CUPS Remote Administration

nominruil · 06-20-2007, 02:13 AM

How can administer CUPS server through its web-GUI on another machine inside the LAN? I've appended the 'Allow From All' under <Location /admin> category yet the connection cannot be established.

I can not enable remote administration through the GUI on the local machine because I only have the program links for browsing (it's a pure server, no X, so no Mozilla) and although the GUI does load, it does not let change anything without authentication, which links does not ask for.

billymayday · 06-20-2007, 02:37 AM

Have you opened port 631 on your firewall?

nominruil · 06-20-2007, 02:50 AM

Quote:

Originally Posted by billymayday

Have you opened port 631 on your firewall?

Both machines are on the same lan so that is irrelevant.

Sorry if that sounded a bit harsh, bit annoyed with the problem.

jschiwal · 06-20-2007, 03:51 AM

Quote:

Originally Posted by nominruil

Both machines are on the same lan so that is irrelevant.

It is relevent if the hosts themselves have firewalls (netfilter).

I enabled remote administration via the cups web interface to examine the config file:

Code:

sed -n '1,29p' cupsd.conf1
# Show general information in error_log.
LogLevel info
SystemGroup sys root
# Allow remote access
Port 631
Listen /var/run/cups/cups.sock
# Show shared printers on the local network.
Browsing On
BrowseOrder allow,deny
BrowseAllow @LOCAL
DefaultAuthType Basic
<Location />
  # Allow remote administration...
  Order allow,deny
  Allow @LOCAL
</Location>
<Location /admin>
  Encryption Required
  # Allow remote administration...
  Order allow,deny
  Allow @LOCAL
</Location>
<Location /admin/conf>
  AuthType Basic
  Require user @SYSTEM
  # Allow remote access to the configuration files...
  Order allow,deny
  Allow @LOCAL
</Location>

Here is the same part when remote administration wasn't enabled:

Code:

sed -n '1,29p' cupsd.conf2
# Show general information in error_log.
LogLevel info
SystemGroup sys root
# Only listen for connections from the local machine.
Listen localhost:631
Listen /var/run/cups/cups.sock
# Show shared printers on the local network.
Browsing On
BrowseOrder allow,deny
BrowseAllow @LOCAL
DefaultAuthType Basic
<Location />
  # Restrict access to the server...
  Order allow,deny
  Allow localhost
</Location>
<Location /admin>
  Encryption Required
  # Restrict access to the admin pages...
  Order allow,deny
  Allow localhost
</Location>
<Location /admin/conf>
  AuthType Basic
  Require user @SYSTEM
  # Restrict access to the configuration files...
  Order allow,deny
  Allow localhost
</Location>

Here is the diff between the two:

Code:

diff cupsd.conf1 cupsd.conf2
4,5c4,5
< # Allow remote access
< Port 631
---
> # Only listen for connections from the local machine.
> Listen localhost:631
13c13
<   # Allow remote administration...
---
>   # Restrict access to the server...
15c15
<   Allow @LOCAL
---
>   Allow localhost
19c19
<   # Allow remote administration...
---
>   # Restrict access to the admin pages...
21c21
<   Allow @LOCAL
---
>   Allow localhost
26c26
<   # Allow remote access to the configuration files...
---
>   # Restrict access to the configuration files...
28c28
<   Allow @LOCAL
---
>   Allow localhost

After making the change I was able to remotely adminster CUPS from another machine in a web browser.

If you have an ssh connection to the server, you could use a text based browser such as links. Browse to http://localhost:631
Press the down arrow until you get to the Administration Tab and press enter. Then press the down arrow until you get to the "Allow Remote Administration" box and press enter. Press the down arrow to "Change Settings" and press enter. You may need to enter the root username and password. After that, you should be able to connect remotely via the web browser ( https://hostname:631 )

nominruil · 06-20-2007, 04:20 AM

Thank you very very much, thanks for taking the time to help me out, thats exactly the kind of thing that would help

That code listing helped me Fix it, too bad the documentation didn't list some of if...

billymayday · 06-20-2007, 04:55 AM

You'd be surprised how many solutions are as simple as firewalls and SELinux - as jschiwal points our, same lan or not same lan.

Anyway, wasn't near a linux box before.

Here's another snip from a cupsd.conf

# Restrict access to the server...
<Location />
Order allow,deny
Allow 192.168.1
</Location>

linuxandtsm · 06-08-2012, 10:46 AM

Hi jschiwal,

Great reply from you...you just solved my problem that i am struggling to solve in few simple steps with clean explanation!.
I just re-opened this thread to thank you!

PS:sorry for re-opening an old thread