cupsd does not read hosts.allow/deny properly

jarome · 01-02-2007, 03:04 PM

I am running SUSE 10.2. If I try to add a printer in YaST2, or use the cups admin GUI, cupsd starts spewing our GBs of error messages, and I have to turn it off.

I need to have hosts.allow to filter out every site except where I work and my local net so that I do not get attacked on my ssh port. The two hosts. files work fine with sshd.

But for cupsd, I get messages like:
Jan 2 10:07:12 romeja cupsd: warning: /etc/hosts.allow, line 62: Unable to handle client address: unknown
Jan 2 10:07:12 romeja cupsd: warning: /etc/hosts.allow, line 64: Unable to handle client address: unknown
Jan 2 10:07:12 romeja cupsd: warning: /etc/hosts.allow, line 65: Unable to handle client address: unknown
Jan 2 10:07:12 romeja cupsd: warning: /etc/hosts.allow, line 66: Unable to handle client address: unknown
Jan 2 10:07:12 romeja cupsd: warning: /etc/hosts.deny, line 5: Unable to handle client address: unknown
Jan 2 10:07:12 romeja cupsd: warning: /etc/hosts.deny, line 5: Unable to handle client address: unknown

My hosts.allow has
ALL : 192.168.1. : ALLOW
ALL : .mycompany.org : ALLOW
ALL : 127.0.0.1, localhost : ALLOW
cupsd : 192.168.1.10 : ALLOW
cupsd : 127.0.0.1 : ALLOW

hosts.deny has:
ALL : ALL EXCEPT 192.168.1., 127.0.0.1, LOCAL

I have tried numerous variations on these with no success.

The cups log gives a zillion lines like:
[26/Dec/2006:22:11:14 -0500] tcp_wrappers refused connection from unknown. See /etc/hosts.allow and /etc/hosts.deny.

I am stuck. Please help.

Jim

anomie · 01-03-2007, 01:42 PM

Just a thought -

This is on my FC5 box:

Code:

[hector@troy ~]$ whereis cupsd
cupsd: /usr/sbin/cupsd /usr/share/man/man8/cupsd.8.gz
[hector@troy ~]$ ldd /usr/sbin/cupsd | grep 'libwrap.so' 
[hector@troy ~]$

There is no tcp_wrappers support compiled into cupsd in my case. If the same is true for you, you will not be able to use the hosts.allow file to control access. Instead you'll have to add a rule to your iptables INPUT chain.

jarome · 01-03-2007, 02:50 PM

Why would cupsd be parsing the two hosts. files then? But I may have to resort to just using iptables.

Thanks for your suggestion. I will check it.