted domain name and the
+relationship password. Type in SAMBA, as this is the name of the remote domain and the password used at the
+time of account creation. Click on <span class="guibutton">OK</span> and, if everything went without incident, you
+will see the <code class="computeroutput">Trusted domain relationship successfully established</code> message.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2588374"></a>Samba as the Trusting Domain</h3></div></div></div><p>
+<a class="indexterm" name="id2588382"></a>
+<a class="indexterm" name="id2588389"></a>
+This time activities are somewhat reversed. Again, we'll assume that your domain
+controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.
+</p><p>
+The very first step is to add an account for the SAMBA domain on RUMBA's PDC.
+</p><p>
+<a class="indexterm" name="id2588407"></a>
+<a class="indexterm" name="id2588414"></a>
+<a class="indexterm" name="id2588420"></a>
+Launch the <span class="application">Domain User Manager</span>, then from the menu select
+<span class="guimenu">Policies</span>, <span class="guimenuitem">Trust Relationships</span>.
+Now, next to the <span class="guilabel">Trusted Domains</span> box, press the <span class="guibutton">Add</span>
+button and type in the name of the trusted domain (SAMBA) and the password to use in securing
+the relationship.
+</p><p>
+<a class="indexterm" name="id2588463"></a>
+<a class="indexterm" name="id2588470"></a>
+The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you
+want. After you confirm the password, your account is ready for use. Now its Samba's turn.
+</p><p>
+Using your favorite shell while logged in as root, issue this command:
+<a class="indexterm" name="id2588485"></a>
+</p><p>
+<code class="prompt">root# </code><strong class="userinput"><code>net rpc trustdom establish rumba</code></strong>
+</p><p>
+<a class="indexterm" name="id2588513"></a>
+<a class="indexterm" name="id2588520"></a>
+<a class="indexterm" name="id2588527"></a>
+You will be prompted for the password you just typed on your Windows NT4 Server box.
+An error message, <code class="literal">"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT,"</code>
+that may be reported periodically is of no concern and may safely be ignored.
+It means the password you gave is correct and the NT4 server says the account is ready for
+interdomain connection and not for ordinary connection. After that, be patient;
+it can take a while (especially in large networks), but eventually you should see
+the <code class="literal">Success</code> message. Congratulations! Your trust
+relationship has just been established.
+</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
+You have to run this command as root because you must have write access to
+the <code class="filename">secrets.tdb</code> file.
+</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2588570"></a>NT4-Style Domain Trusts with Windows 2000</h2></div></div></div><p>
+<a class="indexterm" name="id2588579"></a>
+<a class="indexterm" name="id2588586"></a>
+<a class="indexterm" name="id2588592"></a>
+<a class="indexterm" name="id2588599"></a>
+Although <span class="application">Domain User Manager</span> is not present in Windows 2000, it is
+also possible to establish an NT4-style trust relationship with a Windows 2000 domain
+controller running in mixed mode as the trusting server. It should also be possible for
+Samba to trust a Windows 2000 server; however, more testing is still needed in this area.
+</p><p>
+<a class="indexterm" name="id2588621"></a>
+<a class="indexterm" name="id2588628"></a>
+<a class="indexterm" name="id2588634"></a>
+<a class="indexterm" name="id2588641"></a>
+After <a href="InterdomainTrusts.html#samba-trusted-domain" title="Samba as the Trusted Domain">creating the interdomain trust account on the Samba server</a>
+as described previously, open <span class="application">Active Directory Domains and Trusts</span> on the AD
+controller of the domain whose resources you wish Samba users to have access to. Remember that since NT4-style
+trusts are not transitive, if you want your users to have access to multiple mixed-mode domains in your AD
+forest, you will need to repeat this process for each of those domains. With <span class="application">Active Directory
+domains and trusts</span> open, right-click on the name of the Active Directory domain that will trust
+our Samba domain and choose <span class="guimenuitem">Properties</span>, then click on the
+<span class="guilabel">Trusts</span> tab. In the upper part of the panel, you will see a list box labeled
+<span class="guilabel">Domains trusted by this domain:</span> and an <span class="guilabel">Add...</span> button next to it.
+Press this button and, just as with NT4, you will be prompted for the trusted domain name and the relationship
+password. Press <span class="emphasis"><em>OK</em></span> and after a moment, Active Directory will respond with
+<code class="computeroutput">The trusted domain has been added and the trust has been verified.</code> Your
+Samba users can now be granted access to resources in the AD domain.
+</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2588720"></a>Common Errors</h2></div></div></div><p>
+Interdomain trust relationships should not be attempted on networks that are unstable
+or that suffer regular outages. Network stability and integrity are key concerns with
+distributed trusted domains.
+</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2588732"></a>Browsing of Trusted Domain Fails</h3></div></div></div><p>
+<span class="emphasis"><em>Browsing from a machine in a trusted Windows 200x domain to a Windows 200x member of
+a trusting Samba domain, I get the following error:</em></span>
+</p><pre class="screen">
+The system detected a possible attempt to compromise security. Please
+ensure that you can contact the server that authenticated you.
+</pre><p>
+</p><p>
+<span class="emphasis"><em>The event logs on the box I'm trying to connect to have entries regarding group
+policy not being applied because it is a member of a down-level domain.</em></span>
+</p><p>If there is a computer account in the Windows
+200x domain for the machine in question, and it is disabled, this problem can
+occur. If there is no computer account (removed or never existed), or if that
+account is still intact (i.e., you just joined it to another domain), everything
+seems to be fine. By default, when you unjoin a domain (the Windows 200x
+domain), the computer tries to automatically disable the computer account in
+the domain. If you are running as an account that has privileges to do this
+when you unjoin the machine, it is done; otherwise it is not done.
+</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2588778"></a>Problems with LDAP ldapsam and Older Versions of smbldap-tools</h3></div></div></div><p>
+If you use the <span><strong class="command">smbldap-useradd</strong></span> script to create a trust
+account to set up interdomain trusts, the process of setting up the trust will
+fail. The account that was created in the LDAP database will have an account
+flags field that has <code class="literal">[W ]</code>, when it must have
+<code class="literal">[I ]</code> for interdomain trusts to work.
+</p><p>Here is a simple solution.
+Create a machine account as follows:
+</p><pre class="screen">
+<code class="prompt">root# </code> smbldap-useradd -w domain_name
+</pre><p>
+Then set the desired trust account password as shown here:
+</p><pre class="screen">
+<code class="prompt">root# </code> smbldap-passwd domain_name\$
+</pre><p>
+Using a text editor, create the following file:
+</p><pre class="screen">
+dn: uid=domain_name$,ou=People,dc={your-domain},dc={your-top-level-domain}
+changetype: modify
+sambaAcctFlags: [I ]
+</pre><p>
+Then apply the text file to the LDAP database as follows:
+</p><pre class="screen">
+<code class="prompt">root# </code> ldapmodify -x -h localhost \
+ -D "cn=Manager,dc={your-domain},dc={your-top-level-domain}" \
+ -W -f /path-to/foobar
+</pre><p>
+Create a single-sided trust under the NT4 Domain User Manager, then execute:
+</p><pre class="screen">
+<code class="prompt">root# </code> net rpc trustdom establish domain_name
+</pre><p>
+</p><p>
+It works with Samba-3 and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
+Both domain controllers, Samba and NT must have the same WINS server; otherwise,
+the trust will never work.
+</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 17. Securing Samba </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 19. Hosting a Microsoft Distributed File System Tree</td></tr></table></div></body></html>
projects / samba / blobdiff