Chapter 16. Interdomain Trust Relationships

Samba-3 supports NT4 style domain trust relationships. This is feature that many sites will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to adopt Active Directory or an LDAP based authentication back end. This section explains some background information regarding trust relationships and how to create them. It is now possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. -

Features and Benefits

Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style trust relationships. This imparts to Samba similar scalability as is possible with MS Windows NT4. @@ -13,9 +12,9 @@ MS Windows NT4. Given that Samba-3 has the capability to function with a scalable backend authentication database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control modes, the administrator would be well advised to consider alternatives to the use of -Interdomain trusts simplt because by the very nature of how this works it is fragile. -That was after all a key reason for the development and adoption of Microsoft Active Directory. -

Trust Relationship Background

+Interdomain trusts simply because by the very nature of how this works it is fragile. +That was, after all, a key reason for the development and adoption of Microsoft Active Directory. +

Trust Relationship Background

MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. The limitations of this architecture as it affects the scalability of MS Windows networking in large organisations is well known. Additionally, the flat-name space that results from @@ -50,9 +49,9 @@ domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 style Interdomain trusts and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4 style domains. -

Native MS Windows NT4 Trusts Configuration

There are two steps to creating an interdomain trust relationship. -

NT4 as the Trusting Domain (ie. creating the trusted account)

For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. To affect a two way trust relationship it is necessary for each domain administrator to make available (for use by an external domain) it's @@ -64,14 +63,14 @@ button will open a panel in which needs to be entered the remote domain that wil user rights to your domain. In addition it is necessary to enter a password that is specific to this trust relationship. The password needs to be typed twice (for standard confirmation). -

NT4 as the Trusted Domain (ie. creating trusted account's password)

A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consumate the trust relationship the administrator will launch the +with the trusted domain. To consummate the trust relationship the administrator will launch the Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the Add button that is next to the box that is labelled Trusted Domains. A panel will open in which must be entered the name of the remote domain as well as the password assigned to that trust. -

Configuring Samba NT-style Domain Trusts

This description is meant to be a fairly short introduction about how to set up a Samba server so that it could participate in interdomain trust relationships. Trust relationship support in Samba is in its early stage, so lot of things don't work yet. @@ -80,32 +79,32 @@ Each of the procedures described below is treated as they were performed with Wi one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after reading this document, that combining Samba-specific parts of what's written below leads to trust between domains in purely Samba environment. -

Samba-3 as the Trusting Domain

In order to set the Samba PDC to be the trusted party of the relationship first you need to create special account for the domain that will be the trusting party. To do that, you can use the 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating a trusted machine account. Suppose, your domain is +similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step will be to issue this command from your favourite shell: -

 root#  smbpasswd -a -i rumba
 	New SMB password: XXXXXXXX
 	Retype SMB password: XXXXXXXX
 	Added user rumba$
-

where -a means to add a new account into the passdb database and -i means: ''create this account with the InterDomain trust flag'' -

The account name will be 'rumba$' (the name of the remote domain)

After issuing this command you'll be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will not change this password until 7 days following account creation. After the command returns successfully, you can look at the entry for the new account -(in the stardard way depending on your configuration) and see that account's name is +(in the standard way depending on your configuration) and see that account's name is really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm the trust by establishing it from Windows NT Server.

@@ -118,7 +117,7 @@ your domain name, and the password used at the time of account creation. Press OK and, if everything went without incident, you will see Trusted domain relationship successfully established message. -

Samba-3 as the Trusted Domain

This time activities are somewhat reversed. Again, we'll assume that your domain controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.

@@ -149,11 +148,11 @@ Congratulations! Your trust relationship has just been established.

Note

Note that you have to run this command as root because you must have write access to the secrets.tdb file. -

Common Errors

Interdomain trust relationships should NOT be attempted on networks that are unstable or that suffer regular outages. Network stability and integrity are key concerns with distributed trusted domains. -

Tell me about Trust Relationships using Samba

Like many, I administer multiple LANs connected together using NT trust relationships. This was implemented about 4 years ago. I now have the occasion to consider performing this same task again, but this time, I @@ -170,7 +169,7 @@ distributed trusted domains. Please provide any helpful feedback that you may have.

These are almost complete in Samba 3.0 snapshots. The main catch - is getting winbindd to be able to allocate uid/gid's for trusted + is getting winbindd to be able to allocate UID/GIDs for trusted users/groups. See the updated Samba HOWTO collection for more details.

Prev	Up	Next
Chapter 15. Securing Samba	Home	Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

-- cgit