I have a user community of about 2000 users and a samba server running on AIX that currently hosts a read-only share for the whole company.

[Released]
path = /mypath
guest ok = Yes

But now I have been requested to make this share available as read-only for some users and completely inaccessible to everyone else. The number of users who will have access is probably a few hundred and I expect users to be added/removed on a daily basis. Some of the users have unix logins, while others do not.

Because of this, I hesitate to mess with user mapping because I would have to manage this every day, unless I do something with a script.

Can someone suggest a scheme I can use to deny everyone except for certain users without having to use user mapping?

Someone here in my office suggested we use hosts allow or deny, since the users who will still have access are located on the same subnet. However, there is a distinct possibility that a small number of people on a few other subnets will need access. Is there a way I can specify hosts allow but still allow specific users from other subnets?

Forgive me if this question has been asked before. I'm sure it must have been, but I am having trouble doing a search of the archives that will give me advice about this particular problem.

Thanks in advance.

If the users will be sitting at the same PCs and DHCP is setting static IP addresses then you could effectively use permissions based on IP and subnet.

Unfortunately you are being pushed in to a managed situation and managed is what you'll have to do. Only other option is to lock her up tight and have a Full user/pass, Read-Only user/pass and just give those to individuals that require the access. We all know users are about as secure as a hooker on a street corner, so if possible I'd opt for choice #1.

Ok, so I think what you're saying is, I should use hosts allow for the subnets where large groups of users are sitting, and use individual IPs for users who are on different subnets. I think we're pretty much static IPs, and if so, I guess that would work.

But you're saying without doing it this way, the only other solution is to use usernames and passwords for everyone?