For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. This is done from the Domain User Manager Policies entry on the menu bar. From the Policy menu, select Trust Relationships. Next to the lower box labeled Permitted to Trust this Domain are two buttons, Add and Remove. The Add button will open a panel in which to enter the name of the remote domain that will be able to assign access rights to users in your domain. You will also need to enter a password for this trust relationship, which the trusting domain will use when authenticating users from the trusted domain. The password needs to be typed twice (for standard confirmation).

A trust relationship will work only when the other (trusting) domain makes the appropriate connections with the trusted domain. To consummate the trust relationship, the administrator launches the Domain User Manager from the menu selects Policies, then select Trust Relationships, and clicks on the Add button next to the box that is labeled Trusted Domains. A panel opens in which must be entered the name of the remote domain as well as the password assigned to that trust.

A two-way trust relationship is created when two one-way trusts are created, one in each direction. Where a one-way trust has been established between two MS Windows NT4 domains (let's call them DomA and DomB), the following facilities are created:

Figure 18.1. Trusts overview.

In order to set the Samba PDC to be the trusted party of the relationship, you first need to create a special account for the domain that will be the trusting party. To do that, you can use the smbpasswd utility. Creating the trusted domain account is similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step will be to issue this command from your favorite shell:

root#  smbpasswd -a -i rumba
New SMB password: XXXXXXXX
Retype SMB password: XXXXXXXX
Added user rumba$

where -a means to add a new account into the passdb database and -i means to “create this account with the Interdomain trust flag”.

The account name will be “rumba$” (the name of the remote domain). If this fails, you should check that the trust account has been added to the system password database (/etc/passwd). If it has not been added, you can add it manually and then repeat the previous step.

After issuing this command, you will be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will not change this password until 7 days following account creation. After the command returns successfully, you can look at the entry for the new account (in the standard way as appropriate for your configuration) and see that the account's name is really RUMBA$ and it has the “I” flag set in the flags field. Now you are ready to confirm the trust by establishing it from Windows NT Server.

Open User Manager for Domains and from the Policies menu, select Trust Relationships.... Beside the Trusted domains list box, click the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is the name of the remote domain and the password used at the time of account creation. Click on OK and, if everything went without incident, you will see the Trusted domain relationship successfully established message.

This time activities are somewhat reversed. Again, we'll assume that your domain controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.

The very first step is to add an account for the SAMBA domain on RUMBA's PDC.

Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. Now, next to the Trusted Domains box, press the Add button and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship.

The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you want. After you confirm the password, your account is ready for use. Now its Samba's turn.

Using your favorite shell while logged in as root, issue this command:

root# net rpc trustdom establish rumba

You will be prompted for the password you just typed on your Windows NT4 Server box. An error message, "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT," that may be reported periodically is of no concern and may safely be ignored. It means the password you gave is correct and the NT4 server says the account is ready for interdomain connection and not for ordinary connection. After that, be patient; it can take a while (especially in large networks), but eventually you should see the Success message. Congratulations! Your trust relationship has just been established.

Browsing from a machine in a trusted Windows 200x domain to a Windows 200x member of a trusting Samba domain, I get the following error:

The system detected a possible attempt to compromise security. Please
ensure that you can contact the server that authenticated you.

The event logs on the box I'm trying to connect to have entries regarding group policy not being applied because it is a member of a down-level domain.

If there is a computer account in the Windows 200x domain for the machine in question, and it is disabled, this problem can occur. If there is no computer account (removed or never existed), or if that account is still intact (i.e., you just joined it to another domain), everything seems to be fine. By default, when you unjoin a domain (the Windows 200x domain), the computer tries to automatically disable the computer account in the domain. If you are running as an account that has privileges to do this when you unjoin the machine, it is done; otherwise it is not done.

If you use the smbldap-useradd script to create a trust account to set up interdomain trusts, the process of setting up the trust will fail. The account that was created in the LDAP database will have an account flags field that has [W ], when it must have [I ] for interdomain trusts to work.

Here is a simple solution. Create a machine account as follows:

root#  smbldap-useradd -w domain_name

Then set the desired trust account password as shown here:

root#  smbldap-passwd domain_name\$

Using a text editor, create the following file:

dn: uid=domain_name$,ou=People,dc={your-domain},dc={your-top-level-domain}
changetype: modify
sambaAcctFlags: [I         ]

Then apply the text file to the LDAP database as follows:

root#  ldapmodify -x -h localhost \
 -D "cn=Manager,dc={your-domain},dc={your-top-level-domain}" \
 -W -f /path-to/foobar

Create a single-sided trust under the NT4 Domain User Manager, then execute:

root#  net rpc trustdom establish domain_name

It works with Samba-3 and NT4 domains, and also with Samba-3 and Windows 200x ADS in mixed mode. Both domain controllers, Samba and NT must have the same WINS server; otherwise, the trust will never work.