Anonymous printing to a CUPS printer

ohuf · 28. September 2016

Aloha!

I have installed the CUPS plugin and I've configured my Brother printer (attached to the OMV via USB) correctly (so far) and I've configured the printer driver on my daughter's Windows computer.

That's where my problem/question begins: She *can* print from that computer ONLY, when she's authenticated on the OMV.
So in order for her to actually use the printer, she has to connect to a share and enter her username and password one time in each session.
After that, she can use the CUPS printer without any problems.

The point is, she rarely uses the OMV's shares and she tries to stay disconnected from the OMV shares when she don't need them.
One reason is the danger of catching a CryptoLocker that would try to encrypt the network shares.... so please don't tackle that part of the problem - I know this can be "solved" by auto mounting and password save.... that's not the point here.

Instead, I'd like to configure CUPS in a way that any user on the network can connect to the printer and use it without entering credentials.
Our network is "secure" and I don't care if someone accidentally wastes a few pages.

Can you please point me to a solution? I reckon someone else may have (had) the same problem...
Sadly, searching the forum has lead me nowhere...

All the links for non-OMV CUPS installations involve changing the config file... but that's under OMVs control - so it's probably futile to change it..?

Thanks a bunch!

Oliver.

Dropkick Murphy · 28. September 2016

check your cupsd.conf

Code

<Location />
  # Restrict access to the server...
  Allow from 192.168.1.0/24
  Require valid-user
  Satisfy any
  Order allow,deny
</Location>

Specially 4. should not be set...

HTH

ohuf · 3. Oktober 2016

Aloha!

the section in question is still the OMV default:

Code

<Location />
  # Allow shared printing and remote administration...
  Order allow,deny
  Allow all
</Location>

... so no "Require" statement at all.

However, changing that file would be futile as the header says:

Code

# This configuration file is auto-generated.
# WARNING: Do not edit this file, your changes will be lost.

I'd like to achieve the anonymous printing by changing the config from the OMV side, so I don't have to worry about overwrites through future updates..

ohuf · 3. Oktober 2016

I guess, my cupsd config may be a bit ... special..?
However, I installed the CUPS system through the OMV admin gui.

I keep getting the following errors:

Code

W [03/Oct/2016:16:29:16 +0200] Please move "SystemGroup lpadmin" on line 6 of /etc/cups/cupsd.conf to the /etc/cups/cups-files.conf file; this will become an error in a future release.
W [03/Oct/2016:16:29:16 +0200] No limit for Validate-Job defined in policy default and no suitable template found.
W [03/Oct/2016:16:29:16 +0200] No limit for Cancel-Jobs defined in policy default - using Pause-Printer's policy.
W [03/Oct/2016:16:29:16 +0200] No limit for Cancel-My-Jobs defined in policy default - using Send-Document's policy.
W [03/Oct/2016:16:29:16 +0200] No limit for Close-Job defined in policy default - using Send-Document's policy.
W [03/Oct/2016:16:29:16 +0200] No JobPrivateAccess defined in policy default - using defaults.
W [03/Oct/2016:16:29:16 +0200] No SubscriptionPrivateAccess defined in policy default - using defaults.
W [03/Oct/2016:16:29:16 +0200] No SubscriptionPrivateValues defined in policy default - using defaults.
W [03/Oct/2016:16:29:16 +0200] No limit for Validate-Job defined in policy authenticated - using Print-Job's policy.
W [03/Oct/2016:16:29:16 +0200] No limit for Cancel-Jobs defined in policy authenticated - using Pause-Printer's policy.
W [03/Oct/2016:16:29:16 +0200] No limit for Cancel-My-Jobs defined in policy authenticated - using Send-Document's policy.
W [03/Oct/2016:16:29:16 +0200] No limit for Close-Job defined in policy authenticated - using Send-Document's policy.
W [03/Oct/2016:16:29:16 +0200] No JobPrivateAccess defined in policy authenticated - using defaults.
W [03/Oct/2016:16:29:16 +0200] No JobPrivateValues defined in policy authenticated - using defaults.
W [03/Oct/2016:16:29:16 +0200] No SubscriptionPrivateAccess defined in policy authenticated - using defaults.
W [03/Oct/2016:16:29:16 +0200] No SubscriptionPrivateValues defined in policy authenticated - using defaults.
W [03/Oct/2016:16:29:17 +0200] failed to CreateProfile: org.freedesktop.DBus.Error.ServiceUnknown:The name org.freedesktop.ColorManager was not provided by any .service files
W [03/Oct/2016:16:29:17 +0200] failed to CreateDevice: org.freedesktop.DBus.Error.ServiceUnknown:The name org.freedesktop.ColorManager was not provided by any .service files

Alles anzeigen

while this is annoying, I don't think it's symptomatic for the inability for users to not being able to print anonymously.

BTW: here's my cupsd config file:

Code: /etc/cups/cupsd.conf

# This configuration file is auto-generated.
# WARNING: Do not edit this file, your changes will be lost.
MaxJobs 0
LogLevel warn
MaxLogSize 1m
SystemGroup lpadmin
ServerAlias *
# Allow remote access
Port 631
Listen /var/run/cups/cups.sock
# Enable printer sharing and shared printers.
Browsing On
BrowseOrder allow,deny
BrowseAllow all
BrowseRemoteProtocols none
BrowseAddress @LOCAL
BrowseLocalProtocols CUPS
DefaultAuthType Basic
<Location />
  # Allow shared printing and remote administration...
  Order allow,deny
  Allow all
</Location>
<Location /admin>
  AuthType Default
  Require user @SYSTEM
  # Allow remote administration...
  Order allow,deny
  Allow all
</Location>
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  # Allow remote access to the configuration files...
  Order allow,deny
  Allow all
</Location>
<Policy default>
  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job CUPS-Get-Document>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  <Limit Cancel-Job CUPS-Authenticate-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  <Limit All>
    Order deny,allow
  </Limit>
  # Allow access to default private values: job-name
  #                                         job-originating-host-name
  #                                         job-originating-user-name
  #
  # Deny access to default private values: phone
  #
  # See: http://www.cups.org/documentation.php/ref-cupsd-conf.html#JobPrivateValues
  JobPrivateValues phone
</Policy>
<Policy authenticated>
  <Limit Create-Job Print-Job Print-URI>
    AuthType Default
    Order deny,allow
  </Limit>
  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job CUPS-Get-Document>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  <Limit Cancel-Job CUPS-Authenticate-Job>
      AuthType Default
      Require user @OWNER @SYSTEM
      Order deny,allow
  </Limit>
  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

Alles anzeigen

Any substantial help will be appreciated.

ohuf · 3. Oktober 2016

....aaaand me again!

I just realized, my windows PC's are accessing the printer through SAMBA.
But even there I have configured:

Code: /etc/samba/smb.conf

[printers]
comment = All Printers
path = /var/spool/samba
browseable = yes
guest ok = yes
writable = no
printable = yes


[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browseable = no
guest ok = yes
read only = yes
write list = @lpadmin
oplocks = no
force create mode = 0664
force directory mode = 775

Alles anzeigen

And with (5) and (13) anonymous printing should be allowed....

I just don't get where the error is..

Anonymous printing to a CUPS printer

Jetzt mitmachen!

Tags