docs/docbook/projdoc/InterdomainTrusts.sgml

   1 <chapter id="InterdomainTrusts">
   2 <chapterinfo>
   3         &author.jht;
   4         &author.mimir;
   5         <pubdate>April 3, 2003</pubdate>
   6 </chapterinfo>
   7
   8 <title>Interdomain Trust Relationships</title>
   9
  10 <para>
  11 Samba-3 supports NT4 style domain trust relationships. This is feature that many sites
  12 will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to
  13 adopt Active Directory or an LDAP based authentication back end. This section explains
  14 some background information regarding trust relationships and how to create them. It is now
  15 possible for Samba3 to NT4 trust (and vica versa), as well as Samba3 to Samba3 trusts.
  16 </para>
  17
  18 <sect1>
  19 <title>Trust Relationship Background</title>
  20
  21 <para>
  22 MS Windows NT3.x/4.0 type security domains employ a non-hierchical security structure.
  23 The limitations of this architecture as it affects the scalability of MS Windows networking
  24 in large organisations is well known. Additionally, the flat-name space that results from
  25 this design significantly impacts the delegation of administrative responsibilities in
  26 large and diverse organisations.
  27 </para>
  28
  29 <para>
  30 Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means
  31 of circumventing the limitations of the older technologies. Not every organisation is ready
  32 or willing to embrace ADS. For small companies the older NT4 style domain security paradigm
  33 is quite adequate, there thus remains an entrenched user base for whom there is no direct
  34 desire to go through a disruptive change to adopt ADS.
  35 </para>
  36
  37 <para>
  38 Microsoft introduced with MS Windows NT the ability to allow differing security domains
  39 to affect a mechanism so that users from one domain may be given access rights and privilidges
  40 in another domain. The language that describes this capability is couched in terms of
  41 <emphasis>Trusts</emphasis>. Specifically, one domain will <emphasis>trust</emphasis> the users
  42 from another domain. The domain from which users are available to another security domain is
  43 said to be a trusted domain. The domain in which those users have assigned rights and privilidges
  44 is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only,
  45 thus if users in both domains are to have privilidges and rights in each others' domain, then it is
  46 necessary to establish two (2) relationships, one in each direction.
  47 </para>
  48
  49 <para>
  50 In an NT4 style MS security domain, all trusts are non-transitive. This means that if there
  51 are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust
  52 relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no
  53 implied trust between the RED and BLUE domains. ie: Relationships are explicit and not
  54 transitive.
  55 </para>
  56
  57 <para>
  58 New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way
  59 by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE
  60 domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is
  61 an inherent feature of ADS domains.
  62 </para>
  63
  64 </sect1>
  65
  66 <sect1>
  67 <title>MS Windows NT4 Trust Configuration</title>
  68
  69 <para>
  70 There are two steps to creating an inter-domain trust relationship.
  71 </para>
  72
  73 <sect2>
  74 <title>NT4 as the Trusting Domain</title>
  75
  76 <para>
  77 For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager.
  78 To affect a two way trust relationship it is necessary for each domain administrator to make
  79 available (for use by an external domain) it's security resources. This is done from the Domain
  80 User Manager Policies entry on the menu bar. From the Policy menu, select Trust Relationships, then
  81 next to the lower box that is labelled "Permitted to Trust this Domain" are two buttons, "Add" and
  82 "Remove". The "Add" button will open a panel in which needs to be entered the remote domain that
  83 will be able to assign user rights to your domain. In addition it is necessary to enter a password
  84 that is specific to this trust relationship. The password is added twice.
  85 </para>
  86
  87 </sect2>
  88
  89 <sect2>
  90 <title>NT4 as the Trusted Domain</title>
  91
  92 <para>
  93 A trust relationship will work only when the other (trusting) domain makes the appropriate connections
  94 with the trusted domain. To consumate the trust relationship the administrator will launch the
  95 Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the
  96 "Add" button that is next to the box that is labelled "Trusted Domains". A panel will open in
  97 which must be entered the name of the remote domain as well as the password assigned to that trust.
  98 </para>
  99
 100 </sect2>
 101 </sect1>
 102
 103 <sect1>
 104 <title>Configuring Samba Domain Trusts</title>
 105
 106 <para>
 107 This descitpion is meant to be a fairly short introduction about how to set up a Samba server so
 108 that it could participate in interdomain trust relationships. Trust relationship support in Samba
 109 is in its early stage, so lot of things don't work yet. Paricularly, the contents of this document
 110 applies to NT4-style trusts.
 111 </para>
 112
 113 <para>
 114 Each of the procedures described below is treated as they were performed with Windows NT4 Server on
 115 one end. The other end could just as well be another Samba3 domain. It can be clearly seen, after
 116 reading this document, that combining Samba-specific parts of what's written below leads to trust
 117 between domains in purely Samba environment.
 118 </para>
 119
 120 <sect2>
 121 <title>Samba3 as the Trusting Domain</title>
 122
 123 <para>
 124 In order to set Samba PDC to be trusted party of the relationship first you need
 125 to create special account for domain that will be the trusting party. To do that,
 126 you can use 'smbpasswd' utility. Creating the trusted domain account is very
 127 similiar to creating the connection to the trusting machine's account. Suppose,
 128 your domain is called SAMBA, and the remote domain is called RUMBA. Your first
 129 step will be to issue this command from your favourite shell:
 130 </para>
 131
 132 <para>
 133 <screen>
 134 <prompt>deity#</prompt> <userinput>smbpasswd -a -i rumba</userinput>
 135         New SMB password: XXXXXXXX
 136         Retype SMB password: XXXXXXXX
 137         Added user rumba$
 138 </screen>
 139
 140 where <parameter>-a</parameter> means to add a new account into the passdb database and <parameter>-i</parameter> means create this account with the Inter-Domain trust flag.
 141 </para>
 142
 143 <para>
 144 The account name will be 'rumba$' (the name of the remote domain)
 145 </para>
 146
 147 <para>
 148 fter issuing this command you'll be asked for typing account's
 149 password. You can use any password you want, but be aware that Windows NT will
 150 not change this password until 7 days have passed since account creating.
 151 After command returns successfully, you can look at your new account's entry
 152 (in the way depending on your configuration) and see that account's name is
 153 really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm
 154 the trust by establishing it from Windows NT Server.
 155 </para>
 156
 157 <para>
 158 Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'.
 159 Right beside 'Trusted domains' list press 'Add...' button. You'll be prompted for
 160 trusted domain name and the relationship's password. Type in SAMBA, as this is
 161 your domain name and the password you've just used during account creation.
 162 Press OK and if everything went fine, you will see 'Trusted domain relationship
 163 successfully established' message. Well done.
 164 </para>
 165
 166 </sect2>
 167 <sect2>
 168 <title>Samba3 as the Trusted Domain</title>
 169
 170 <para>
 171 This time activities are somewhat reversed. Again, we'll assume that your domain
 172 controlled by Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.
 173 </para>
 174
 175 <para>
 176 The very first thing is to add account for SAMBA domain on RUMBA's PDC.
 177 </para>
 178
 179 <para>
 180 Launch the Domain User Manager, then from the menu select 'Policies', 'Trust Relationships'.
 181 Now, next to 'Trusted Domains' box press the 'Add' button, and type in the name of the trusted
 182 domein (SAMBA) and password securing the relationship.
 183 </para>
 184
 185 <para>
 186 Password can be arbitrarily chosen the more, because it's easy to change it
 187 from Samba server whenever you want. After confirming password your account is
 188 ready and waiting. Now it's Samba's turn.
 189 </para>
 190
 191 <para>
 192 Using your favourite shell while being logged on as root, issue this command:
 193 </para>
 194
 195 <para>
 196 <prompt>deity# </prompt><userinput>net rpc trustdom establish rumba</userinput>
 197 </para>
 198
 199 <para>
 200 You'll be prompted for password you've just typed on your Windows NT4 Server box.
 201 Don't worry if you will see the error message with returned code of
 202 <errorname>NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT</errorname>. It means the
 203 password you gave is correct and the NT4 Server says the account is ready for trusting your domain
 204 and not for ordinary connection. After that, be patient it can take a while (especially
 205 in large networks), you should see 'Success' message. Contgratulations! Your trust
 206 relationship has just been established.
 207 </para>
 208
 209 <note><para>
 210 Note that you have to run this command as root, since you need write access to
 211 your <filename>secrets.tdb</filename> file.
 212 </para></note>
 213
 214 </sect2>
 215 </sect1>
 216
 217 </chapter>