Ignore:
Timestamp:
Nov 12, 2012, 7:37:04 PM (13 years ago)
Author:
Silvan Scherrer
Message:

Samba Server 3.5: update branche to 3.5.19

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.5.x/docs/htmldocs/Samba3-HOWTO/InterdomainTrusts.html

    r599 r739  
    1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 19. Interdomain Trust Relationships</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.5.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="securing-samba.html" title="Chapter 18. Securing Samba"><link rel="next" href="msdfs.html" title="Chapter 20. Hosting a Microsoft Distributed File System Tree"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 19. Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 19. Interdomain Trust Relationships"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 19. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mimir@samba.org">mimir@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span> <div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="InterdomainTrusts.html#id386823">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id386889">Trust Relationship Background</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id387143">Native MS Windows NT4 Trusts Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id387177">Creating an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id387268">Completing an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id387348">Interdomain Trust Facilities</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id387544">Configuring Samba NT-Style Domain Trusts</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id387860">Samba as the Trusting Domain</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id388043">NT4-Style Domain Trusts with Windows 2000</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id388180">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id388191">Browsing of Trusted Domain Fails</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id388228">Problems with LDAP ldapsam and Older Versions of smbldap-tools</a></span></dt></dl></dd></dl></div><p>
    2 <a class="indexterm" name="id386616"></a>
    3 <a class="indexterm" name="id386623"></a>
    4 <a class="indexterm" name="id386630"></a>
    5 <a class="indexterm" name="id386636"></a>
    6 <a class="indexterm" name="id386643"></a>
    7 <a class="indexterm" name="id386649"></a>
    8 <a class="indexterm" name="id386656"></a>
    9 <a class="indexterm" name="id386663"></a>
    10 <a class="indexterm" name="id386670"></a>
     1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 19. Interdomain Trust Relationships</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="The Official Samba 3.5.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="securing-samba.html" title="Chapter 18. Securing Samba"><link rel="next" href="msdfs.html" title="Chapter 20. Hosting a Microsoft Distributed File System Tree"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 19. Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 19. Interdomain Trust Relationships"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 19. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:mimir@samba.org">mimir@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span> <div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="InterdomainTrusts.html#id384968">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id385034">Trust Relationship Background</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id385289">Native MS Windows NT4 Trusts Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id385323">Creating an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id385412">Completing an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id385492">Interdomain Trust Facilities</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id385688">Configuring Samba NT-Style Domain Trusts</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id386004">Samba as the Trusting Domain</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id386187">NT4-Style Domain Trusts with Windows 2000</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id386324">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id386334">Browsing of Trusted Domain Fails</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id386371">Problems with LDAP ldapsam and Older Versions of smbldap-tools</a></span></dt></dl></dd></dl></div><p>
     2<a class="indexterm" name="id384761"></a>
     3<a class="indexterm" name="id384768"></a>
     4<a class="indexterm" name="id384774"></a>
     5<a class="indexterm" name="id384781"></a>
     6<a class="indexterm" name="id384788"></a>
     7<a class="indexterm" name="id384795"></a>
     8<a class="indexterm" name="id384802"></a>
     9<a class="indexterm" name="id384808"></a>
     10<a class="indexterm" name="id384815"></a>
    1111Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
    1212will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
    … …  
    1616trusts.
    1717</p><p>
    18 <a class="indexterm" name="id386683"></a>
    19 <a class="indexterm" name="id386690"></a>
    20 <a class="indexterm" name="id386697"></a>
    21 <a class="indexterm" name="id386704"></a>
    22 <a class="indexterm" name="id386711"></a>
     18<a class="indexterm" name="id384829"></a>
     19<a class="indexterm" name="id384836"></a>
     20<a class="indexterm" name="id384842"></a>
     21<a class="indexterm" name="id384849"></a>
     22<a class="indexterm" name="id384856"></a>
    2323The use of interdomain trusts requires use of <code class="literal">winbind</code>, so the
    2424<code class="literal">winbindd</code> daemon must be running. Winbind operation in this mode is
    2525dependent on the specification of a valid UID range and a valid GID range in the <code class="filename">smb.conf</code> file.
    2626These are specified respectively using:
    27 </p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id386743"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id386754"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table><p>
    28 <a class="indexterm" name="id386766"></a>
    29 <a class="indexterm" name="id386772"></a>
    30 <a class="indexterm" name="id386779"></a>
    31 <a class="indexterm" name="id386786"></a>
     27</p><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id384888"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id384900"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr></table><p>
     28<a class="indexterm" name="id384911"></a>
     29<a class="indexterm" name="id384918"></a>
     30<a class="indexterm" name="id384925"></a>
     31<a class="indexterm" name="id384931"></a>
    3232The range of values specified must not overlap values used by the host operating system and must
    3333not overlap values used in the passdb backend for POSIX user accounts. The maximum value is
    … …  
    3636(32-bit unsigned variable).
    3737</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
    38 <a class="indexterm" name="id386801"></a>
    39 <a class="indexterm" name="id386807"></a>
    40 <a class="indexterm" name="id386814"></a>
     38<a class="indexterm" name="id384946"></a>
     39<a class="indexterm" name="id384953"></a>
     40<a class="indexterm" name="id384960"></a>
    4141The use of winbind is necessary only when Samba is the trusting domain, not when it is the
    4242trusted domain.
    43 </p></div><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386823"></a>Features and Benefits</h2></div></div></div><p>
    44 <a class="indexterm" name="id386831"></a>
    45 <a class="indexterm" name="id386838"></a>
     43</p></div><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id384968"></a>Features and Benefits</h2></div></div></div><p>
     44<a class="indexterm" name="id384976"></a>
     45<a class="indexterm" name="id384983"></a>
    4646Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
    4747trust relationships. This imparts to Samba scalability similar to that with MS Windows NT4.
    4848</p><p>
    49 <a class="indexterm" name="id386849"></a>
    50 <a class="indexterm" name="id386856"></a>
    51 <a class="indexterm" name="id386863"></a>
    52 <a class="indexterm" name="id386870"></a>
    53 <a class="indexterm" name="id386876"></a>
     49<a class="indexterm" name="id384995"></a>
     50<a class="indexterm" name="id385001"></a>
     51<a class="indexterm" name="id385008"></a>
     52<a class="indexterm" name="id385015"></a>
     53<a class="indexterm" name="id385022"></a>
    5454Given that Samba-3 can function with a scalable backend authentication database such as LDAP, and given its
    5555ability to run in primary as well as backup domain control modes, the administrator would be well-advised to
    … …  
    5757function, this system is fragile.  That was, after all, a key reason for the development and adoption of
    5858Microsoft Active Directory.
    59 </p></div><div class="sect1" title="Trust Relationship Background"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386889"></a>Trust Relationship Background</h2></div></div></div><p>
    60 <a class="indexterm" name="id386897"></a>
    61 <a class="indexterm" name="id386904"></a>
    62 <a class="indexterm" name="id386910"></a>
    63 <a class="indexterm" name="id386917"></a>
    64 <a class="indexterm" name="id386924"></a>
    65 <a class="indexterm" name="id386931"></a>
     59</p></div><div class="sect1" title="Trust Relationship Background"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385034"></a>Trust Relationship Background</h2></div></div></div><p>
     60<a class="indexterm" name="id385042"></a>
     61<a class="indexterm" name="id385049"></a>
     62<a class="indexterm" name="id385056"></a>
     63<a class="indexterm" name="id385063"></a>
     64<a class="indexterm" name="id385069"></a>
     65<a class="indexterm" name="id385076"></a>
    6666MS Windows NT3/4-type security domains employ a nonhierarchical security structure.
    6767The limitations of this architecture as it effects the scalability of MS Windows networking
    … …  
    7070large and diverse organizations.
    7171</p><p>
    72 <a class="indexterm" name="id386944"></a>
    73 <a class="indexterm" name="id386951"></a>
    74 <a class="indexterm" name="id386958"></a>
    75 <a class="indexterm" name="id386964"></a>
    76 <a class="indexterm" name="id386971"></a>
     72<a class="indexterm" name="id385090"></a>
     73<a class="indexterm" name="id385096"></a>
     74<a class="indexterm" name="id385103"></a>
     75<a class="indexterm" name="id385110"></a>
     76<a class="indexterm" name="id385117"></a>
    7777Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
    7878of circumventing the limitations of the older technologies. Not every organization is ready
    … …  
    8181desire to go through a disruptive change to adopt ADS.
    8282</p><p>
    83 <a class="indexterm" name="id386985"></a>
    84 <a class="indexterm" name="id386992"></a>
    85 <a class="indexterm" name="id386998"></a>
    86 <a class="indexterm" name="id387005"></a>
    87 <a class="indexterm" name="id387012"></a>
    88 <a class="indexterm" name="id387019"></a>
    89 <a class="indexterm" name="id387026"></a>
     83<a class="indexterm" name="id385130"></a>
     84<a class="indexterm" name="id385137"></a>
     85<a class="indexterm" name="id385144"></a>
     86<a class="indexterm" name="id385151"></a>
     87<a class="indexterm" name="id385157"></a>
     88<a class="indexterm" name="id385164"></a>
     89<a class="indexterm" name="id385171"></a>
    9090With Windows NT, Microsoft introduced the ability to allow different security domains
    9191to effect a mechanism so users from one domain may be given access rights and privileges
    … …  
    9898necessary to establish two relationships, one in each direction.
    9999</p><p>
    100 <a class="indexterm" name="id387049"></a>
    101 <a class="indexterm" name="id387056"></a>
    102 <a class="indexterm" name="id387063"></a>
    103 <a class="indexterm" name="id387070"></a>
    104 <a class="indexterm" name="id387076"></a>
     100<a class="indexterm" name="id385194"></a>
     101<a class="indexterm" name="id385201"></a>
     102<a class="indexterm" name="id385208"></a>
     103<a class="indexterm" name="id385215"></a>
     104<a class="indexterm" name="id385222"></a>
    105105Further, in an NT4-style MS security domain, all trusts are nontransitive. This means that if there are three
    106106domains (let's call them red, white, and blue), where red and white have a trust relationship, and white and
    … …  
    108108Relationships are explicit and not transitive.
    109109</p><p>
    110 <a class="indexterm" name="id387090"></a>
    111 <a class="indexterm" name="id387096"></a>
    112 <a class="indexterm" name="id387103"></a>
    113 <a class="indexterm" name="id387110"></a>
    114 <a class="indexterm" name="id387117"></a>
    115 <a class="indexterm" name="id387123"></a>
    116 <a class="indexterm" name="id387130"></a>
     110<a class="indexterm" name="id385235"></a>
     111<a class="indexterm" name="id385242"></a>
     112<a class="indexterm" name="id385248"></a>
     113<a class="indexterm" name="id385255"></a>
     114<a class="indexterm" name="id385262"></a>
     115<a class="indexterm" name="id385269"></a>
     116<a class="indexterm" name="id385276"></a>
    117117New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default.
    118118Also, all inter-ADS domain trusts are transitive. In the case of the red, white, and blue domains, with
    … …  
    120120domains. Samba-3 implements MS Windows NT4-style interdomain trusts and interoperates with MS Windows 200x ADS
    121121security domains in similar manner to MS Windows NT4-style domains.
    122 </p></div><div class="sect1" title="Native MS Windows NT4 Trusts Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387143"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div></div><p>
    123 <a class="indexterm" name="id387151"></a>
    124 <a class="indexterm" name="id387161"></a>
    125 <a class="indexterm" name="id387167"></a>
     122</p></div><div class="sect1" title="Native MS Windows NT4 Trusts Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385289"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div></div><p>
     123<a class="indexterm" name="id385297"></a>
     124<a class="indexterm" name="id385306"></a>
     125<a class="indexterm" name="id385313"></a>
    126126There are two steps to creating an interdomain trust relationship. To effect a two-way trust
    127127relationship, it is necessary for each domain administrator to create a trust account for the
    128128other domain to use in verifying security credentials.
    129 </p><div class="sect2" title="Creating an NT4 Domain Trust"><div class="titlepage"><div><div><h3 class="title"><a name="id387177"></a>Creating an NT4 Domain Trust</h3></div></div></div><p>
    130 <a class="indexterm" name="id387185"></a>
    131 <a class="indexterm" name="id387192"></a>
    132 <a class="indexterm" name="id387199"></a>
    133 <a class="indexterm" name="id387206"></a>
    134 <a class="indexterm" name="id387213"></a>
     129</p><div class="sect2" title="Creating an NT4 Domain Trust"><div class="titlepage"><div><div><h3 class="title"><a name="id385323"></a>Creating an NT4 Domain Trust</h3></div></div></div><p>
     130<a class="indexterm" name="id385331"></a>
     131<a class="indexterm" name="id385337"></a>
     132<a class="indexterm" name="id385344"></a>
     133<a class="indexterm" name="id385351"></a>
     134<a class="indexterm" name="id385358"></a>
    135135For MS Windows NT4, all domain trust relationships are configured using the
    136136<span class="application">Domain User Manager</span>. This is done from the Domain User Manager Policies
    … …  
    143143trusting domain will use when authenticating users from the trusted domain.
    144144The password needs to be typed twice (for standard confirmation).
    145 </p></div><div class="sect2" title="Completing an NT4 Domain Trust"><div class="titlepage"><div><div><h3 class="title"><a name="id387268"></a>Completing an NT4 Domain Trust</h3></div></div></div><p>
    146 <a class="indexterm" name="id387276"></a>
    147 <a class="indexterm" name="id387282"></a>
    148 <a class="indexterm" name="id387289"></a>
    149 <a class="indexterm" name="id387296"></a>
    150 <a class="indexterm" name="id387303"></a>
    151 <a class="indexterm" name="id387310"></a>
     145</p></div><div class="sect2" title="Completing an NT4 Domain Trust"><div class="titlepage"><div><div><h3 class="title"><a name="id385412"></a>Completing an NT4 Domain Trust</h3></div></div></div><p>
     146<a class="indexterm" name="id385420"></a>
     147<a class="indexterm" name="id385427"></a>
     148<a class="indexterm" name="id385434"></a>
     149<a class="indexterm" name="id385440"></a>
     150<a class="indexterm" name="id385447"></a>
     151<a class="indexterm" name="id385454"></a>
    152152A trust relationship will work only when the other (trusting) domain makes the appropriate connections
    153153with the trusted domain. To consummate the trust relationship, the administrator launches the
    … …  
    156156next to the box that is labeled <span class="guilabel">Trusted Domains</span>. A panel opens in which
    157157must be entered the name of the remote domain as well as the password assigned to that trust.
    158 </p></div><div class="sect2" title="Interdomain Trust Facilities"><div class="titlepage"><div><div><h3 class="title"><a name="id387348"></a>Interdomain Trust Facilities</h3></div></div></div><p>
    159 <a class="indexterm" name="id387356"></a>
    160 <a class="indexterm" name="id387362"></a>
    161 <a class="indexterm" name="id387369"></a>
    162 <a class="indexterm" name="id387376"></a>
    163 <a class="indexterm" name="id387383"></a>
    164 <a class="indexterm" name="id387390"></a>
     158</p></div><div class="sect2" title="Interdomain Trust Facilities"><div class="titlepage"><div><div><h3 class="title"><a name="id385492"></a>Interdomain Trust Facilities</h3></div></div></div><p>
     159<a class="indexterm" name="id385500"></a>
     160<a class="indexterm" name="id385507"></a>
     161<a class="indexterm" name="id385514"></a>
     162<a class="indexterm" name="id385521"></a>
     163<a class="indexterm" name="id385527"></a>
     164<a class="indexterm" name="id385534"></a>
    165165A two-way trust relationship is created when two one-way trusts are created, one in each direction.
    166166Where a one-way trust has been established between two MS Windows NT4 domains (let's call them
    … …  
    202202        Global groups from the trusted domain can be made members in local groups on
    203203        MS Windows domain member machines.
    204         </p></li></ul></div></div></div><div class="sect1" title="Configuring Samba NT-Style Domain Trusts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387544"></a>Configuring Samba NT-Style Domain Trusts</h2></div></div></div><p>
    205 <a class="indexterm" name="id387552"></a>
     204        </p></li></ul></div></div></div><div class="sect1" title="Configuring Samba NT-Style Domain Trusts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385688"></a>Configuring Samba NT-Style Domain Trusts</h2></div></div></div><p>
     205<a class="indexterm" name="id385696"></a>
    206206This description is meant to be a fairly short introduction about how to set up a Samba server so
    207207that it can participate in interdomain trust relationships. Trust relationship support in Samba
    208208is at an early stage, so do not be surprised if something does not function as it should.
    209209</p><p>
    210 <a class="indexterm" name="id387565"></a>
    211 <a class="indexterm" name="id387572"></a>
    212 <a class="indexterm" name="id387578"></a>
    213 <a class="indexterm" name="id387585"></a>
     210<a class="indexterm" name="id385708"></a>
     211<a class="indexterm" name="id385715"></a>
     212<a class="indexterm" name="id385722"></a>
     213<a class="indexterm" name="id385729"></a>
    214214Each of the procedures described next assumes the peer domain in the trust relationship is controlled by a
    215215Windows NT4 server. However, the remote end could just as well be another Samba-3  domain. It can be clearly
    … …  
    217217sections leads to trust between domains in a purely Samba environment.
    218218</p><div class="sect2" title="Samba as the Trusted Domain"><div class="titlepage"><div><div><h3 class="title"><a name="samba-trusted-domain"></a>Samba as the Trusted Domain</h3></div></div></div><p>
    219 <a class="indexterm" name="id387608"></a>
    220 <a class="indexterm" name="id387615"></a>
    221 <a class="indexterm" name="id387622"></a>
    222 <a class="indexterm" name="id387628"></a>
    223 <a class="indexterm" name="id387635"></a>
     219<a class="indexterm" name="id385752"></a>
     220<a class="indexterm" name="id385758"></a>
     221<a class="indexterm" name="id385765"></a>
     222<a class="indexterm" name="id385772"></a>
     223<a class="indexterm" name="id385779"></a>
    224224In order to set the Samba PDC to be the trusted party of the relationship, you first need
    225225to create a special account for the domain that will be the trusting party. To do that,
    … …  
    240240account with the Interdomain trust flag</span>&#8221;</span>.
    241241</p><p>
    242 <a class="indexterm" name="id387699"></a>
    243 <a class="indexterm" name="id387706"></a>
    244 <a class="indexterm" name="id387713"></a>
    245 <a class="indexterm" name="id387719"></a>
     242<a class="indexterm" name="id385843"></a>
     243<a class="indexterm" name="id385850"></a>
     244<a class="indexterm" name="id385856"></a>
     245<a class="indexterm" name="id385863"></a>
    246246The account name will be <span class="quote">&#8220;<span class="quote">rumba$</span>&#8221;</span> (the name of the remote domain).
    247247If this fails, you should check that the trust account has been added to the system
    … …  
    249249can add it manually and then repeat the previous step.
    250250</p><p>
    251 <a class="indexterm" name="id387741"></a>
    252 <a class="indexterm" name="id387748"></a>
    253 <a class="indexterm" name="id387755"></a>
    254 <a class="indexterm" name="id387762"></a>
     251<a class="indexterm" name="id385885"></a>
     252<a class="indexterm" name="id385892"></a>
     253<a class="indexterm" name="id385899"></a>
     254<a class="indexterm" name="id385905"></a>
    255255After issuing this command, you will be asked to enter the password for the account. You can use any password
    256256you want, but be aware that Windows NT will not change this password until 7 days following account creation.
    … …  
    260260Windows NT Server.
    261261</p><p>
    262 <a class="indexterm" name="id387780"></a>
    263 <a class="indexterm" name="id387786"></a>
    264 <a class="indexterm" name="id387793"></a>
    265 <a class="indexterm" name="id387800"></a>
    266 <a class="indexterm" name="id387807"></a>
     262<a class="indexterm" name="id385923"></a>
     263<a class="indexterm" name="id385930"></a>
     264<a class="indexterm" name="id385937"></a>
     265<a class="indexterm" name="id385944"></a>
     266<a class="indexterm" name="id385951"></a>
    267267Open <span class="application">User Manager for Domains</span> and from the <span class="guimenu">Policies</span> menu, select
    268268<span class="guimenuitem">Trust Relationships...</span>.  Beside the <span class="guilabel">Trusted domains</span> list box,
    … …  
    271271time of account creation.  Click on <span class="guibutton">OK</span> and, if everything went without incident, you
    272272will see the <code class="computeroutput">Trusted domain relationship successfully established</code> message.
    273 </p></div><div class="sect2" title="Samba as the Trusting Domain"><div class="titlepage"><div><div><h3 class="title"><a name="id387860"></a>Samba as the Trusting Domain</h3></div></div></div><p>
    274 <a class="indexterm" name="id387868"></a>
    275 <a class="indexterm" name="id387875"></a>
     273</p></div><div class="sect2" title="Samba as the Trusting Domain"><div class="titlepage"><div><div><h3 class="title"><a name="id386004"></a>Samba as the Trusting Domain</h3></div></div></div><p>
     274<a class="indexterm" name="id386012"></a>
     275<a class="indexterm" name="id386019"></a>
    276276This time activities are somewhat reversed. Again, we'll assume that your domain
    277277controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.
    … …  
    279279The very first step is to add an account for the SAMBA domain on RUMBA's PDC.
    280280</p><p>
    281 <a class="indexterm" name="id387890"></a>
    282 <a class="indexterm" name="id387897"></a>
    283 <a class="indexterm" name="id387904"></a>
     281<a class="indexterm" name="id386034"></a>
     282<a class="indexterm" name="id386041"></a>
     283<a class="indexterm" name="id386048"></a>
    284284Launch the <span class="application">Domain User Manager</span>, then from the menu select
    285285<span class="guimenu">Policies</span>, <span class="guimenuitem">Trust Relationships</span>.
    … …  
    288288the relationship.
    289289</p><p>
    290 <a class="indexterm" name="id387944"></a>
    291 <a class="indexterm" name="id387951"></a>
     290<a class="indexterm" name="id386088"></a>
     291<a class="indexterm" name="id386095"></a>
    292292The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you
    293293want. After you confirm the password, your account is ready for use. Now its Samba's turn.
    294294</p><p>
    295295Using your favorite shell while logged in as root, issue this command:
    296 <a class="indexterm" name="id387964"></a>
     296<a class="indexterm" name="id386108"></a>
    297297</p><p>
    298298<code class="prompt">root# </code><strong class="userinput"><code>net rpc trustdom establish rumba</code></strong>
    299299</p><p>
    300 <a class="indexterm" name="id387992"></a>
    301 <a class="indexterm" name="id387999"></a>
    302 <a class="indexterm" name="id388006"></a>
     300<a class="indexterm" name="id386136"></a>
     301<a class="indexterm" name="id386142"></a>
     302<a class="indexterm" name="id386149"></a>
    303303You will be prompted for the password you just typed on your Windows NT4 Server box.
    304304An error message, <code class="literal">"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT,"</code>
    … …  
    312312You have to run this command as root because you must have write access to
    313313the <code class="filename">secrets.tdb</code> file.
    314 </p></div></div></div><div class="sect1" title="NT4-Style Domain Trusts with Windows 2000"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388043"></a>NT4-Style Domain Trusts with Windows 2000</h2></div></div></div><p>
    315 <a class="indexterm" name="id388051"></a>
    316 <a class="indexterm" name="id388058"></a>
    317 <a class="indexterm" name="id388065"></a>
    318 <a class="indexterm" name="id388072"></a>
     314</p></div></div></div><div class="sect1" title="NT4-Style Domain Trusts with Windows 2000"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386187"></a>NT4-Style Domain Trusts with Windows 2000</h2></div></div></div><p>
     315<a class="indexterm" name="id386195"></a>
     316<a class="indexterm" name="id386202"></a>
     317<a class="indexterm" name="id386208"></a>
     318<a class="indexterm" name="id386215"></a>
    319319Although <span class="application">Domain User Manager</span> is not present in Windows 2000, it is
    320320also possible to establish an NT4-style trust relationship with a Windows 2000 domain
    … …  
    322322Samba to trust a Windows 2000 server; however, more testing is still needed in this area.
    323323</p><p>
    324 <a class="indexterm" name="id388090"></a>
    325 <a class="indexterm" name="id388097"></a>
    326 <a class="indexterm" name="id388104"></a>
    327 <a class="indexterm" name="id388111"></a>
     324<a class="indexterm" name="id386234"></a>
     325<a class="indexterm" name="id386241"></a>
     326<a class="indexterm" name="id386248"></a>
     327<a class="indexterm" name="id386254"></a>
    328328After <a class="link" href="InterdomainTrusts.html#samba-trusted-domain" title="Samba as the Trusted Domain">creating the interdomain trust account on the Samba server</a>
    329329as described previously, open <span class="application">Active Directory Domains and Trusts</span> on the AD
    … …  
    339339<code class="computeroutput">The trusted domain has been added and the trust has been verified.</code> Your
    340340Samba users can now be granted access to resources in the AD domain.
    341 </p></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388180"></a>Common Errors</h2></div></div></div><p>
     341</p></div><div class="sect1" title="Common Errors"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386324"></a>Common Errors</h2></div></div></div><p>
    342342Interdomain trust relationships should not be attempted on networks that are unstable
    343343or that suffer regular outages. Network stability and integrity are key concerns with
    344344distributed trusted domains.
    345 </p><div class="sect2" title="Browsing of Trusted Domain Fails"><div class="titlepage"><div><div><h3 class="title"><a name="id388191"></a>Browsing of Trusted Domain Fails</h3></div></div></div><p>
     345</p><div class="sect2" title="Browsing of Trusted Domain Fails"><div class="titlepage"><div><div><h3 class="title"><a name="id386334"></a>Browsing of Trusted Domain Fails</h3></div></div></div><p>
    346346<span class="emphasis"><em>Browsing from a machine in a trusted Windows 200x domain to a Windows 200x member of
    347347a trusting Samba domain, I get the following error:</em></span>
    … …  
    361361the domain.  If you are running as an account that has privileges to do this
    362362when you unjoin the machine, it is done; otherwise it is not done.
    363 </p></div><div class="sect2" title="Problems with LDAP ldapsam and Older Versions of smbldap-tools"><div class="titlepage"><div><div><h3 class="title"><a name="id388228"></a>Problems with LDAP ldapsam and Older Versions of smbldap-tools</h3></div></div></div><p>
     363</p></div><div class="sect2" title="Problems with LDAP ldapsam and Older Versions of smbldap-tools"><div class="titlepage"><div><div><h3 class="title"><a name="id386371"></a>Problems with LDAP ldapsam and Older Versions of smbldap-tools</h3></div></div></div><p>
    364364If you use the <code class="literal">smbldap-useradd</code> script to create a trust
    365365account to set up interdomain trusts, the process of setting up the trust will
Note: See TracChangeset for help on using the changeset viewer.