1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3 <chapter id="InterdomainTrusts">
7 <author>&person.jelmer;<contrib>drawing</contrib></author>
9 <firstname>Stephen</firstname><surname>Langasek</surname>
11 <address><email>vorlon@netexpress.net</email></address>
14 <pubdate>April 3, 2003</pubdate>
17 <title>Interdomain Trust Relationships</title>
21 <indexterm><primary>Interdomain Trusts</primary></indexterm>
22 <indexterm><primary>LDAP</primary></indexterm>
23 <indexterm><primary>trusts</primary></indexterm>
24 <indexterm><primary>samba-to-samba trusts</primary></indexterm>
25 <indexterm><primary>Active Directory</primary></indexterm>
26 Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites
27 will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to
28 adopt Active Directory or an LDAP-based authentication backend. This section explains
29 some background information regarding trust relationships and how to create them. It is now
30 possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba
35 <indexterm><primary>winbind</primary></indexterm>
36 <indexterm><primary>UID range</primary></indexterm>
37 <indexterm><primary>GID range</primary></indexterm>
38 The use of interdomain trusts requires use of <command>winbind</command>. Thus the
39 <command>winbindd</command> daemon must be running. Winbind operation in this mode is
40 dependant on the specification of a valid UID range and a valid GID range in the &smb.conf; file.
41 These are specified respectively using
42 <smbconfoption name="idmap uid">10000-20000</smbconfoption> and
43 <smbconfoption name="idmap gid">10000-20000</smbconfoption>.
47 The use of winbind is necessary only when Samba is the trusting Domain, not when it is the
52 <title>Features and Benefits</title>
55 Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style
56 trust relationships. This imparts to Samba similar scalability as with MS Windows NT4.
60 Given that Samba-3 has the capability to function with a scalable backend authentication
61 database such as LDAP, and given its ability to run in Primary as well as Backup Domain Control
62 modes, the administrator would be well advised to consider alternatives to the use of
63 Interdomain trusts simply because by the very nature of how this works it is fragile.
64 That was, after all, a key reason for the development and adoption of Microsoft Active Directory.
70 <title>Trust Relationship Background</title>
73 MS Windows NT3/4 type security domains employ a non-hierarchical security structure.
74 The limitations of this architecture as it effects the scalability of MS Windows networking
75 in large organizations is well known. Additionally, the flat namespace that results from
76 this design significantly impacts the delegation of administrative responsibilities in
77 large and diverse organizations.
81 Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
82 of circumventing the limitations of the older technologies. Not every organization is ready
83 or willing to embrace ADS. For small companies the older NT4-style domain security paradigm
84 is quite adequate, there remains an entrenched user base for whom there is no direct
85 desire to go through a disruptive change to adopt ADS.
89 With MS Windows NT, Microsoft introduced the ability to allow differing security domains
90 to effect a mechanism so users from one domain may be given access rights and privileges
91 in another domain. The language that describes this capability is couched in terms of
92 <emphasis>Trusts</emphasis>. Specifically, one domain will <emphasis>trust</emphasis> the users
93 from another domain. The domain from which users are available to another security domain is
94 said to be a trusted domain. The domain in which those users have assigned rights and privileges
95 is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
96 thus if users in both domains are to have privileges and rights in each others' domain, then it is
97 necessary to establish two relationships, one in each direction.
101 In an NT4-style MS security domain, all trusts are non-transitive. This means that if there
102 are three domains (let's call them RED, WHITE and BLUE) where RED and WHITE have a trust
103 relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no
104 implied trust between the RED and BLUE domains. Relationships are explicit and not
109 New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way
110 by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE
111 domains above, with Windows 2000 and ADS the RED and BLUE domains can trust each other. This is
112 an inherent feature of ADS domains. Samba-3 implements MS Windows NT4-style Interdomain trusts
113 and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4-style domains.
119 <title>Native MS Windows NT4 Trusts Configuration</title>
122 There are two steps to creating an interdomain trust relationship. To effect a two-way trust
123 relationship, it is necessary for each domain administrator to create a trust account for the
124 other domain to use in verifying security credentials.
125 <indexterm><primary>Interdomain Trusts</primary><secondary>creating</secondary></indexterm>
130 <title>Creating an NT4 Domain Trust</title>
133 For MS Windows NT4, all domain trust relationships are configured using the
134 <application>Domain User Manager</application>. This is done from the Domain User Manager Policies
135 entry on the menu bar. From the <guimenu>Policy</guimenu> menu, select
136 <guimenuitem>Trust Relationships</guimenuitem>. Next to the lower box labeled
137 <guilabel>Permitted to Trust this Domain</guilabel> are two buttons, <guibutton>Add</guibutton>
138 and <guibutton>Remove</guibutton>. The <guibutton>Add</guibutton> button will open a panel in which
139 to enter the name of the remote domain that will be able to assign access rights to users in
140 your domain. You will also need to enter a password for this trust relationship, which the
141 trusting domain will use when authenticating users from the trusted domain.
142 The password needs to be typed twice (for standard confirmation).
149 <title>Completing an NT4 Domain Trust</title>
152 <indexterm><primary>Interdomain Trusts</primary><secondary>Completing</secondary></indexterm>
153 A trust relationship will work only when the other (trusting) domain makes the appropriate connections
154 with the trusted domain. To consummate the trust relationship, the administrator will launch the
155 Domain User Manager from the menu select <guilabel>Policies</guilabel>, then select
156 <guilabel>Trust Relationships</guilabel>, click on the <guibutton>Add</guibutton> button
157 next to the box that is labeled <guilabel>Trusted Domains</guilabel>. A panel will open in which
158 must be entered the name of the remote domain as well as the password assigned to that trust.
164 <title>Inter-Domain Trust Facilities</title>
168 <indexterm><primary>Interdomain Trusts</primary><secondary>Facilities</secondary></indexterm>
169 A two-way trust relationship is created when two one-way trusts are created, one in each direction.
170 Where a one-way trust has been established between two MS Windows NT4 domains (let's call them
171 DomA and DomB), the following facilities are created:
175 <imagedescription>Trusts overview.</imagedescription>
176 <imagefile>trusts1</imagefile>
181 DomA (completes the trust connection) <parameter>Trusts</parameter> DomB.
185 DomA is the <parameter>Trusting</parameter> domain.
189 DomB is the <parameter>Trusted</parameter> domain (originates the trust account).
193 Users in DomB can access resources in DomA.
197 Users in DomA cannot access resources in DomB.
201 Global groups from DomB can be used in DomA.
205 Global groups from DomA cannot be used in DomB.
209 DomB does appear in the logon dialog box on client workstations in DomA.
213 DomA does not appear in the logon dialog box on client workstations in DomB.
219 Users/Groups in a trusting domain cannot be granted rights, permissions or access
224 The trusting domain can access and use accounts (Users/Global Groups) in the
229 Administrators of the trusted domain can be granted administrative rights in the
234 Users in a trusted domain can be given rights and privileges in the trusting
239 Trusted domain Global Groups can be given rights and permissions in the trusting
244 Global Groups from the trusted domain can be made members in Local Groups on
245 MS Windows Domain Member machines.
254 <title>Configuring Samba NT-Style Domain Trusts</title>
257 This description is meant to be a fairly short introduction about how to set up a Samba server so
258 that it can participate in interdomain trust relationships. Trust relationship support in Samba
259 is at an early stage, so do not be surprised if something does not function as it should.
263 Each of the procedures described below assumes the peer domain in the trust relationship is
264 controlled by a Windows NT4 server. However, the remote end could just as well be another
265 Samba-3 domain. It can be clearly seen, after reading this document, that combining
266 Samba-specific parts of what's written below leads to trust between domains in a purely Samba
270 <sect2 id="samba-trusted-domain">
271 <title>Samba as the Trusted Domain</title>
274 In order to set the Samba PDC to be the trusted party of the relationship, you first need
275 to create a special account for the domain that will be the trusting party. To do that,
276 you can use the <command>smbpasswd</command> utility. Creating the trusted domain account is
277 similar to creating a trusted machine account. Suppose, your domain is
278 called SAMBA, and the remote domain is called RUMBA. The first step
279 will be to issue this command from your favorite shell:
284 &rootprompt; <userinput>smbpasswd -a -i rumba</userinput>
285 New SMB password: <userinput>XXXXXXXX</userinput>
286 Retype SMB password: <userinput>XXXXXXXX</userinput>
290 where <option>-a</option> means to add a new account into the
291 passdb database and <option>-i</option> means: <quote>create this
292 account with the Inter-Domain trust flag</quote>.
296 The account name will be <quote>rumba$</quote> (the name of the remote domain).
297 If this fails, you should check that the trust account has been added to the system
298 password database (<filename>/etc/passwd</filename>). If it has not been added, you
299 can add it manually and then repeat the step above.
303 After issuing this command, you will be asked to enter the password for
304 the account. You can use any password you want, but be aware that Windows NT will
305 not change this password until seven days following account creation.
306 After the command returns successfully, you can look at the entry for the new account
307 (in the standard way as appropriate for your configuration) and see that accounts name is
308 really RUMBA$ and it has the <quote>I</quote> flag set in the flags field. Now you are ready to confirm
309 the trust by establishing it from Windows NT Server.
314 <indexterm><primary>User Manager</primary></indexterm>
315 Open <application>User Manager for Domains</application> and from the
316 <guimenu>Policies</guimenu> menu, select <guimenuitem>Trust Relationships...</guimenuitem>.
317 Beside the <guilabel>Trusted domains</guilabel> list box click the
318 <guimenu>Add...</guimenu> button. You will be prompted for
319 the trusted domain name and the relationship password. Type in SAMBA, as this is
320 the name of the remote domain and the password used at the time of account creation.
321 Click on <guibutton>OK</guibutton> and, if everything went without incident, you will see
322 the <computeroutput>Trusted domain relationship successfully
323 established</computeroutput> message.
328 <title>Samba as the Trusting Domain</title>
331 This time activities are somewhat reversed. Again, we'll assume that your domain
332 controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.
336 The very first step is to add an account for the SAMBA domain on RUMBA's PDC.
341 <indexterm><primary>User Manager</primary></indexterm>
342 Launch the <application>Domain User Manager</application>, then from the menu select
343 <guimenu>Policies</guimenu>, <guimenuitem>Trust Relationships</guimenuitem>.
344 Now, next to the <guilabel>Trusted Domains</guilabel> box press the <guibutton>Add</guibutton>
345 button and type in the name of the trusted domain (SAMBA) and the password to use in securing
350 The password can be arbitrarily chosen. It is easy to change the password
351 from the Samba server whenever you want. After confirming the password your account is
352 ready for use. Now its Samba's turn.
356 Using your favorite shell while being logged in as root, issue this command:
360 &rootprompt;<userinput>net rpc trustdom establish rumba</userinput>
364 You will be prompted for the password you just typed on your Windows NT4 Server box.
365 An error message <errorname>`NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT'</errorname>
366 that may be reported periodically is of no concern and may safely be ignored.
367 It means the password you gave is correct and the NT4 Server says the account is ready for
368 interdomain connection and not for ordinary connection. After that, be patient;
369 it can take a while (especially in large networks), but eventually you should see
370 the <computeroutput>Success</computeroutput> message. Congratulations! Your trust
371 relationship has just been established.
375 You have to run this command as root because you must have write access to
376 the <filename>secrets.tdb</filename> file.
383 <title>NT4-Style Domain Trusts with Windows 2000</title>
385 Although <application>Domain User Manager</application> is not present in Windows 2000, it is
386 also possible to establish an NT4-style trust relationship with a Windows 2000 domain
387 controller running in mixed mode as the trusting server. It should also be possible for
388 Samba to trust a Windows 2000 server, however, more testing is still needed in this area.
392 After <link linkend="samba-trusted-domain">creating the interdomain trust account on the
393 Samba server</link> as described above, open <application>Active Directory Domains and
394 Trusts</application> on the AD controller of the domain whose resources you wish Samba users
395 to have access to. Remember that since NT4-style trusts are not transitive, if you want
396 your users to have access to multiple mixed-mode domains in your AD forest, you will need to
397 repeat this process for each of those domains. With <application>Active Directory Domains
398 and Trusts</application> open, right-click on the name of the Active Directory domain that
399 will trust our Samba domain and choose <guimenuitem>Properties</guimenuitem>, then click on
400 the <guilabel>Trusts</guilabel> tab. In the upper part of the panel, you will see a list box
401 labeled <guilabel>Domains trusted by this domain:</guilabel>, and an
402 <guilabel>Add...</guilabel> button next to it. Press this button and just as with NT4, you
403 will be prompted for the trusted domain name and the relationship password. Press OK and
404 after a moment, Active Directory will respond with <computeroutput>The trusted domain has
405 been added and the trust has been verified.</computeroutput> Your Samba users can now be
406 granted access to resources in the AD domain.
411 <title>Common Errors</title>
414 Interdomain trust relationships should not be attempted on networks that are unstable
415 or that suffer regular outages. Network stability and integrity are key concerns with
416 distributed trusted domains.
420 <title>Browsing of Trusted Domain Fails</title>
423 Browsing from a machine in a trusted Windows 200x Domain to a Windows 200x member of
424 a trusting samba domain, I get the following error:
428 The system detected a possible attempt to compromise security. Please ensure that
429 you can contact the server that authenticated you.
433 The event logs on the box I'm trying to connect to have entries regarding group
434 policy not being applied because it is a member of a down-level domain.
437 <para><emphasis>Answer: </emphasis> If there is a computer account in the Windows
438 200x Domain for the machine in question, and it is disabled, this problem can
439 occur. If there is no computer account (removed or never existed), or if that
440 account is still intact (i.e.: you just joined it to another domain) everything
441 seems to be fine. By default, when you un-join a domain (the Windows 200x
442 Domain), the computer tries to automatically disable the computer account in
443 the domain. If you are running as an account which has privileges to do this
444 when you un-join the machine, it is done, otherwise it is not done.
450 <title>Problems With LDAP ldapsam And The smbldap-tools</title>
453 If you use the <command>smbldap-useradd.pl</command> script to create a trust
454 account to set up Interdomain trusts the process of setting up the trust will
455 fail. The account that was created in the LDAP database will have an account
456 flags field that has <constant>[W ]</constant>, when it must have
457 <constant>[I ]</constant> for Interdomain trusts to work.
460 <para><emphasis>Answer: </emphasis>Here is a simple solution.
461 Create a machine account as follows:
463 &rootprompt; smbldap-useradd.pl -w domain_name
465 Then set the desired trust account password as shown here:
467 &rootprompt; smbldap-passwd.pl domain_name\$
469 Using a text editor, create the following file:
471 dn: uid=domain_name$,ou=People,dc={your-domain},dc={your-top-level-domain}
475 Then apply the text file to the LDAP database as follows:
477 &rootprompt; ldapmodify -x -h localhost \
478 -D "cn=Manager,dc={your-domain},dc={your-top-level-domain}" \
479 -W -f /path-to/foobar
481 Create a single-sided trust under the NT4 Domain User Manager, then execute:
483 &rootprompt; net rpc trustdom establish domain_name
488 It works with Samba-3 and NT4 Domains, and also with Samba-3 and Windows 200x ADS in mixed mode.
489 Both DC's, samba and NT, must have the same WINS server otherwise
490 the trust will never work.