auth

I am trying to set up a small inn server with no incoming/outgoing feeds.
there are some public.* groups and some private.* groups.
I am playing with readers.conf so that
1) anybody from internet can read/post to public.*
2) you have use username/passwd to access the private.*

auth "all" {
    hosts: "*"
    auth: "ckpasswd -f /etc/news/users"
    default: <noauth>
    default-domain: internet
}
access "authorized" {
    users: "* <at> internet"
    newsgroups: "*, !control*, !junk"
}
access "noauth" {
    users: "<noauth> <at> internet"
    newsgroups: "*, !control*, !junk, !private*"
}

I tested it with tin from remote, I can only see those public.*
groups, trying to go to private.* gives "not in active file" error.
tin never prompts username/passwd.

Any ideas?
inn-2.3.3

Frank