diff options
Diffstat (limited to 'docs/docbook/projdoc/InterdomainTrusts.sgml')
-rw-r--r-- | docs/docbook/projdoc/InterdomainTrusts.sgml | 59 |
1 files changed, 31 insertions, 28 deletions
diff --git a/docs/docbook/projdoc/InterdomainTrusts.sgml b/docs/docbook/projdoc/InterdomainTrusts.sgml index bd96ef85d2..dc34e7eca7 100644 --- a/docs/docbook/projdoc/InterdomainTrusts.sgml +++ b/docs/docbook/projdoc/InterdomainTrusts.sgml @@ -12,7 +12,7 @@ Samba-3 supports NT4 style domain trust relationships. This is feature that many will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to adopt Active Directory or an LDAP based authentication back end. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba3 to NT4 trust (and vica versa), as well as Samba3 to Samba3 trusts. +possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. </para> <sect1> @@ -58,7 +58,9 @@ transitive. New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. +an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 +style Interdomain trusts and interoperates with MS Windows 200x ADS +security domains in similar manner to MS Windows NT4 style domains. </para> </sect1> @@ -107,7 +109,7 @@ which must be entered the name of the remote domain as well as the password assi <para> This description is meant to be a fairly short introduction about how to set up a Samba server so that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things doesn't work yet. +is in its early stage, so lot of things don't work yet. </para> <para> @@ -122,9 +124,9 @@ between domains in purely Samba environment. <para> In order to set Samba PDC to be trusted party of the relationship first you need -to create special account for domain that will be the trusting party. To do that, -you can use 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating trusted machine account. Suppose, your domain is +to create special account for the domain that will be the trusting party. To do that, +you can use the 'smbpasswd' utility. Creating the trusted domain account is very +similiar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step will be to issue this command from your favourite shell: </para> @@ -147,10 +149,10 @@ The account name will be 'rumba$' (the name of the remote domain) </para> <para> -After issuing this command you'll be asked for typing account's -password. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days have passed since account creating. -After command returns successfully, you can look at your new account's entry +After issuing this command you'll be asked to enter the password for +the account. You can use any password you want, but be aware that Windows NT will +not change this password until 7 days following account creation. +After the command returns successfully, you can look at the entry for new account (in the way depending on your configuration) and see that account's name is really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm the trust by establishing it from Windows NT Server. @@ -158,11 +160,11 @@ the trust by establishing it from Windows NT Server. <para> Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'. -Right beside 'Trusted domains' list box press 'Add...' button. You'll be prompted for -trusted domain name and the relationship's password. Type in SAMBA, as this is -your domain name, and the password you've just used for account creation. -Press OK and, if everything went fine, you will see 'Trusted domain relationship -successfully established' message. Well done. +Right beside 'Trusted domains' list box press 'Add...' button. You will be prompted for +the trusted domain name and the relationship password. Type in SAMBA, as this is +your domain name, and the password used at the time of account creation. +Press OK and, if everything went without incident, you will see 'Trusted domain relationship +successfully established' message. </para> </sect2> @@ -171,11 +173,11 @@ successfully established' message. Well done. <para> This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. +controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. </para> <para> -The very first thing is to add account for SAMBA domain on RUMBA's PDC. +The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. </para> <para> @@ -185,13 +187,13 @@ domain (SAMBA) and password securing the relationship. </para> <para> -Password can be arbitrarily chosen, the more because it's easy to change it -from Samba server whenever you want. After confirming password your account is -ready and waiting. Now it's Samba's turn. +The password can be arbitrarily chosen. It is easy to change it the password +from Samba server whenever you want. After confirming the password your account is +ready for use. Now it's Samba's turn. </para> <para> -Using your favourite shell while being logged on as root, issue this command: +Using your favourite shell while being logged in as root, issue this command: </para> <para> @@ -199,18 +201,19 @@ Using your favourite shell while being logged on as root, issue this command: </para> <para> -You'll be prompted for password you've just typed on your Windows NT4 Server box. -Don't worry if you will see the error message with returned code of +You will be prompted for the password you just typed on your Windows NT4 Server box. +Don not worry if you see an error message that mentions a returned code of <errorname>NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT</errorname>. It means the -password you gave is correct and the NT4 Server says the account is ready for trusting your domain -and not for ordinary connection. After that, be patient it can take a while (especially -in large networks), you should see 'Success' message. Contgratulations! Your trust +password you gave is correct and the NT4 Server says the account is +ready for interdomain connection and not for ordinary +connection. After that, be patient it can take a while (especially +in large networks), you should see the 'Success' message. Congratulations! Your trust relationship has just been established. </para> <note><para> -Note that you have to run this command as root, since you need write access to -your <filename>secrets.tdb</filename> file. +Note that you have to run this command as root because you must have write access to +the <filename>secrets.tdb</filename> file. </para></note> </sect2> |