docs/htmldocs/InterdomainTrusts.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Interdomain Trust Relationships</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="samba-doc.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="securing-samba.html" title="Chapter 15. Securing Samba"><link rel="next" href="msdfs.html" title="Chapter 17. Hosting a Microsoft Distributed File System tree on Samba"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Interdomain Trust Relationships</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="InterdomainTrusts"></a>Chapter 16. Interdomain Trust Relationships</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email">&lt;<a href="mailto:jht@samba.org">jht@samba.org</a>&gt;</tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Rafal</span> <span class="surname">Szczesniak</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email">&lt;<a href="mailto:mimir@samba.org">mimir@samba.org</a>&gt;</tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><span class="contrib">drawing</span><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email">&lt;<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>&gt;</tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Stephen</span> <span class="surname">Langasek</span></h3><div class="affiliation"><div class="address"><p><tt class="email">&lt;<a href="mailto:vorlon@netexpress.net">vorlon@netexpress.net</a>&gt;</tt></p></div></div></div></div><div><p class="pubdate">April 3, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="InterdomainTrusts.html#id2911605">Features and Benefits</a></dt><dt><a href="InterdomainTrusts.html#id2911633">Trust Relationship Background</a></dt><dt><a href="InterdomainTrusts.html#id2911721">Native MS Windows NT4 Trusts Configuration</a></dt><dd><dl><dt><a href="InterdomainTrusts.html#id2911750">Creating an NT4 Domain Trust</a></dt><dt><a href="InterdomainTrusts.html#id2911822">Completing an NT4 Domain Trust</a></dt><dt><a href="InterdomainTrusts.html#id2911868">Inter-Domain Trust Facilities</a></dt></dl></dd><dt><a href="InterdomainTrusts.html#id2912046">Configuring Samba NT-style Domain Trusts</a></dt><dd><dl><dt><a href="InterdomainTrusts.html#samba-trusted-domain">Samba as the Trusted Domain</a></dt><dt><a href="InterdomainTrusts.html#id2912232">Samba as the Trusting Domain</a></dt></dl></dd><dt><a href="InterdomainTrusts.html#id2912370">NT4-style Domain Trusts with Windows 2000</a></dt><dt><a href="InterdomainTrusts.html#id2912476">Common Errors</a></dt></dl></div><a class="indexterm" name="id2911584"></a><p>
   2 Samba-3 supports NT4 style domain trust relationships. This is feature that many sites
   3 will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to
   4 adopt Active Directory or an LDAP based authentication back end. This section explains
   5 some background information regarding trust relationships and how to create them. It is now
   6 possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3
   7 trusts.
   8 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911605"></a>Features and Benefits</h2></div></div><div></div></div><p>
   9 Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style
  10 trust relationships. This imparts to Samba similar scalability as is possible with
  11 MS Windows NT4.
  12 </p><p>
  13 Given that Samba-3 has the capability to function with a scalable backend authentication
  14 database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control
  15 modes, the administrator would be well advised to consider alternatives to the use of
  16 Interdomain trusts simply because by the very nature of how this works it is fragile.
  17 That was, after all, a key reason for the development and adoption of Microsoft Active Directory.
  18 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911633"></a>Trust Relationship Background</h2></div></div><div></div></div><p>
  19 MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure.
  20 The limitations of this architecture as it affects the scalability of MS Windows networking
  21 in large organisations is well known. Additionally, the flat namespace that results from
  22 this design significantly impacts the delegation of administrative responsibilities in
  23 large and diverse organisations.
  24 </p><p>
  25 Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
  26 of circumventing the limitations of the older technologies. Not every organisation is ready
  27 or willing to embrace ADS. For small companies the older NT4 style domain security paradigm
  28 is quite adequate, there thus remains an entrenched user base for whom there is no direct
  29 desire to go through a disruptive change to adopt ADS.
  30 </p><p>
  31 Microsoft introduced with MS Windows NT the ability to allow differing security domains
  32 to affect a mechanism so that users from one domain may be given access rights and privileges
  33 in another domain. The language that describes this capability is couched in terms of
  34 <span class="emphasis"><em>Trusts</em></span>. Specifically, one domain will <span class="emphasis"><em>trust</em></span> the users
  35 from another domain. The domain from which users are available to another security domain is
  36 said to be a trusted domain. The domain in which those users have assigned rights and privileges
  37 is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
  38 thus if users in both domains are to have privileges and rights in each others' domain, then it is
  39 necessary to establish two (2) relationships, one in each direction.
  40 </p><p>
  41 In an NT4 style MS security domain, all trusts are non-transitive. This means that if there
  42 are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust
  43 relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no
  44 implied trust between the RED and BLUE domains. ie: Relationships are explicit and not
  45 transitive.
  46 </p><p>
  47
  48 New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way
  49 by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE
  50 domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is
  51 an inherent feature of ADS domains. Samba-3 implements MS Windows NT4
  52 style Interdomain trusts and interoperates with MS Windows 200x ADS
  53 security domains in similar manner to MS Windows NT4 style domains.
  54 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2911721"></a>Native MS Windows NT4 Trusts Configuration</h2></div></div><div></div></div><p>
  55 There are two steps to creating an interdomain trust relationship.  To effect a two-way trust
  56 relationship it is necessary for each domain administrator to create a trust account for the
  57 other domain to use in verifying security credentials.
  58
  59 <a class="indexterm" name="id2911738"></a>
  60 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911750"></a>Creating an NT4 Domain Trust</h3></div></div><div></div></div><p>
  61 For MS Windows NT4, all domain trust relationships are configured using the
  62 <span class="application">Domain User Manager</span>. This is done from the Domain User Manager Policies
  63 entry on the menu bar. From the <span class="guimenu">Policy</span> menu, select
  64 <span class="guimenuitem">Trust Relationships</span>. Next to the lower box labelled
  65 <span class="guilabel">Permitted to Trust this Domain</span> are two buttons, <span class="guibutton">Add</span>
  66 and <span class="guibutton">Remove</span>. The <span class="guibutton">Add</span> button will open a panel in which
  67 to enter the name of the remote domain that will be able to assign access rights to users in
  68 your domain.  You will also need to enter a password for this trust relationship, which the
  69 trusting domain will use when authenticating users from the trusted domain.
  70 The password needs to be typed twice (for standard confirmation).
  71 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911822"></a>Completing an NT4 Domain Trust</h3></div></div><div></div></div><p>
  72 <a class="indexterm" name="id2911833"></a>
  73 A trust relationship will work only when the other (trusting) domain makes the appropriate connections
  74 with the trusted domain. To consummate the trust relationship the administrator will launch the
  75 Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the
  76 <span class="guibutton">Add</span> button that is next to the box that is labelled
  77 <span class="guilabel">Trusted Domains</span>. A panel will open in which must be entered the name of the remote
  78 domain as well as the password assigned to that trust.
  79 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2911868"></a>Inter-Domain Trust Facilities</h3></div></div><div></div></div><a class="indexterm" name="id2911877"></a><p>
  80 A two-way trust relationship is created when two one-way trusts are created, one in each direction.
  81 Where a one-way trust has been established between two MS Windows NT4 domains (let's call them
  82 DomA and DomB) the following facilities are created:
  83 </p><div class="figure"><a name="trusts1"></a><p class="title"><b>Figure 16.1. Trusts overview</b></p><div class="mediaobject"><img src="projdoc/imagefiles/trusts1.png" width="270" alt="Trusts overview"></div></div><div class="itemizedlist"><ul type="disc"><li><p>
  84         DomA (completes the trust connection) Trusts DomB
  85         </p></li><li><p>
  86         DomA is the Trusting domain
  87         </p></li><li><p>
  88         DomB is the Trusted domain (originates the trust account)
  89         </p></li><li><p>
  90         Users in DomB can access resources in DomA
  91         </p></li><li><p>
  92         Users in DomA can NOT access resources in DomB
  93         </p></li><li><p>
  94         Global groups from DomB CAN be used in DomA
  95         </p></li><li><p>
  96         Global groups from DomA can NOT be used in DomB
  97         </p></li><li><p>
  98         DomB DOES appear in the logon dialog box on client workstations in DomA
  99         </p></li><li><p>
 100         DomA does NOT appear in the logon dialog box on client workstations in DomB
 101         </p></li></ul></div><div class="itemizedlist"><ul type="disc"><li><p>
 102         Users / Groups in a trusting domain can NOT be granted rights, permissions or access
 103         to a trusted domain.
 104         </p></li><li><p>
 105         The trusting domain CAN access and use accounts (Users / Global Groups) in the
 106         trusted domain.
 107         </p></li><li><p>
 108         Administrators of the trusted domain CAN be granted admininstrative rights in the
 109         trusting domain.
 110         </p></li><li><p>
 111         Users in a trusted domain CAN be given rights and privileges in the trusting
 112         domain.
 113         </p></li><li><p>
 114         Trusted domain Global Groups CAN be given rights and permissions in the trusting
 115         domain.
 116         </p></li><li><p>
 117         Global Groups from the trusted domain CAN be made members in Local Groups on
 118         MS Windows domain member machines.
 119         </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2912046"></a>Configuring Samba NT-style Domain Trusts</h2></div></div><div></div></div><p>
 120 This description is meant to be a fairly short introduction about how to set up a Samba server so
 121 that it could participate in interdomain trust relationships. Trust relationship support in Samba
 122 is in its early stage, so lot of things don't work yet.
 123 </p><p>
 124 Each of the procedures described below assumes the peer domain in the trust relationship is
 125 controlled by a Windows NT4 server.  However, the remote end could just as well be another
 126 Samba-3  domain. It can be clearly seen, after reading this document, that combining
 127 Samba-specific parts of what's written below leads to trust between domains in a purely Samba
 128 environment.
 129 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="samba-trusted-domain"></a>Samba as the Trusted Domain</h3></div></div><div></div></div><p>
 130 In order to set the Samba PDC to be the trusted party of the relationship you first need
 131 to create a special account for the domain that will be the trusting party. To do that,
 132 you can use the 'smbpasswd' utility. Creating the trusted domain account is very
 133 similar to creating a trusted machine account. Suppose, your domain is
 134 called SAMBA, and the remote domain is called RUMBA. The first step
 135 will be to issue this command from your favourite shell:
 136 </p><p>
 137 </p><pre class="screen">
 138 <tt class="prompt">root# </tt> <b class="userinput"><tt>smbpasswd -a -i rumba</tt></b>
 139 New SMB password: <b class="userinput"><tt>XXXXXXXX</tt></b>
 140 Retype SMB password: <b class="userinput"><tt>XXXXXXXX</tt></b>
 141 Added user rumba$
 142 </pre><p>
 143
 144 where <tt class="option">-a</tt> means to add a new account into the
 145 passdb database and <tt class="option">-i</tt> means: ''create this
 146 account with the InterDomain trust flag''
 147 </p><p>
 148 The account name will be 'rumba$' (the name of the remote domain)
 149 </p><p>
 150 After issuing this command you'll be asked to enter the password for
 151 the account. You can use any password you want, but be aware that Windows NT will
 152 not change this password until 7 days following account creation.
 153 After the command returns successfully, you can look at the entry for the new account
 154 (in the standard way as appropriate for your configuration) and see that account's name is
 155 really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm
 156 the trust by establishing it from Windows NT Server.
 157 </p><a class="indexterm" name="id2912170"></a><p>
 158 Open <span class="application">User Manager for Domains</span> and from the
 159 <span class="guimenu">Policies</span> menu, select <span class="guimenuitem">Trust Relationships...</span>.
 160 Right beside the <span class="guilabel">Trusted domains</span> list box press the
 161 <span class="guimenu">Add...</span> button. You will be prompted for
 162 the trusted domain name and the relationship password. Type in SAMBA, as this is
 163 the name of the remote domain, and the password used at the time of account creation.
 164 Press OK and, if everything went without incident, you will see
 165 <tt class="computeroutput">Trusted domain relationship successfully
 166 established</tt> message.
 167 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2912232"></a>Samba as the Trusting Domain</h3></div></div><div></div></div><p>
 168 This time activities are somewhat reversed. Again, we'll assume that your domain
 169 controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.
 170 </p><p>
 171 The very first step is to add an account for the SAMBA domain on RUMBA's PDC.
 172 </p><a class="indexterm" name="id2912253"></a><p>
 173 Launch the <span class="application">Domain User Manager</span>, then from the menu select
 174 <span class="guimenu">Policies</span>, <span class="guimenuitem">Trust Relationships</span>.
 175 Now, next to the <span class="guilabel">Trusted Domains</span> box press the <span class="guibutton">Add</span>
 176 button, and type in the name of the trusted domain (SAMBA) and the password to use in securing
 177 the relationship.
 178 </p><p>
 179 The password can be arbitrarily chosen. It is easy to change the password
 180 from the Samba server whenever you want. After confirming the password your account is
 181 ready for use. Now it's Samba's turn.
 182 </p><p>
 183 Using your favourite shell while being logged in as root, issue this command:
 184 </p><p>
 185 <tt class="prompt">root# </tt><b class="userinput"><tt>net rpc trustdom establish rumba</tt></b>
 186 </p><p>
 187 You will be prompted for the password you just typed on your Windows NT4 Server box.
 188 Do not worry if you see an error message that mentions a return code of
 189 NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the
 190 password you gave is correct and the NT4 Server says the account is
 191 ready for interdomain connection and not for ordinary
 192 connection. After that, be patient; it can take a while (especially
 193 in large networks), but eventually you should see the <tt class="computeroutput">Success</tt> message.
 194 Congratulations! Your trust relationship has just been established.
 195 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
 196 Note that you have to run this command as root because you must have write access to
 197 the <tt class="filename">secrets.tdb</tt> file.
 198 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2912370"></a>NT4-style Domain Trusts with Windows 2000</h2></div></div><div></div></div><p>
 199 Although <span class="application">Domain User Manager</span> is not present in Windows 2000, it is
 200 also possible to establish an NT4-style trust relationship with a Windows 2000 domain
 201 controller running in mixed mode as the trusting server.  It should also be possible for
 202 Samba to trust a Windows 2000 server, however, more testing is still needed in this area.
 203 </p><p>
 204 After <a href="InterdomainTrusts.html#samba-trusted-domain" title="Samba as the Trusted Domain">creating the interdomain trust account on the
 205 Samba server</a> as described above, open <span class="application">Active Directory Domains and
 206 Trusts</span> on the AD controller of the domain whose resources you wish Samba users
 207 to have access to.  Remember that since NT4-style trusts are not transitive, if you want
 208 your users to have access to multiple mixed-mode domains in your AD forest, you will need to
 209 repeat this process for each of those domains.  With <span class="application">Active Directory Domains
 210 and Trusts</span> open, right-click on the name of the Active Directory domain that
 211 will trust our Samba domain and choose <span class="guimenuitem">Properties</span>, then click on
 212 the <span class="guilabel">Trusts</span> tab.  In the upper part of the panel, you will see a list box
 213 labelled <span class="guilabel">Domains trusted by this domain:</span>, and an
 214 <span class="guilabel">Add...</span> button next to it.  Press this button, and just as with NT4, you
 215 will be prompted for the trusted domain name and the relationship password.  Press OK, and
 216 after a moment, Active Directory will respond with <tt class="computeroutput">The trusted domain has
 217 been added and the trust has been verified.</tt>  Your Samba users can now be
 218 granted acess to resources in the AD domain.
 219 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2912476"></a>Common Errors</h2></div></div><div></div></div><p>
 220 Interdomain trust relationships should NOT be attempted on networks that are unstable
 221 or that suffer regular outages. Network stability and integrity are key concerns with
 222 distributed trusted domains.
 223 </p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="securing-samba.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="msdfs.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. Securing Samba </td><td width="20%" align="center"><a accesskey="h" href="samba-doc.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 17. Hosting a Microsoft Distributed File System tree on Samba</td></tr></table></div></body></html>