This step is exclusively for Windows NT clients. All NT clients that connect to a primary domain controller make use of
trust accounts. These accounts allow a machine to log in to the PDC itself (not one of its shares), which means that the PDC can trust any further connections from users on that client. For all intents and purposes, a trust account is identical to a user account. In fact, we will be using standard Unix user accounts to emulate trust accounts for the Samba server.
The login name of a machine's trust account is the name of the machine with a dollar sign appended to it. For example, if our Windows NT machine is named
chimaera, the login account would be
chimaera$. The initial password of the account is simply the name of the machine in lowercase letters. In order to forge the trust account on the Samba server, you need to create a Unix account with the appropriate machine name, as well as an encrypted password entry in the
smbpasswd database.
Let's tackle the first part. Here, we only need to modify the
/etc/passwd file to support the trust account; there is no need to create a home directory or assign a shell to the "user" because the only part we are interested in is whether a login is permitted. Therefore, we can create a "dummy" account with the following entry:
chimaera$:*:1000:900:Trust Account:/dev/null:/dev/null
Note that we have also disabled the password field by placing a
* in it. This is because Samba will use the
smbpasswd file to contain the password instead, and we don't want anyone to telnet into the machine using that account. In fact, the only value other than the account name that is used here is the UID of the account for the encrypted password database (1000). This number must map to a unique resource ID on the NT server and cannot conflict with any other resource IDs. Hence, no NT user or group should map to this number or a networking error will occur.
Next, add the encrypted password using the
smbpasswd command, as follows:
#
smbpasswd -a -m chimaera
Added user chimaera$
Password changed for user chimaera$
The
-m option specifies that a machine trust account is being generated. The
smbpasswd program will automatically set the initial encrypted password as the NetBIOS name of the machine in lowercase letters; you don't need to enter it. When specifying this option on the command line, do not put a dollar sign after the machine name - it will be appended automatically. Once the encrypted password has been added, Samba is ready to handle domain logins from a NT client.
