LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-23-2005, 11:54 AM   #91
KimVette
Senior Member
 
Registered: Dec 2004
Location: Lee, NH
Distribution: OpenSUSE, CentOS, RHEL
Posts: 1,794

Rep: Reputation: 46

penguinlnx>

As far as printer drivers (filters) are concerned, they can be a bit of a pain. The fault lies in the hardware vendors (Canon, Epson, HP, etc) and not on Linux developers.

Why?

Take Windows for example. Aside from the generic/text and generic/postscript printer drivers found in Win3x and Win9x, they have never developed a printer driver. Drivers for Epson, HP (incidentally, HP printers are all rebadged Canon printers. HP has never actually manufactured one - they design the PCL protocol and outsource manufacturing), Canon, et al all develop the drivers and submit them to the Microsoft HWQL for testing, and the ones which are stable and don't actually change the way Windows functions (e.g., don't patch or otherwise putz with GDI) are included in the next Windows release.

Now, if a driver is unavailable for your printer for Windows, what do you do? You can read the printer's specs, the documentation (which unfortunately is not as good as printer documentation used to be), and so forth to find out which protocols and/or emulation modes the printer offers, and use an alternate driver.

Now, say you buy a Canon i860 (one of my printers) - there is no Linux printer filter for it unless you use the Taiwanese drivers. Knowing that the protocol for the i860 is nearly identical to the i9100 (aside from not handling 13x19), and probably draws from the BJC protocol used by previous printers, I turned to other Canon filters. As it turns out, the BJC 4300 is very similar in feature set to the i860. Having determined that the printer is "close" I tried that filter and sure enough it printed legible graphics. The resolution was off, so I tweaked the filter a bit just to get the printout to fit the page, just for basic proofing. Since I can't do my final work on Linux (no Photoshop Creative Suite for Linux yet ) I then deemed the printer filter to be Good Enough™ for my purposes. I just won't use the Canon for anything that requires full-bleed capability. If the need arises or Adobe Creative Suite is released, I'll put the few hours into tweaking the printer filter to fully support the i860 and submit it to the project.

Now, take Kyocera: they are a stellar example of providing EXCELLENT Linux support. I have a Kyocera color laser - model FS-C5016N. Kyocera FULLY supports Linux and includes Linux drivers for various distributions on the CD, and I think they may have even included the source (I can dig up the CD to find out for sure). Not only that, when you buy this printer, they'll actually send a rep out to configure it for you. Want to know the surprising part? The Kyocera driver actually supports MORE of this printer's features than the Windows driver suite.

Even better, I did not have to install the driver from the CD, because Suse Linux Pro includes this driver right out of the box - this printer was as plug and play as it gets. Not only that, Kyocera publishes their protocol spec, API, and everything else you need to develop your own driver if you need to. Kudos to Kyocera!

The question: Why is printer support so spotty in Linux?

It is a two-part answer.

1. Many vendors Just Don't Care™ because they see the Linux market as insignificant. The only reason you see Mac drivers for many printers is that print houses use Macs because they have historically used Macs, and these vendors want to have their printers be seen in these print houses being used for proofing - for marketing and exposure. Why? Because if you see a printer being used in a print shop for small jobs and for proofing, well, it's got to be a good printer, right? But because print shops generally use Linux only for RIP components on their presses, or for servers, and not for graphic design, there is no perceived need for them to produce print filters. The kicker of this is that it's REALLY simple to develop a print driver for *nix relative to other operating systems.

2. Printer manufacturers used to publish EVERYTHING their printers could do. They'd publish everything their protocol requires; every single escape sequence, handshaking, and printer controls. This applied to both consumer-level and professional printers. You received a COMPLETE manual including the full spec for the protocol.

Now when you buy a consumer-level printer, or a lower-end professional printer, you receive NO documentation beyond "here's how to plug in the printer and install your Windows driver. Call our 900 number at $54/minute for support." If you're lucky, you get a 62-page "manual" in a PDF file on the driver CD and that manual consists of 33% advertising (I'm obviously pulling that number out of thin air - take it as cynicism) promoting the manufacturer-branded paper, and the rest is "here is how to load the paper" and coverage of the cheesy third-party "value added" apps that they bundle but only two of their customers actually use. If you write them and ask for a spec of the protocol or any technical support in that regard, they brush you off citing "support boundaries" or "proprietary intellectual property"

What the heck? How does explaining how your protocol works so you actually BUY a few of their printers to run them with Linux put your intellectual property at risk? Just release the darn info, publish it to the world, because that information does not give the means to duplicate your patented 1500-nozzle piezoelectric or thermoelectric printhead, and even if it did, patent protection would prevent someone from duplicating and marketing that design.


That's the cause of your Linux printer woes. We're left out in the cold to reverse-engineer the protocols, figure out how they work, and implement the print filter to translate from postscript to whatever the printer requires.

Last edited by KimVette; 03-23-2005 at 12:52 PM.
 
Old 03-23-2005, 09:12 PM   #92
penguinlnx
Member
 
Registered: Mar 2005
Location: Ice Station Alert AFB
Distribution: Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
Thank you KimVette: that's quite a post!

I am still looking into the problem of hooking up the Cone-n i450 ...It isn't sounding good for the plan of abandoning Windows in the area of Photoshop/photo-printing. That could be my bottleneck.

TigerOC & JTShaw: The Gaim Program is amazing!

It emerged smoothly without a fuss, and in five minutes the teenagers were gabbing on MSN!
And the program is actually better than Microsoft's original it seems, with a few extra or more accessible useful features. I thought this would have been the most difficult problem, but it turned out the simplest and fastest. Cripes! But signing onto Yahoo was a bit loopy, with 50 people automatically being PMed when I signed in! Quite embarrassing, closing all those windows and hoping all the people in Yahoo Messenger didn't organize a lynching party! Must be a way to turn that off!

Still no JAVA for Epiphany/Mozilla:

But this shouldn't be insurmountable.

So close to jettisoning Windows I can taste it.....

Last edited by penguinlnx; 03-23-2005 at 09:51 PM.
 
Old 03-24-2005, 02:37 PM   #93
KimVette
Senior Member
 
Registered: Dec 2004
Location: Lee, NH
Distribution: OpenSUSE, CentOS, RHEL
Posts: 1,794

Rep: Reputation: 46
penguinlnx, I owe you an apology. I'm sorry I mistook your questioning as trolling but that's how some of your posts come across.

There's a lot to learn and a lot to unlearn when switching from one OS to the other. Just be willing to accept answers from folks who have been using the system for a while, and rather than coming back with "but. . . but. . . I doubt what you're saying because I don't KNOW the technology" why not just ask for more details or perhaps for a pointer to more detailed documentation? This would come across as more, well, honest, and less hostile to boot.
 
Old 03-24-2005, 03:30 PM   #94
penguinlnx
Member
 
Registered: Mar 2005
Location: Ice Station Alert AFB
Distribution: Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
An apology? Well, thanks, I appreciate the change of heart.
I don't know if I deserve an apology, I was only hoping people would take it down a notch,
and help me figure out a few things. Maybe I could lighten up too:
Perhaps the smoking pot slam got to me more than it should have...
But that's not something people here could be expected to know about.

Actually, I don't like drugs at all, or those who recklessly push them for recreational purposes.
But that's just me, and my private war with German drug companies...he he...
 
Old 03-24-2005, 04:31 PM   #95
KimVette
Senior Member
 
Registered: Dec 2004
Location: Lee, NH
Distribution: OpenSUSE, CentOS, RHEL
Posts: 1,794

Rep: Reputation: 46
Grrr. We're plunking down the dough for Adobe Creative Suite for Windows next month (no more managing individual application licenses - woohoo!). Time to try Crossover Office, methinks, and to tackle the printer filter sooner than planned. If I get to the printer filter and get it working perfectly I'll post it here.
 
Old 03-24-2005, 09:29 PM   #96
penguinlnx
Member
 
Registered: Mar 2005
Location: Ice Station Alert AFB
Distribution: Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
For JTShaw: I hope you see this last post- if not perhaps someone else can jump in:

Quote:
Put jts-firewall in your /sbin directory. Make sure you make it executable by root. Put firewall-init in your /etc/init.d directory, again make sure it is executable by root. Edit the jts-firewall script as needed. I have a bunch of rules commented out for allowing connections on different ports so you can see examples of how things are done. Adding firewall-init to your initscripts (rc-update add firewall-init default) will get your firewall up and running on each boot.
I did this and got the rc-update working. Is there a way to test and see if it is all working as it is supposed to? How can I turn on, dump and interpret logs?

I installed something called NmapFE, a GUI front end for Nmap.
a scan seems to report:

111/tcp open rpcbind
631/tcp open ipp
762/tcp open quotad

Device type: general purpose
Running: Linux 2.4.x12.5.x12.5.x
OO details: Linux 2.5.25 - 2.6.3 or Gentoo 1.2 Linux 2.4.19 rc1-rc7), Linux 2.6.3 - 2.6.8
Uptime 0.093 days (since Thu Mar 24 20:12:22 2005)

Quote:
Never ever run telnetd or ftpd... It should be made clear the days of running telnet and ftp are over. SSH version 2.0 is the only way to fly for remote shell access and file transfer.
Is this something I can check? I don't want to leave any backdoors open.


Quote:
Use a strict umask (077 instead of the usual 022 default) so that by default nothing is executable, readable, or writable by any user other then the user who created the file unless they go out of there way to change the permissions.
Where and how can I check and set this?

Quote:
Make sure your kernel limits in sysctl.conf are reasonable. Usually they are, but it doesn't hurt to check?
Where and What exactly am I looking for here?
 
Old 03-25-2005, 07:03 AM   #97
jtshaw
Senior Member
 
Registered: Nov 2000
Location: Seattle, WA USA
Distribution: Ubuntu @ Home, RHEL @ Work
Posts: 3,892
Blog Entries: 1

Rep: Reputation: 67
"netstat -tua" will tell you all the TCP and UPD ports you are listening to (as well as what is connected to them).

"iptables -L" will tell show you the currently installed iptables rules. All attempts to connect on block ports will be logged to the kernel message buffer so you can see them in dmesg.

Make sure you run nmap from a different machine then the one you are testing. iptables blocks external connections, not internal.

Gentoo doesn't install an ftp daemon or telnet daemon unless you go out of your way to do it... so your safe there.

Umask is set in /etc/profile. You'll see a line that says "umask 022" with a comment about how 077 is safer, but 022 is pretty resonable in there somewhere.

As for the sysctl.conf stuff.... your default values should do you fine for now, Gentoo uses resonable values.
 
Old 03-26-2005, 07:41 AM   #98
frob23
Senior Member
 
Registered: Jan 2004
Location: Roughly 29.467N / 81.206W
Distribution: OpenBSD, Debian, FreeBSD
Posts: 1,450

Rep: Reputation: 48
Quote:
Originally posted by penguinlnx
Perhaps the smoking pot slam got to me more than it should have...
But that's not something people here could be expected to know about.

Actually, I don't like drugs at all, or those who recklessly push them for recreational purposes.
But that's just me, and my private war with German drug companies...he he...
For my part in that slight, I also apologize. I took it as humorous ribbing which I never, not even for a moment, thought that it was possible someone would take seriously. In the group of people I tend to associate with, most of whom are not drug users and would never even consider their use, good natured joking about their being "spacey" or "paranoid" or whatever is taken in turn without any suspicion that they might be users.

It was no slam, it was an attempt at some levity... to lighten the mood caused by the need to rebuke many of the points you were making from a lack of understanding.

As for your war against German drug companies... I imagine it might be from the hypocrisy of their market if they are like the American market. Where they offer pills and products to cure any "ailment" even when the problem is less troubling than the side effects of the "cure." All the while, our children hear about the evils of drugs in one ear and hear their praises sung on the TV.
Quote:
"Better living through chemistry."
-Dow Chemical Ad
I can only speak for Americans when I say we have become a nation of chemical hypocrites... denying the benefits of chemically altered states out of one corner of our mouth... while preaching their benefits out the other. Never feel better than the pot-smoker... nor better than the child on ADD controlling medication... nor the woman who takes a pill for "social anxiety disorder." They are only people who have sought a solution in a chemical. May they find the respite they seek and avoid the dangers it brings with it.
 
Old 03-26-2005, 12:48 PM   #99
penguinlnx
Member
 
Registered: Mar 2005
Location: Ice Station Alert AFB
Distribution: Gentoo
Posts: 166

Original Poster
Rep: Reputation: 30
Quote:
I also apologize. I took it as humorous ribbing which I never, not even for a moment, thought that it was possible someone would take seriously.
No sweat: I can take a ribbing, and I am not hurt by it, even if it's about the size of my willie or the color of my skin, or my religion. Most people feel that things you're born with and can't change probably shouldn't be made fun of. (although I tried an enlarger, I'm colorblind, and I often worship myself).

Whereas changeable and inappropriate behaviors are open season, as to joking and horseplay. My only problem with this is potential legal implications, and the fact that people often believe unsubstantiated statements, which affects employment and relationships. (Would you still go out with me, and let me run your Server, if your brother said I was into Donkey Porn? - and how does *he* know?)

On the other hand, this stifling 'politically correct' climate is like the 'night of the body-snatchers':
I would rather you could make fun of everything, and everyone had a thicker skin. I can't even tell my favourite 'same-sex' marriage joke now. ("What same sex every night? Can't I even wear a blindfold?")
If we could make fun of ourselves properly, none of this would have happened:
Quote:
"So I said to the taxi driver, 'Show me where I can have a good time.' .
...And he takes me to my house!" -Rodney Dangerfield

Last edited by penguinlnx; 03-26-2005 at 01:23 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
POSIX message queues(Solaris) to SYS V message queues(Linux) devershetty Programming 1 01-22-2007 10:15 AM
Linux Kernel Vulnerability jeremy Linux - Security 2 03-15-2005 02:03 AM
Linux Services Ameii83 Linux - Software 7 12-24-2004 03:12 AM
Linux vs Mac question (Virus vulnerability related) unixfreak Linux - Security 14 08-29-2004 06:05 AM
TightVNC Ver terminal Services.. also looking for terminal Services for linux 2782d4 Linux - Security 3 05-20-2004 02:30 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:14 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration