diff options
author | John Terpstra <jht@samba.org> | 2003-04-14 12:19:54 +0000 |
---|---|---|
committer | John Terpstra <jht@samba.org> | 2003-04-14 12:19:54 +0000 |
commit | 999a00bcac4d317dd304ded987bf21bec783140f (patch) | |
tree | 62d8d5f1abce519bff808b6dfa211584d945b40d /docs/docbook/projdoc | |
parent | 8403454aae4c84412705df70dd0e05702f22584f (diff) | |
download | samba-999a00bcac4d317dd304ded987bf21bec783140f.tar.gz samba-999a00bcac4d317dd304ded987bf21bec783140f.tar.bz2 samba-999a00bcac4d317dd304ded987bf21bec783140f.zip |
Partial review of changes by mimir. Work in progress.
(This used to be commit 77bdd68b65d6d485a484ca1b3475ffbb772f8661)
Diffstat (limited to 'docs/docbook/projdoc')
-rw-r--r-- | docs/docbook/projdoc/InterdomainTrusts.sgml | 52 |
1 files changed, 27 insertions, 25 deletions
diff --git a/docs/docbook/projdoc/InterdomainTrusts.sgml b/docs/docbook/projdoc/InterdomainTrusts.sgml index 7ad546bb7b..56b0dcc710 100644 --- a/docs/docbook/projdoc/InterdomainTrusts.sgml +++ b/docs/docbook/projdoc/InterdomainTrusts.sgml @@ -19,7 +19,7 @@ possible for Samba3 to NT4 trust (and vica versa), as well as Samba3 to Samba3 t <title>Trust Relationship Background</title> <para> -MS Windows NT3.x/4.0 type security domains employ a non-hierchical security structure. +MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. The limitations of this architecture as it affects the scalability of MS Windows networking in large organisations is well known. Additionally, the flat-name space that results from this design significantly impacts the delegation of administrative responsibilities in @@ -36,13 +36,13 @@ desire to go through a disruptive change to adopt ADS. <para> Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privilidges +to affect a mechanism so that users from one domain may be given access rights and privileges in another domain. The language that describes this capability is couched in terms of <emphasis>Trusts</emphasis>. Specifically, one domain will <emphasis>trust</emphasis> the users from another domain. The domain from which users are available to another security domain is -said to be a trusted domain. The domain in which those users have assigned rights and privilidges +said to be a trusted domain. The domain in which those users have assigned rights and privileges is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, -thus if users in both domains are to have privilidges and rights in each others' domain, then it is +thus if users in both domains are to have privileges and rights in each others' domain, then it is necessary to establish two (2) relationships, one in each direction. </para> @@ -64,14 +64,14 @@ an inherent feature of ADS domains. </sect1> <sect1> -<title>MS Windows NT4 Trust Configuration</title> +<title>Native MS Windows NT4 Trusts Configuration</title> <para> -There are two steps to creating an inter-domain trust relationship. +There are two steps to creating an interdomain trust relationship. </para> <sect2> -<title>NT4 as the Trusting Domain</title> +<title>NT4 as the Trusting Domain (ie. creating the trusted account)</title> <para> For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. @@ -81,13 +81,14 @@ User Manager Policies entry on the menu bar. From the Policy menu, select Trust next to the lower box that is labelled "Permitted to Trust this Domain" are two buttons, "Add" and "Remove". The "Add" button will open a panel in which needs to be entered the remote domain that will be able to assign user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password is added twice. +that is specific to this trust relationship. The password needs to be +typed twice (for standard confirmation). </para> </sect2> <sect2> -<title>NT4 as the Trusted Domain</title> +<title>NT4 as the Trusted Domain (ie. creating trusted account's password)</title> <para> A trust relationship will work only when the other (trusting) domain makes the appropriate connections @@ -101,32 +102,31 @@ which must be entered the name of the remote domain as well as the password assi </sect1> <sect1> -<title>Configuring Samba Domain Trusts</title> +<title>Configuring Samba NT-style Domain Trusts</title> <para> This descitpion is meant to be a fairly short introduction about how to set up a Samba server so that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet. Paricularly, the contents of this document -applies to NT4-style trusts. +is in its early stage, so lot of things doesn't work yet. </para> <para> Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The other end could just as well be another Samba3 domain. It can be clearly seen, after +one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after reading this document, that combining Samba-specific parts of what's written below leads to trust between domains in purely Samba environment. </para> <sect2> -<title>Samba3 as the Trusting Domain</title> +<title>Samba-3 as the Trusting Domain</title> <para> In order to set Samba PDC to be trusted party of the relationship first you need to create special account for domain that will be the trusting party. To do that, you can use 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating the connection to the trusting machine's account. Suppose, -your domain is called SAMBA, and the remote domain is called RUMBA. Your first -step will be to issue this command from your favourite shell: +similiar to creating trusted machine account. Suppose, your domain is +called SAMBA, and the remote domain is called RUMBA. The first step +will be to issue this command from your favourite shell: </para> <para> @@ -137,7 +137,9 @@ step will be to issue this command from your favourite shell: Added user rumba$ </screen> -where <parameter>-a</parameter> means to add a new account into the passdb database and <parameter>-i</parameter> means create this account with the Inter-Domain trust flag. +where <parameter>-a</parameter> means to add a new account into the +passdb database and <parameter>-i</parameter> means: ''create this +account with the InterDomain trust flag'' </para> <para> @@ -145,7 +147,7 @@ The account name will be 'rumba$' (the name of the remote domain) </para> <para> -fter issuing this command you'll be asked for typing account's +After issuing this command you'll be asked for typing account's password. You can use any password you want, but be aware that Windows NT will not change this password until 7 days have passed since account creating. After command returns successfully, you can look at your new account's entry @@ -156,16 +158,16 @@ the trust by establishing it from Windows NT Server. <para> Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'. -Right beside 'Trusted domains' list press 'Add...' button. You'll be prompted for +Right beside 'Trusted domains' list box press 'Add...' button. You'll be prompted for trusted domain name and the relationship's password. Type in SAMBA, as this is -your domain name and the password you've just used during account creation. -Press OK and if everything went fine, you will see 'Trusted domain relationship +your domain name, and the password you've just used for account creation. +Press OK and, if everything went fine, you will see 'Trusted domain relationship successfully established' message. Well done. </para> </sect2> <sect2> -<title>Samba3 as the Trusted Domain</title> +<title>Samba-3 as the Trusted Domain</title> <para> This time activities are somewhat reversed. Again, we'll assume that your domain @@ -179,11 +181,11 @@ The very first thing is to add account for SAMBA domain on RUMBA's PDC. <para> Launch the Domain User Manager, then from the menu select 'Policies', 'Trust Relationships'. Now, next to 'Trusted Domains' box press the 'Add' button, and type in the name of the trusted -domein (SAMBA) and password securing the relationship. +domain (SAMBA) and password securing the relationship. </para> <para> -Password can be arbitrarily chosen the more, because it's easy to change it +Password can be arbitrarily chosen, the more because it's easy to change it from Samba server whenever you want. After confirming password your account is ready and waiting. Now it's Samba's turn. </para> |