Open and Password protected shares in Samba

If you want to have more than one share for samba, with one open to anyone on the network (as a guest) and one open only to named users (in this case 'realuser', which should be an actual unix account), there are a couple of complications. The following is a config file that works (it assumes you've followed the smbguest username setup steps from this post).

[global]
  security = User
  map to guest = Bad User
  null passwords = Yes
  obey pam restrictions = Yes
  # this account must exist as unix users
  guest account = smbguest
  unix password sync = Yes
  # these two are for performance
  socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=32768
  strict allocate = Yes

[data]
  comment = data
  path = /data
  force user = smbguest
  read only = No
  create mask = 0666
  directory mask = 0777
  guest only = Yes
  guest ok = Yes

[private]
  comment = private
  path = /private
  valid users = realuser
  admin users = realuser
  read only = No
  guest ok = No
  create mask = 0666
  directory mask = 0777
  # this makes it invisible when browsing the computer
  browseable = No

You'll have to add realuser as a username accessible from samba:

sudo smbpasswd -a realuser

But it's a bit tricky because authentication is by users, not shares. So if you want to be able to access the private share (using realuser and its username), as well as the data share (that's open to guests), you'll need to log into both as realuser. Note that in windows 7 the username is \realuser (the backslash is necessary to remove the  domain).  Note that if you do this only in linux, you'll want to make sure you have the map to guest = bad user line after the security=user line under MacOS to allow access to users who have saved mapped the drives while linux was running.

P.S. - For debugging your smb.conf file, it helps to run testparm -s (which gives warnings and errors).
For debugging windows 7-related issues related to samba, see here.