[Samba] Trusted domains within a large enterprise

[Adam Wainwright]

Hi Folks

I need some advice on whether what I am doing is correct, initially  
from a logical perspective.

My company (E.ON - large utility) has a large ADS system.  We are  
retiring NT4 domains and I have been asked to transfer the SAMBA  
domain log-ins into ADS.  I am initially testing my work on Linux  
RHEL 4, running SAMBA 3.10.

The ADS system consists of a realm/forest PG.EON.NET (old Powergen)  
on server A, a realm/forest RETAIL.PG.EON.NET on server B and a new  
realm/forest UNIX.EONUK.INT on server C.  There is a one-way trust  
system whereby C trusts A and B.  A and B are running native AD on  
W2K3 and C is currently running mixed mode on W2K3.  The idea is to  
place the UNIX machine accounts into C (no user accounts) and use it  
for authentication of users in the RETAIL/PG and eventually other  
areas.  The Windows admin has stated that we should get the thing  
working on mixed mode then he'll transfer the system into native and  
see if we can continue as it is more lax.

I have set-up the kerberos system on the SAMBA server and 'net ads  
join' works fine to the UNIX.EONUK.INT realm.  'wbinfo -u' and  
'wbinfo -g' also work fine and produce accounts such as 'RETAIL 
+FRED'.  I can even do a 'kinit' to get a ticket against the machine  
account.  The number of accounts is ca. 13000 so I have put 'idmap  
uid = 10000 - 40000' into the smb.conf.

I cannot get 'getent' to work, however and I see within the winbindd  
logs that it cannot map ids to SIDs.  I also see within the logs the  
IP addresses of A and B, refusing requests from SAMBA, whereas I was  
under the impression that C would forward on requests for  
authentication or handle them for the SAMBA server(according to the  
Windows admins), and it looks as if it is receiving either  
redirection or 'nmbd' has asked "who's RETAIL.PG.EON.NET'? and got an  
answer to query elsewhere than server C.

The questions I have at this time:

1.  Do I have to be running native mode on the W2K3 server for realm  
UNIX?
2.  Is the one-way trust system here broken/a bit silly?
3.  Is the only way forward to place the SAMBA servers machine  
accounts into the correct realms for each business?
4.  Why does my brain hurt so much?

Confused, and in dire need of help or beer,

Adam


--
Does dim atal y llanw!