- Timestamp:
- Mar 1, 2010, 3:05:48 PM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/InterdomainTrusts.html
r368 r411 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 19. Interdomain Trust Relationships</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 5.2"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="securing-samba.html" title="Chapter 18. Securing Samba"><link rel="next" href="msdfs.html" title="Chapter 20. Hosting a Microsoft Distributed File System Tree"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 19. Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 19. Interdomain Trust Relationships"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 19. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:mimir@samba.org">mimir@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span> <div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="InterdomainTrusts.html#id2625845">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2625917">Trust Relationship Background</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2626202">Native MS Windows NT4 Trusts Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2626238">Creating an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2626335">Completing an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2626421">Interdomain Trust Facilities</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2626630">Configuring Samba NT-Style Domain Trusts</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2626971">Samba as the Trusting Domain</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2627167">NT4-Style Domain Trusts with Windows 2000</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2627316">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2627329">Browsing of Trusted Domain Fails</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2627375">Problems with LDAP ldapsam and Older Versions of smbldap-tools</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id26 25625"></a>3 <a class="indexterm" name="id26 25632"></a>4 <a class="indexterm" name="id26 25638"></a>5 <a class="indexterm" name="id26 25645"></a>6 <a class="indexterm" name="id26 25652"></a>7 <a class="indexterm" name="id26 25659"></a>8 <a class="indexterm" name="id26 25666"></a>9 <a class="indexterm" name="id26 25673"></a>10 <a class="indexterm" name="id26 25680"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 19. Interdomain Trust Relationships</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="securing-samba.html" title="Chapter 18. Securing Samba"><link rel="next" href="msdfs.html" title="Chapter 20. Hosting a Microsoft Distributed File System Tree"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 19. Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 19. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="orgname">Samba Team</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:mimir@samba.org">mimir@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="orgname">The Samba Team</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span> <div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="InterdomainTrusts.html#id2619759">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2619831">Trust Relationship Background</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2620117">Native MS Windows NT4 Trusts Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2620153">Creating an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2620250">Completing an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2620335">Interdomain Trust Facilities</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2620544">Configuring Samba NT-Style Domain Trusts</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2620885">Samba as the Trusting Domain</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2621081">NT4-Style Domain Trusts with Windows 2000</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2621231">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2621243">Browsing of Trusted Domain Fails</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2621289">Problems with LDAP ldapsam and Older Versions of smbldap-tools</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2619539"></a> 3 <a class="indexterm" name="id2619546"></a> 4 <a class="indexterm" name="id2619553"></a> 5 <a class="indexterm" name="id2619560"></a> 6 <a class="indexterm" name="id2619567"></a> 7 <a class="indexterm" name="id2619574"></a> 8 <a class="indexterm" name="id2619580"></a> 9 <a class="indexterm" name="id2619587"></a> 10 <a class="indexterm" name="id2619594"></a> 11 11 Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites 12 12 will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to … … 16 16 trusts. 17 17 </p><p> 18 <a class="indexterm" name="id26 25697"></a>19 <a class="indexterm" name="id26 25704"></a>20 <a class="indexterm" name="id26 25711"></a>21 <a class="indexterm" name="id26 25718"></a>22 <a class="indexterm" name="id26 25725"></a>18 <a class="indexterm" name="id2619612"></a> 19 <a class="indexterm" name="id2619618"></a> 20 <a class="indexterm" name="id2619625"></a> 21 <a class="indexterm" name="id2619632"></a> 22 <a class="indexterm" name="id2619639"></a> 23 23 The use of interdomain trusts requires use of <code class="literal">winbind</code>, so the 24 24 <code class="literal">winbindd</code> daemon must be running. Winbind operation in this mode is 25 25 dependent on the specification of a valid UID range and a valid GID range in the <code class="filename">smb.conf</code> file. 26 26 These are specified respectively using: 27 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id2625759"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2625770"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table><p>28 <a class="indexterm" name="id26 25782"></a>29 <a class="indexterm" name="id26 25789"></a>30 <a class="indexterm" name="id26 25796"></a>31 <a class="indexterm" name="id26 25803"></a>27 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2619673"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2619685"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table><p> 28 <a class="indexterm" name="id2619696"></a> 29 <a class="indexterm" name="id2619703"></a> 30 <a class="indexterm" name="id2619710"></a> 31 <a class="indexterm" name="id2619717"></a> 32 32 The range of values specified must not overlap values used by the host operating system and must 33 33 not overlap values used in the passdb backend for POSIX user accounts. The maximum value is … … 35 35 limited parameter. Linux kernel 2.6-based systems support a maximum value of 4294967295 36 36 (32-bit unsigned variable). 37 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>38 <a class="indexterm" name="id26 25821"></a>39 <a class="indexterm" name="id26 25828"></a>40 <a class="indexterm" name="id26 25835"></a>37 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 38 <a class="indexterm" name="id2619735"></a> 39 <a class="indexterm" name="id2619742"></a> 40 <a class="indexterm" name="id2619749"></a> 41 41 The use of winbind is necessary only when Samba is the trusting domain, not when it is the 42 42 trusted domain. 43 </p></div><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2625845"></a>Features and Benefits</h2></div></div></div><p>44 <a class="indexterm" name="id26 25853"></a>45 <a class="indexterm" name="id26 25859"></a>43 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2619759"></a>Features and Benefits</h2></div></div></div><p> 44 <a class="indexterm" name="id2619767"></a> 45 <a class="indexterm" name="id2619774"></a> 46 46 Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style 47 47 trust relationships. This imparts to Samba scalability similar to that with MS Windows NT4. 48 48 </p><p> 49 <a class="indexterm" name="id26 25873"></a>50 <a class="indexterm" name="id26 25880"></a>51 <a class="indexterm" name="id26 25887"></a>52 <a class="indexterm" name="id26 25893"></a>53 <a class="indexterm" name="id26 25900"></a>49 <a class="indexterm" name="id2619787"></a> 50 <a class="indexterm" name="id2619794"></a> 51 <a class="indexterm" name="id2619801"></a> 52 <a class="indexterm" name="id2619808"></a> 53 <a class="indexterm" name="id2619815"></a> 54 54 Given that Samba-3 can function with a scalable backend authentication database such as LDAP, and given its 55 55 ability to run in primary as well as backup domain control modes, the administrator would be well-advised to … … 57 57 function, this system is fragile. That was, after all, a key reason for the development and adoption of 58 58 Microsoft Active Directory. 59 </p></div><div class="sect1" title="Trust Relationship Background"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2625917"></a>Trust Relationship Background</h2></div></div></div><p>60 <a class="indexterm" name="id26 25925"></a>61 <a class="indexterm" name="id26 25932"></a>62 <a class="indexterm" name="id26 25939"></a>63 <a class="indexterm" name="id26 25946"></a>64 <a class="indexterm" name="id26 25953"></a>65 <a class="indexterm" name="id26 25959"></a>59 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2619831"></a>Trust Relationship Background</h2></div></div></div><p> 60 <a class="indexterm" name="id2619839"></a> 61 <a class="indexterm" name="id2619846"></a> 62 <a class="indexterm" name="id2619853"></a> 63 <a class="indexterm" name="id2619860"></a> 64 <a class="indexterm" name="id2619867"></a> 65 <a class="indexterm" name="id2619874"></a> 66 66 MS Windows NT3/4-type security domains employ a nonhierarchical security structure. 67 67 The limitations of this architecture as it effects the scalability of MS Windows networking … … 70 70 large and diverse organizations. 71 71 </p><p> 72 <a class="indexterm" name="id26 25976"></a>73 <a class="indexterm" name="id26 25983"></a>74 <a class="indexterm" name="id26 25990"></a>75 <a class="indexterm" name="id26 25996"></a>76 <a class="indexterm" name="id26 26003"></a>72 <a class="indexterm" name="id2619891"></a> 73 <a class="indexterm" name="id2619897"></a> 74 <a class="indexterm" name="id2619904"></a> 75 <a class="indexterm" name="id2619911"></a> 76 <a class="indexterm" name="id2619918"></a> 77 77 Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means 78 78 of circumventing the limitations of the older technologies. Not every organization is ready … … 81 81 desire to go through a disruptive change to adopt ADS. 82 82 </p><p> 83 <a class="indexterm" name="id26 26021"></a>84 <a class="indexterm" name="id26 26028"></a>85 <a class="indexterm" name="id26 26034"></a>86 <a class="indexterm" name="id26 26041"></a>87 <a class="indexterm" name="id26 26048"></a>88 <a class="indexterm" name="id26 26055"></a>89 <a class="indexterm" name="id26 26062"></a>83 <a class="indexterm" name="id2619935"></a> 84 <a class="indexterm" name="id2619942"></a> 85 <a class="indexterm" name="id2619949"></a> 86 <a class="indexterm" name="id2619956"></a> 87 <a class="indexterm" name="id2619962"></a> 88 <a class="indexterm" name="id2619969"></a> 89 <a class="indexterm" name="id2619976"></a> 90 90 With Windows NT, Microsoft introduced the ability to allow different security domains 91 91 to effect a mechanism so users from one domain may be given access rights and privileges … … 98 98 necessary to establish two relationships, one in each direction. 99 99 </p><p> 100 <a class="indexterm" name="id262 6100"></a>101 <a class="indexterm" name="id262 6106"></a>102 <a class="indexterm" name="id262 6113"></a>103 <a class="indexterm" name="id262 6120"></a>104 <a class="indexterm" name="id262 6127"></a>100 <a class="indexterm" name="id2620014"></a> 101 <a class="indexterm" name="id2620021"></a> 102 <a class="indexterm" name="id2620028"></a> 103 <a class="indexterm" name="id2620035"></a> 104 <a class="indexterm" name="id2620041"></a> 105 105 Further, in an NT4-style MS security domain, all trusts are nontransitive. This means that if there are three 106 106 domains (let's call them red, white, and blue), where red and white have a trust relationship, and white and … … 108 108 Relationships are explicit and not transitive. 109 109 </p><p> 110 <a class="indexterm" name="id262 6144"></a>111 <a class="indexterm" name="id262 6150"></a>112 <a class="indexterm" name="id262 6157"></a>113 <a class="indexterm" name="id262 6164"></a>114 <a class="indexterm" name="id262 6171"></a>115 <a class="indexterm" name="id262 6178"></a>116 <a class="indexterm" name="id262 6185"></a>110 <a class="indexterm" name="id2620058"></a> 111 <a class="indexterm" name="id2620064"></a> 112 <a class="indexterm" name="id2620071"></a> 113 <a class="indexterm" name="id2620078"></a> 114 <a class="indexterm" name="id2620085"></a> 115 <a class="indexterm" name="id2620092"></a> 116 <a class="indexterm" name="id2620099"></a> 117 117 New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. 118 118 Also, all inter-ADS domain trusts are transitive. In the case of the red, white, and blue domains, with … … 120 120 domains. Samba-3 implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS 121 121 security domains in similar manner to MS Windows NT4-style domains. 122 </p></div><div class="sect1" title="Native MS Windows NT4 Trusts Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2626202"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div></div><p>123 <a class="indexterm" name="id262 6210"></a>124 <a class="indexterm" name="id262 6219"></a>125 <a class="indexterm" name="id262 6226"></a>122 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620117"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div></div><p> 123 <a class="indexterm" name="id2620124"></a> 124 <a class="indexterm" name="id2620133"></a> 125 <a class="indexterm" name="id2620140"></a> 126 126 There are two steps to creating an interdomain trust relationship. To effect a two-way trust 127 127 relationship, it is necessary for each domain administrator to create a trust account for the 128 128 other domain to use in verifying security credentials. 129 </p><div class="sect2" title="Creating an NT4 Domain Trust"><div class="titlepage"><div><div><h3 class="title"><a name="id2626238"></a>Creating an NT4 Domain Trust</h3></div></div></div><p>130 <a class="indexterm" name="id262 6247"></a>131 <a class="indexterm" name="id262 6254"></a>132 <a class="indexterm" name="id262 6260"></a>133 <a class="indexterm" name="id262 6268"></a>134 <a class="indexterm" name="id262 6275"></a>129 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620153"></a>Creating an NT4 Domain Trust</h3></div></div></div><p> 130 <a class="indexterm" name="id2620161"></a> 131 <a class="indexterm" name="id2620168"></a> 132 <a class="indexterm" name="id2620175"></a> 133 <a class="indexterm" name="id2620182"></a> 134 <a class="indexterm" name="id2620189"></a> 135 135 For MS Windows NT4, all domain trust relationships are configured using the 136 136 <span class="application">Domain User Manager</span>. This is done from the Domain User Manager Policies … … 143 143 trusting domain will use when authenticating users from the trusted domain. 144 144 The password needs to be typed twice (for standard confirmation). 145 </p></div><div class="sect2" title="Completing an NT4 Domain Trust"><div class="titlepage"><div><div><h3 class="title"><a name="id2626335"></a>Completing an NT4 Domain Trust</h3></div></div></div><p>146 <a class="indexterm" name="id262 6344"></a>147 <a class="indexterm" name="id262 6350"></a>148 <a class="indexterm" name="id262 6357"></a>149 <a class="indexterm" name="id262 6364"></a>150 <a class="indexterm" name="id262 6371"></a>151 <a class="indexterm" name="id262 6378"></a>145 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620250"></a>Completing an NT4 Domain Trust</h3></div></div></div><p> 146 <a class="indexterm" name="id2620258"></a> 147 <a class="indexterm" name="id2620265"></a> 148 <a class="indexterm" name="id2620272"></a> 149 <a class="indexterm" name="id2620279"></a> 150 <a class="indexterm" name="id2620286"></a> 151 <a class="indexterm" name="id2620292"></a> 152 152 A trust relationship will work only when the other (trusting) domain makes the appropriate connections 153 153 with the trusted domain. To consummate the trust relationship, the administrator launches the … … 156 156 next to the box that is labeled <span class="guilabel">Trusted Domains</span>. A panel opens in which 157 157 must be entered the name of the remote domain as well as the password assigned to that trust. 158 </p></div><div class="sect2" title="Interdomain Trust Facilities"><div class="titlepage"><div><div><h3 class="title"><a name="id2626421"></a>Interdomain Trust Facilities</h3></div></div></div><p>159 <a class="indexterm" name="id262 6429"></a>160 <a class="indexterm" name="id262 6436"></a>161 <a class="indexterm" name="id262 6443"></a>162 <a class="indexterm" name="id262 6450"></a>163 <a class="indexterm" name="id262 6456"></a>164 <a class="indexterm" name="id262 6463"></a>158 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620335"></a>Interdomain Trust Facilities</h3></div></div></div><p> 159 <a class="indexterm" name="id2620343"></a> 160 <a class="indexterm" name="id2620350"></a> 161 <a class="indexterm" name="id2620357"></a> 162 <a class="indexterm" name="id2620364"></a> 163 <a class="indexterm" name="id2620371"></a> 164 <a class="indexterm" name="id2620378"></a> 165 165 A two-way trust relationship is created when two one-way trusts are created, one in each direction. 166 166 Where a one-way trust has been established between two MS Windows NT4 domains (let's call them 167 167 DomA and DomB), the following facilities are created: 168 </p><div class="figure"><a name="trusts1"></a><p class="title"><b>Figure 19.1. Trusts overview.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/trusts1.png" alt="Trusts overview."></div></div></div><br class="figure-break"><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>168 </p><div class="figure"><a name="trusts1"></a><p class="title"><b>Figure 19.1. Trusts overview.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/trusts1.png" alt="Trusts overview."></div></div></div><br class="figure-break"><div class="itemizedlist"><ul type="disc"><li><p> 169 169 DomA (completes the trust connection) <em class="parameter"><code>Trusts</code></em> DomB. 170 </p></li><li class="listitem"><p>170 </p></li><li><p> 171 171 DomA is the <em class="parameter"><code>Trusting</code></em> domain. 172 </p></li><li class="listitem"><p>172 </p></li><li><p> 173 173 DomB is the <em class="parameter"><code>Trusted</code></em> domain (originates the trust account). 174 </p></li><li class="listitem"><p>174 </p></li><li><p> 175 175 Users in DomB can access resources in DomA. 176 </p></li><li class="listitem"><p>176 </p></li><li><p> 177 177 Users in DomA cannot access resources in DomB. 178 </p></li><li class="listitem"><p>178 </p></li><li><p> 179 179 Global groups from DomB can be used in DomA. 180 </p></li><li class="listitem"><p>180 </p></li><li><p> 181 181 Global groups from DomA cannot be used in DomB. 182 </p></li><li class="listitem"><p>182 </p></li><li><p> 183 183 DomB does appear in the logon dialog box on client workstations in DomA. 184 </p></li><li class="listitem"><p>184 </p></li><li><p> 185 185 DomA does not appear in the logon dialog box on client workstations in DomB. 186 </p></li></ul></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>186 </p></li></ul></div><div class="itemizedlist"><ul type="disc"><li><p> 187 187 Users and groups in a trusting domain cannot be granted rights, permissions, or access 188 188 to a trusted domain. 189 </p></li><li class="listitem"><p>189 </p></li><li><p> 190 190 The trusting domain can access and use accounts (users/global groups) in the 191 191 trusted domain. 192 </p></li><li class="listitem"><p>192 </p></li><li><p> 193 193 Administrators of the trusted domain can be granted administrative rights in the 194 194 trusting domain. 195 </p></li><li class="listitem"><p>195 </p></li><li><p> 196 196 Users in a trusted domain can be given rights and privileges in the trusting 197 197 domain. 198 </p></li><li class="listitem"><p>198 </p></li><li><p> 199 199 Trusted domain global groups can be given rights and permissions in the trusting 200 200 domain. 201 </p></li><li class="listitem"><p>201 </p></li><li><p> 202 202 Global groups from the trusted domain can be made members in local groups on 203 203 MS Windows domain member machines. 204 </p></li></ul></div></div></div><div class="sect1" title="Configuring Samba NT-Style Domain Trusts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2626630"></a>Configuring Samba NT-Style Domain Trusts</h2></div></div></div><p>205 <a class="indexterm" name="id262 6638"></a>204 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620544"></a>Configuring Samba NT-Style Domain Trusts</h2></div></div></div><p> 205 <a class="indexterm" name="id2620552"></a> 206 206 This description is meant to be a fairly short introduction about how to set up a Samba server so 207 207 that it can participate in interdomain trust relationships. Trust relationship support in Samba 208 208 is at an early stage, so do not be surprised if something does not function as it should. 209 209 </p><p> 210 <a class="indexterm" name="id262 6653"></a>211 <a class="indexterm" name="id262 6660"></a>212 <a class="indexterm" name="id262 6667"></a>213 <a class="indexterm" name="id262 6674"></a>210 <a class="indexterm" name="id2620567"></a> 211 <a class="indexterm" name="id2620574"></a> 212 <a class="indexterm" name="id2620581"></a> 213 <a class="indexterm" name="id2620588"></a> 214 214 Each of the procedures described next assumes the peer domain in the trust relationship is controlled by a 215 215 Windows NT4 server. However, the remote end could just as well be another Samba-3 domain. It can be clearly 216 216 seen, after reading this document, that combining Samba-specific parts of what's written in the following 217 217 sections leads to trust between domains in a purely Samba environment. 218 </p><div class="sect2" title="Samba as the Trusted Domain"><div class="titlepage"><div><div><h3 class="title"><a name="samba-trusted-domain"></a>Samba as the Trusted Domain</h3></div></div></div><p>219 <a class="indexterm" name="id262 6701"></a>220 <a class="indexterm" name="id262 6708"></a>221 <a class="indexterm" name="id262 6715"></a>222 <a class="indexterm" name="id262 6722"></a>223 <a class="indexterm" name="id262 6728"></a>218 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="samba-trusted-domain"></a>Samba as the Trusted Domain</h3></div></div></div><p> 219 <a class="indexterm" name="id2620615"></a> 220 <a class="indexterm" name="id2620622"></a> 221 <a class="indexterm" name="id2620629"></a> 222 <a class="indexterm" name="id2620636"></a> 223 <a class="indexterm" name="id2620642"></a> 224 224 In order to set the Samba PDC to be the trusted party of the relationship, you first need 225 225 to create a special account for the domain that will be the trusting party. To do that, … … 237 237 238 238 where <code class="option">-a</code> means to add a new account into the 239 passdb database and <code class="option">-i</code> means to <span class="quote">“<span class="quote">create this240 account with the Interdomain trust flag</span>” </span>.241 </p><p> 242 <a class="indexterm" name="id262 6798"></a>243 <a class="indexterm" name="id262 6805"></a>244 <a class="indexterm" name="id262 6812"></a>245 <a class="indexterm" name="id262 6819"></a>246 The account name will be <span class="quote">“<span class="quote">rumba$</span>”</span>(the name of the remote domain).239 passdb database and <code class="option">-i</code> means to “<span class="quote">create this 240 account with the Interdomain trust flag</span>”. 241 </p><p> 242 <a class="indexterm" name="id2620712"></a> 243 <a class="indexterm" name="id2620719"></a> 244 <a class="indexterm" name="id2620726"></a> 245 <a class="indexterm" name="id2620733"></a> 246 The account name will be “<span class="quote">rumba$</span>” (the name of the remote domain). 247 247 If this fails, you should check that the trust account has been added to the system 248 248 password database (<code class="filename">/etc/passwd</code>). If it has not been added, you 249 249 can add it manually and then repeat the previous step. 250 250 </p><p> 251 <a class="indexterm" name="id262 6842"></a>252 <a class="indexterm" name="id262 6849"></a>253 <a class="indexterm" name="id262 6856"></a>254 <a class="indexterm" name="id262 6863"></a>251 <a class="indexterm" name="id2620757"></a> 252 <a class="indexterm" name="id2620763"></a> 253 <a class="indexterm" name="id2620770"></a> 254 <a class="indexterm" name="id2620777"></a> 255 255 After issuing this command, you will be asked to enter the password for the account. You can use any password 256 256 you want, but be aware that Windows NT will not change this password until 7 days following account creation. 257 257 After the command returns successfully, you can look at the entry for the new account (in the standard way as 258 258 appropriate for your configuration) and see that the account's name is really RUMBA$ and it has the 259 <span class="quote">“<span class="quote">I</span>”</span>flag set in the flags field. Now you are ready to confirm the trust by establishing it from259 “<span class="quote">I</span>” flag set in the flags field. Now you are ready to confirm the trust by establishing it from 260 260 Windows NT Server. 261 261 </p><p> 262 <a class="indexterm" name="id262 6886"></a>263 <a class="indexterm" name="id262 6892"></a>264 <a class="indexterm" name="id262 6899"></a>265 <a class="indexterm" name="id262 6906"></a>266 <a class="indexterm" name="id262 6913"></a>262 <a class="indexterm" name="id2620800"></a> 263 <a class="indexterm" name="id2620807"></a> 264 <a class="indexterm" name="id2620814"></a> 265 <a class="indexterm" name="id2620821"></a> 266 <a class="indexterm" name="id2620828"></a> 267 267 Open <span class="application">User Manager for Domains</span> and from the <span class="guimenu">Policies</span> menu, select 268 268 <span class="guimenuitem">Trust Relationships...</span>. Beside the <span class="guilabel">Trusted domains</span> list box, … … 271 271 time of account creation. Click on <span class="guibutton">OK</span> and, if everything went without incident, you 272 272 will see the <code class="computeroutput">Trusted domain relationship successfully established</code> message. 273 </p></div><div class="sect2" title="Samba as the Trusting Domain"><div class="titlepage"><div><div><h3 class="title"><a name="id2626971"></a>Samba as the Trusting Domain</h3></div></div></div><p>274 <a class="indexterm" name="id262 6979"></a>275 <a class="indexterm" name="id262 6986"></a>273 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620885"></a>Samba as the Trusting Domain</h3></div></div></div><p> 274 <a class="indexterm" name="id2620893"></a> 275 <a class="indexterm" name="id2620900"></a> 276 276 This time activities are somewhat reversed. Again, we'll assume that your domain 277 277 controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA. … … 279 279 The very first step is to add an account for the SAMBA domain on RUMBA's PDC. 280 280 </p><p> 281 <a class="indexterm" name="id262 7003"></a>282 <a class="indexterm" name="id262 7010"></a>283 <a class="indexterm" name="id262 7017"></a>281 <a class="indexterm" name="id2620918"></a> 282 <a class="indexterm" name="id2620925"></a> 283 <a class="indexterm" name="id2620932"></a> 284 284 Launch the <span class="application">Domain User Manager</span>, then from the menu select 285 285 <span class="guimenu">Policies</span>, <span class="guimenuitem">Trust Relationships</span>. … … 288 288 the relationship. 289 289 </p><p> 290 <a class="indexterm" name="id262 7060"></a>291 <a class="indexterm" name="id262 7067"></a>290 <a class="indexterm" name="id2620974"></a> 291 <a class="indexterm" name="id2620981"></a> 292 292 The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you 293 293 want. After you confirm the password, your account is ready for use. Now its Samba's turn. 294 294 </p><p> 295 295 Using your favorite shell while logged in as root, issue this command: 296 <a class="indexterm" name="id262 7082"></a>296 <a class="indexterm" name="id2620996"></a> 297 297 </p><p> 298 298 <code class="prompt">root# </code><strong class="userinput"><code>net rpc trustdom establish rumba</code></strong> 299 299 </p><p> 300 <a class="indexterm" name="id262 7110"></a>301 <a class="indexterm" name="id262 7117"></a>302 <a class="indexterm" name="id262 7124"></a>300 <a class="indexterm" name="id2621024"></a> 301 <a class="indexterm" name="id2621031"></a> 302 <a class="indexterm" name="id2621038"></a> 303 303 You will be prompted for the password you just typed on your Windows NT4 Server box. 304 304 An error message, <code class="literal">"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT,"</code> … … 309 309 the <code class="literal">Success</code> message. Congratulations! Your trust 310 310 relationship has just been established. 311 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>311 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 312 312 You have to run this command as root because you must have write access to 313 313 the <code class="filename">secrets.tdb</code> file. 314 </p></div></div></div><div class="sect1" title="NT4-Style Domain Trusts with Windows 2000"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2627167"></a>NT4-Style Domain Trusts with Windows 2000</h2></div></div></div><p>315 <a class="indexterm" name="id262 7175"></a>316 <a class="indexterm" name="id262 7182"></a>317 <a class="indexterm" name="id262 7189"></a>318 <a class="indexterm" name="id262 7196"></a>314 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2621081"></a>NT4-Style Domain Trusts with Windows 2000</h2></div></div></div><p> 315 <a class="indexterm" name="id2621090"></a> 316 <a class="indexterm" name="id2621097"></a> 317 <a class="indexterm" name="id2621104"></a> 318 <a class="indexterm" name="id2621110"></a> 319 319 Although <span class="application">Domain User Manager</span> is not present in Windows 2000, it is 320 320 also possible to establish an NT4-style trust relationship with a Windows 2000 domain … … 322 322 Samba to trust a Windows 2000 server; however, more testing is still needed in this area. 323 323 </p><p> 324 <a class="indexterm" name="id262 7217"></a>325 <a class="indexterm" name="id262 7224"></a>326 <a class="indexterm" name="id262 7231"></a>327 <a class="indexterm" name="id262 7238"></a>324 <a class="indexterm" name="id2621132"></a> 325 <a class="indexterm" name="id2621139"></a> 326 <a class="indexterm" name="id2621146"></a> 327 <a class="indexterm" name="id2621152"></a> 328 328 After <a class="link" href="InterdomainTrusts.html#samba-trusted-domain" title="Samba as the Trusted Domain">creating the interdomain trust account on the Samba server</a> 329 329 as described previously, open <span class="application">Active Directory Domains and Trusts</span> on the AD … … 339 339 <code class="computeroutput">The trusted domain has been added and the trust has been verified.</code> Your 340 340 Samba users can now be granted access to resources in the AD domain. 341 </p></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2627316"></a>Common Errors</h2></div></div></div><p>341 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2621231"></a>Common Errors</h2></div></div></div><p> 342 342 Interdomain trust relationships should not be attempted on networks that are unstable 343 343 or that suffer regular outages. Network stability and integrity are key concerns with 344 344 distributed trusted domains. 345 </p><div class="sect2" title="Browsing of Trusted Domain Fails"><div class="titlepage"><div><div><h3 class="title"><a name="id2627329"></a>Browsing of Trusted Domain Fails</h3></div></div></div><p>345 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2621243"></a>Browsing of Trusted Domain Fails</h3></div></div></div><p> 346 346 <span class="emphasis"><em>Browsing from a machine in a trusted Windows 200x domain to a Windows 200x member of 347 347 a trusting Samba domain, I get the following error:</em></span> … … 361 361 the domain. If you are running as an account that has privileges to do this 362 362 when you unjoin the machine, it is done; otherwise it is not done. 363 </p></div><div class="sect2" title="Problems with LDAP ldapsam and Older Versions of smbldap-tools"><div class="titlepage"><div><div><h3 class="title"><a name="id2627375"></a>Problems with LDAP ldapsam and Older Versions of smbldap-tools</h3></div></div></div><p>363 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2621289"></a>Problems with LDAP ldapsam and Older Versions of smbldap-tools</h3></div></div></div><p> 364 364 If you use the <code class="literal">smbldap-useradd</code> script to create a trust 365 365 account to set up interdomain trusts, the process of setting up the trust will
Note:
See TracChangeset
for help on using the changeset viewer.
