UCS 2.4 - Univention

8.4 Extended Configuration
auth/user/methods must be expanded with winbind using Univention Management Console (see
Chapter 5.3.5), e.g., to krb5 ldap unix winbind.
If the winbindd process cannot be found in the process list in Univention Management Console, it
must be started there (see Chapter 5.3.9).
On a domaincontroller master/backup
net idmap secret WINDOWSDOMAIN $(cat /etc/ldap.secret)
needs to be called.
On a domain controller slave or a member server
net idmap secret WINDOWSDOMAIN $(cat /etc/machine.secret)
needs to be executed instead.
2. A trust relationship must be created on the Windows PDC (see Chapter 8.4.1.2). Any requirements
for Windows applicable to the Windows domain must be taken into account when choosing the
password for the trust relationship. The NetBIOS name of the Samba domain is required for this.
3. The root user must run the following command on the Samba PDC:
net rpc trustdom establish
The winbind service must then be restarted over Univention Management Console.
must be replaced with the NetBIOS name of the Windows domain. The com-
mand requests the input of a password; the password used on the Windows PDC must be entered.
The message Trust to domain established then appears.
Attention:
This command must be run on all Samba log-in servers (domain controller master, backup and
slave).
The command occasionally provokes unjustified error messages such as Could not connect to
server . The following command can be used to check that the trust
relationship has been added correctly:
net rpc trustdom list
The password of emphroot on the Samba PDC or BDC should be used. The command display
should be similar to the following:
Trusted domains list:
S-1-5-21-1275210071-1060284298-839522115
Trusting domains list:
none
The System log in Windows can offer help in problem containment when troubleshooting.
4. The command
net rpc trustdom revoke
can be used to remove the trust relationship with the Windows domain. The trust relationship must
also be removed from the Windows PDC.
193