CIFS on VMS 8.3

[robert70]

I have setup CIFS1.2 on a DS20E running VMS 8.3 which allows all PC Workstations running XP on the "EU" domain to connect to shares.
2 questions:-

1. How can I Limit certain users from the "EU" domain, in particulat those with an IP address range of say 100.110.120.1 to 100.110.120.128?

2. How can I allow users not in the "EU" domain but with IP addresses in the range above have access to shares?

Thanks

[Chris Barratt]

I can't say I've tried it on VMS, but I imagine it should work...

from
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/securing-samba.html#id2618313

essentially add the following to your smb.conf,

hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
hosts deny = 0.0.0.0/0

For your second item, I imagine that would require some sort of trust relationship be set up with the Windows stuff, but I have no knowlede of how that works. :-)

[Chris Barratt]

oops...I just cut and pasted that IP range above from the SAMBA docs...didn't update for your example IP range.

[Paul Bakker]

Robert,

Starting first with the second question.
A samba server is member of a domain. (most of the time) and users must be validated against this domain. Users from other domains can only access the server if there is a trust between domain where Samba is a member of and the users domain.
Lets say this is the case. Then best would be is to create a group in each domain where you place all users in that are allowed to access the server. e.g. groupname Cifsuser:

Then you can specify in the smb.conf the following line:

valid users = @DOM1\cifsuser, @DOM2\cifsusers.

In my opinion this is the most flexible way to allow users to access the server.
You can even limmit the access on a per share basis.

[robert70]

Thanks Chris and Paul for your help so far - I'll try and see if i can progress your ideas - will report back - ta

[robert70]

MY 1ST QUESTION RE PARTICULAR IP ADDRESS ACCESS WORKS PERFECTLY SO THANKS
THE HOSTS ALLOW AND HOSTS DENY LINES ABOVE IN THE SMB.CONF DO THE TRICK

[robert70]

MANY THANKS CHAPS
ALL HAPPY AND COMPLETE WITH THIS NOW
TA