1
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter�15.�Interdomain Trust Relationships</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.64.1"><link rel="home" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part�III.�Advanced Configuration"><link rel="previous" href="securing-samba.html" title="Chapter�14.�Securing Samba"><link rel="next" href="msdfs.html" title="Chapter�16.�Hosting a Microsoft Distributed File System Tree"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter�15.�Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a>�</td><th width="60%" align="center">Part�III.�Advanced Configuration</th><td width="20%" align="right">�<a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter�15.�Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:mimir@samba.org">mimir@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><tt class="email"><<a href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>></tt></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="InterdomainTrusts.html#id2545174">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2545198">Trust Relationship Background</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2545269">Native MS Windows NT4 Trusts Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2545292">Creating an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2545354">Completing an NT4 Domain Trust</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2545404">Inter-Domain Trust Facilities</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2545580">Configuring Samba NT-Style Domain Trusts</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2545772">Samba as the Trusting Domain</a></span></dt></dl></dd><dt><span class="sect1"><a href="InterdomainTrusts.html#id2545893">NT4-Style Domain Trusts with Windows 2000</a></span></dt><dt><span class="sect1"><a href="InterdomainTrusts.html#id2545985">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="InterdomainTrusts.html#id2545998">Browsing of Trusted Domain Fails</a></span></dt><dt><span class="sect2"><a href="InterdomainTrusts.html#id2546039">Problems With LDAP ldapsam And The smbldap-tools</a></span></dt></dl></dd></dl></div><p>
2
<a class="indexterm" name="id2545158"></a>
3
Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
4
will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
5
adopt Active Directory or an LDAP-based authentication backend. This section explains
6
some background information regarding trust relationships and how to create them. It is now
7
possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba
9
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545174"></a>Features and Benefits</h2></div></div><div></div></div><p>
10
Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
11
trust relationships. This imparts to Samba similar scalability as with MS Windows NT4.
13
Given that Samba-3 has the capability to function with a scalable backend authentication
14
database such as LDAP, and given its ability to run in Primary as well as Backup Domain Control
15
modes, the administrator would be well advised to consider alternatives to the use of
16
Interdomain trusts simply because by the very nature of how this works it is fragile.
17
That was, after all, a key reason for the development and adoption of Microsoft Active Directory.
18
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545198"></a>Trust Relationship Background</h2></div></div><div></div></div><p>
19
MS Windows NT3/4 type security domains employ a non-hierarchical security structure.
20
The limitations of this architecture as it effects the scalability of MS Windows networking
21
in large organizations is well known. Additionally, the flat namespace that results from
22
this design significantly impacts the delegation of administrative responsibilities in
23
large and diverse organizations.
25
Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
26
of circumventing the limitations of the older technologies. Not every organization is ready
27
or willing to embrace ADS. For small companies the older NT4-style domain security paradigm
28
is quite adequate, there remains an entrenched user base for whom there is no direct
29
desire to go through a disruptive change to adopt ADS.
31
With MS Windows NT, Microsoft introduced the ability to allow differing security domains
32
to effect a mechanism so users from one domain may be given access rights and privileges
33
in another domain. The language that describes this capability is couched in terms of
34
<span class="emphasis"><em>Trusts</em></span>. Specifically, one domain will <span class="emphasis"><em>trust</em></span> the users
35
from another domain. The domain from which users are available to another security domain is
36
said to be a trusted domain. The domain in which those users have assigned rights and privileges
37
is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
38
thus if users in both domains are to have privileges and rights in each others' domain, then it is
39
necessary to establish two relationships, one in each direction.
41
In an NT4-style MS security domain, all trusts are non-transitive. This means that if there
42
are three domains (let's call them RED, WHITE and BLUE) where RED and WHITE have a trust
43
relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no
44
implied trust between the RED and BLUE domains. Relationships are explicit and not
47
New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way
48
by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE
49
domains above, with Windows 2000 and ADS the RED and BLUE domains can trust each other. This is
50
an inherent feature of ADS domains. Samba-3 implements MS Windows NT4-style Interdomain trusts
51
and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4-style domains.
52
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545269"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div><div></div></div><p>
53
There are two steps to creating an interdomain trust relationship. To effect a two-way trust
54
relationship, it is necessary for each domain administrator to create a trust account for the
55
other domain to use in verifying security credentials.
56
<a class="indexterm" name="id2545282"></a>
57
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2545292"></a>Creating an NT4 Domain Trust</h3></div></div><div></div></div><p>
58
For MS Windows NT4, all domain trust relationships are configured using the
59
<span class="application">Domain User Manager</span>. This is done from the Domain User Manager Policies
60
entry on the menu bar. From the <span class="guimenu">Policy</span> menu, select
61
<span class="guimenuitem">Trust Relationships</span>. Next to the lower box labeled
62
<span class="guilabel">Permitted to Trust this Domain</span> are two buttons, <span class="guibutton">Add</span>
63
and <span class="guibutton">Remove</span>. The <span class="guibutton">Add</span> button will open a panel in which
64
to enter the name of the remote domain that will be able to assign access rights to users in
65
your domain. You will also need to enter a password for this trust relationship, which the
66
trusting domain will use when authenticating users from the trusted domain.
67
The password needs to be typed twice (for standard confirmation).
68
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2545354"></a>Completing an NT4 Domain Trust</h3></div></div><div></div></div><p>
69
<a class="indexterm" name="id2545362"></a>
70
A trust relationship will work only when the other (trusting) domain makes the appropriate connections
71
with the trusted domain. To consummate the trust relationship, the administrator will launch the
72
Domain User Manager from the menu select <span class="guilabel">Policies</span>, then select
73
<span class="guilabel">Trust Relationships</span>, click on the <span class="guibutton">Add</span> button
74
next to the box that is labeled <span class="guilabel">Trusted Domains</span>. A panel will open in which
75
must be entered the name of the remote domain as well as the password assigned to that trust.
76
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2545404"></a>Inter-Domain Trust Facilities</h3></div></div><div></div></div><p>
77
<a class="indexterm" name="id2545412"></a>
78
A two-way trust relationship is created when two one-way trusts are created, one in each direction.
79
Where a one-way trust has been established between two MS Windows NT4 domains (let's call them
80
DomA and DomB), the following facilities are created:
81
</p><div class="figure"><a name="trusts1"></a><p class="title"><b>Figure�15.1.�Trusts overview.</b></p><div class="mediaobject"><img src="images/trusts1.png" width="270" alt="Trusts overview."></div></div><div class="itemizedlist"><ul type="disc"><li><p>
82
DomA (completes the trust connection) <i class="parameter"><tt>Trusts</tt></i> DomB.
84
DomA is the <i class="parameter"><tt>Trusting</tt></i> domain.
86
DomB is the <i class="parameter"><tt>Trusted</tt></i> domain (originates the trust account).
88
Users in DomB can access resources in DomA.
90
Users in DomA cannot access resources in DomB.
92
Global groups from DomB can be used in DomA.
94
Global groups from DomA cannot be used in DomB.
96
DomB does appear in the logon dialog box on client workstations in DomA.
98
DomA does not appear in the logon dialog box on client workstations in DomB.
99
</p></li></ul></div><div class="itemizedlist"><ul type="disc"><li><p>
100
Users/Groups in a trusting domain cannot be granted rights, permissions or access
103
The trusting domain can access and use accounts (Users/Global Groups) in the
106
Administrators of the trusted domain can be granted administrative rights in the
109
Users in a trusted domain can be given rights and privileges in the trusting
112
Trusted domain Global Groups can be given rights and permissions in the trusting
115
Global Groups from the trusted domain can be made members in Local Groups on
116
MS Windows Domain Member machines.
117
</p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545580"></a>Configuring Samba NT-Style Domain Trusts</h2></div></div><div></div></div><p>
118
This description is meant to be a fairly short introduction about how to set up a Samba server so
119
that it can participate in interdomain trust relationships. Trust relationship support in Samba
120
is at an early stage, so do not be surprised if something does not function as it should.
122
Each of the procedures described below assumes the peer domain in the trust relationship is
123
controlled by a Windows NT4 server. However, the remote end could just as well be another
124
Samba-3 domain. It can be clearly seen, after reading this document, that combining
125
Samba-specific parts of what's written below leads to trust between domains in a purely Samba
127
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="samba-trusted-domain"></a>Samba as the Trusted Domain</h3></div></div><div></div></div><p>
128
In order to set the Samba PDC to be the trusted party of the relationship, you first need
129
to create a special account for the domain that will be the trusting party. To do that,
130
you can use the <span><b class="command">smbpasswd</b></span> utility. Creating the trusted domain account is
131
similar to creating a trusted machine account. Suppose, your domain is
132
called SAMBA, and the remote domain is called RUMBA. The first step
133
will be to issue this command from your favorite shell:
135
</p><pre class="screen">
136
<tt class="prompt">root# </tt> <b class="userinput"><tt>smbpasswd -a -i rumba</tt></b>
137
New SMB password: <b class="userinput"><tt>XXXXXXXX</tt></b>
138
Retype SMB password: <b class="userinput"><tt>XXXXXXXX</tt></b>
142
where <tt class="option">-a</tt> means to add a new account into the
143
passdb database and <tt class="option">-i</tt> means: “<span class="quote"><span class="emphasis"><em>create this
144
account with the Inter-Domain trust flag</em></span></span>”.
146
The account name will be “<span class="quote"><span class="emphasis"><em>rumba$</em></span></span>” (the name of the remote domain).
147
If this fails, you should check that the trust account has been added to the system
148
password database (<tt class="filename">/etc/passwd</tt>). If it has not been added, you
149
can add it manually and then repeat the step above.
151
After issuing this command, you will be asked to enter the password for
152
the account. You can use any password you want, but be aware that Windows NT will
153
not change this password until seven days following account creation.
154
After the command returns successfully, you can look at the entry for the new account
155
(in the standard way as appropriate for your configuration) and see that accounts name is
156
really RUMBA$ and it has the “<span class="quote"><span class="emphasis"><em>I</em></span></span>” flag set in the flags field. Now you are ready to confirm
157
the trust by establishing it from Windows NT Server.
159
<a class="indexterm" name="id2545714"></a>
160
Open <span class="application">User Manager for Domains</span> and from the
161
<span class="guimenu">Policies</span> menu, select <span class="guimenuitem">Trust Relationships...</span>.
162
Beside the <span class="guilabel">Trusted domains</span> list box click the
163
<span class="guimenu">Add...</span> button. You will be prompted for
164
the trusted domain name and the relationship password. Type in SAMBA, as this is
165
the name of the remote domain and the password used at the time of account creation.
166
Click on <span class="guibutton">OK</span> and, if everything went without incident, you will see
167
the <tt class="computeroutput">Trusted domain relationship successfully
168
established</tt> message.
169
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2545772"></a>Samba as the Trusting Domain</h3></div></div><div></div></div><p>
170
This time activities are somewhat reversed. Again, we'll assume that your domain
171
controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.
173
The very first step is to add an account for the SAMBA domain on RUMBA's PDC.
175
<a class="indexterm" name="id2545791"></a>
176
Launch the <span class="application">Domain User Manager</span>, then from the menu select
177
<span class="guimenu">Policies</span>, <span class="guimenuitem">Trust Relationships</span>.
178
Now, next to the <span class="guilabel">Trusted Domains</span> box press the <span class="guibutton">Add</span>
179
button and type in the name of the trusted domain (SAMBA) and the password to use in securing
182
The password can be arbitrarily chosen. It is easy to change the password
183
from the Samba server whenever you want. After confirming the password your account is
184
ready for use. Now its Samba's turn.
186
Using your favorite shell while being logged in as root, issue this command:
188
<tt class="prompt">root# </tt><b class="userinput"><tt>net rpc trustdom establish rumba</tt></b>
190
You will be prompted for the password you just typed on your Windows NT4 Server box.
191
An error message <span class="errorname">`NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT'</span>
192
that may be reported periodically is of no concern and may safely be ignored.
193
It means the password you gave is correct and the NT4 Server says the account is ready for
194
interdomain connection and not for ordinary connection. After that, be patient;
195
it can take a while (especially in large networks), but eventually you should see
196
the <tt class="computeroutput">Success</tt> message. Congratulations! Your trust
197
relationship has just been established.
198
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
199
You have to run this command as root because you must have write access to
200
the <tt class="filename">secrets.tdb</tt> file.
201
</p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545893"></a>NT4-Style Domain Trusts with Windows 2000</h2></div></div><div></div></div><p>
202
Although <span class="application">Domain User Manager</span> is not present in Windows 2000, it is
203
also possible to establish an NT4-style trust relationship with a Windows 2000 domain
204
controller running in mixed mode as the trusting server. It should also be possible for
205
Samba to trust a Windows 2000 server, however, more testing is still needed in this area.
207
After <a href="InterdomainTrusts.html#samba-trusted-domain" title="Samba as the Trusted Domain">creating the interdomain trust account on the
208
Samba server</a> as described above, open <span class="application">Active Directory Domains and
209
Trusts</span> on the AD controller of the domain whose resources you wish Samba users
210
to have access to. Remember that since NT4-style trusts are not transitive, if you want
211
your users to have access to multiple mixed-mode domains in your AD forest, you will need to
212
repeat this process for each of those domains. With <span class="application">Active Directory Domains
213
and Trusts</span> open, right-click on the name of the Active Directory domain that
214
will trust our Samba domain and choose <span class="guimenuitem">Properties</span>, then click on
215
the <span class="guilabel">Trusts</span> tab. In the upper part of the panel, you will see a list box
216
labeled <span class="guilabel">Domains trusted by this domain:</span>, and an
217
<span class="guilabel">Add...</span> button next to it. Press this button and just as with NT4, you
218
will be prompted for the trusted domain name and the relationship password. Press OK and
219
after a moment, Active Directory will respond with <tt class="computeroutput">The trusted domain has
220
been added and the trust has been verified.</tt> Your Samba users can now be
221
granted access to resources in the AD domain.
222
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2545985"></a>Common Errors</h2></div></div><div></div></div><p>
223
Interdomain trust relationships should not be attempted on networks that are unstable
224
or that suffer regular outages. Network stability and integrity are key concerns with
225
distributed trusted domains.
226
</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2545998"></a>Browsing of Trusted Domain Fails</h3></div></div><div></div></div><p>
227
Browsing from a machine in a trusted Windows 200x Domain to a Windows 200x member of
228
a trusting samba domain, I get the following error:
229
</p><p><span class="emphasis"><em>
230
The system detected a possible attempt to compromise security. Please ensure that
231
you can contact the server that authenticated you.</em></span></p><p>
232
The event logs on the box I'm trying to connect to have entries regarding group
233
policy not being applied because it is a member of a down-level domain.
234
</p><p><span class="emphasis"><em>Answer: </em></span> If there is a computer account in the Windows
235
200x Domain for the machine in question, and it is disabled, this problem can
236
occur. If there is no computer account (removed or never existed), or if that
237
account is still intact (i.e.: you just joined it to another domain) everything
238
seems to be fine. By default, when you un-join a domain (the Windows 200x
239
Domain), the computer tries to automatically disable the computer account in
240
the domain. If you are running as an account which has privileges to do this
241
when you un-join the machine, it is done, otherwise it is not done.
242
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2546039"></a>Problems With LDAP ldapsam And The smbldap-tools</h3></div></div><div></div></div><p>
243
If you use the <span><b class="command">smbldap-useradd.pl</b></span> script to create a trust
244
account to set up Interdomain trusts the process of setting up the trust will
245
fail. The account that was created in the LDAP database will have an account
246
flags field that has <tt class="constant">[W ]</tt>, when it must have
247
<tt class="constant">[I ]</tt> for Interdomain trusts to work.
248
</p><p><span class="emphasis"><em>Answer: </em></span>Here is a simple solution.
249
Create a machine account as follows:
250
</p><pre class="screen">
251
<tt class="prompt">root# </tt> smbldap-useradd.pl -w domain_name
253
Then set the desired trust account password as shown here:
254
</p><pre class="screen">
255
<tt class="prompt">root# </tt> smbldap-passwd.pl domain_name\$
257
Using a text editor, create the following file:
258
</p><pre class="screen">
259
dn: uid=domain_name$,ou=People,dc={your-domain},dc={your-top-level-domain}
263
Then apply the text file to the LDAP database as follows:
264
</p><pre class="screen">
265
<tt class="prompt">root# </tt> ldapmodify -x -h localhost \
266
-D "cn=Manager,dc={your-domain},dc={your-top-level-domain}" \
267
-W -f /path-to/foobar
269
Create a single-sided trust under the NT4 Domain User Manager, then execute:
270
</p><pre class="screen">
271
<tt class="prompt">root# </tt> net rpc trustdom establish domain_name
274
It works with Samba-3 and NT4 Domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
275
Both DC's, samba and NT, must have the same WINS server otherwise
276
the trust will never work.
277
</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a>�</td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right">�<a accesskey="n" href="msdfs.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter�14.�Securing Samba�</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">�Chapter�16.�Hosting a Microsoft Distributed File System Tree</td></tr></table></div></body></html>
added
removed
docs/htmldocs/Samba-HOWTO-Collection/InterdomainTrusts.html
