[Samba] where winbindd has to be running?

[Gianluca Cecchi]

If I have a samba 3 pdc and a samba 3 domain member. The latter has
also ssh/telnet access through network.
I want to authenticate smb connections for both and telenet for domain
member against the pdc.
Where has to be running winbindd? On pdc, domain member or both?
Which kind of "security =" parameter have I to set in domain member?
Thanks in advance.
Gianluca