How to bypass authorization on cups

mfoley · 01-08-2017, 09:26 AM

I'm running Slackware 14.2 and KDE. This question has probably been asked a million times, but I can't find a definitive answer.

I'm trying to add a printer as a normal (non-root) user. When I go into the 'Select Printer to Add' dialog I am prompted to enter root's password.

How can I eliminate this prompt and let the user select a printer?

Alien Bob · 01-08-2017, 10:32 AM

RTFM: "man cupsd.conf" and search for the SystemGroup directive.

hazel · 01-08-2017, 10:50 AM

Add yourself to the lpadmin group. Then log in again.

ivandi · 01-08-2017, 12:31 PM

/etc/cups/cups-files.conf

Code:

...
# Administrator user group, used to match @SYSTEM in cupsd.conf policy rules...
# This cannot contain the Group value for security reasons...
SystemGroup sys root
...

Add the user to the sys group.

Or add users group to the SystemGroup list

Code:

SystemGroup sys root users

Or create a lpadmin group, add the user to that group and modify SystemGroup.

Code:

SystemGroup lpadmin root

Cheers

mfoley · 01-08-2017, 11:36 PM

Quote:

Originally Posted by hazel

Add yourself to the lpadmin group. Then log in again.

hazel: There is no lpadmin group and adding it and adding the user to it did nothing.

Alien Bob: love your worstenbroodjes. I do generally read man pages and web-search before posting here. On re-reading, the line,

Quote:

"@SYSTEM" maps to the groups listed for the SystemGroup directive in the cups-files.conf(5) file.

So, I changed the line in /etc/cups/cups-file.conf from SystemGroup sys root to SystemGroup sys root users and restarted cups. That seemed to do it!

Next, I want to see my Windows shared Officejet. In the Settings > Add Printer > Select a Printer to Add, I chose "Windows Printer via SAMBA" per instructions at http://www.howtogeek.com/191323/how-...-on-a-network/, and entered: smb://alluneedizluv/rover/MarksOfficejet, where "alluneedizluv" is the workgroup, "rover" is the Windows host and "MarksOfficejet" is the sharename of the printer. I entered the Windows user and PW. So far so good (maybe).

Then I tried printing a test page. I got the message: "Paused - Can't load /etc/samba/smb.conf - run testparm to debug it". This is doubtless because samba is not running on the Linux host. So, next question, what should go in my smb.conf file? I've snagged the following from https://www.samba.org/samba/docs/man...plePrintServer. Does this look right?

Code:

[global]
workgroup = MIDEARTH    # should I change to ALLUNEEDIZLUV?
netbios name = GANDALF  # should I change to Linux hostname?
security = SHARE
passdb backend = guest
printing = cups
printcap name = cups
[printers]
comment = All Printers
path = /var/spool/samba
printer admin = root    # what about this?
guest ok = Yes
printable = Yes
use client driver = Yes
browseable = No

I'll have to say, that example as-is doesn't work:

Code:

$ testparm
Load smb config files from /etc/samba/smb.conf
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
WARNING: Ignoring invalid value 'SHARE' for parameter 'security'
Error loading services.

mfoley · 01-09-2017, 11:51 PM

More info ... I changed to the as-shipped smb.conf:

Code:

[global]
   workgroup = MYGROUP
   server string = Samba Server
   server role = standalone server
   log file = /var/log/samba.%m
   max log size = 50
   dns proxy = no 

[homes]
   comment = Home Directories
   browseable = no
   writable = yes

[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = no
   writable = no
   printable = yes

And I changed my connection string to smb://192.168.0.41/MarksOfficejet, using the actual IP instead of the hostname (there is no DNS on this LAN). Now my error message is different when I go to print the test page, I get a timeout message and after it retries I get:

Paused - 'Unable to connect to CIFS host after (tried 3 times)'

And that's that! I cannot try sending the test page again as it is stuck on that message, forever, even after rebooting. The only way I can retry this is to delete the printer and add it back in again.

(slight correction: I can go into http://localhost:631/printers and cancel the jobs and retry the test page. However, Settings > Printer still shows "Unable to connect ...", forever.)

CUPS is a P.I.A.! Need help!

mfoley · 01-10-2017, 12:30 AM

More info: Using http://localhost:631 I was able to see this same printer on its wireless IP. I used http://localhost:631 to connect to that printer and it worked, albeit I had to use the HP Officejet Pro 6830, hpcups 3.16.11 driver. The hpijs driver did not work.

Interestingly, this and the other HP printer on the LAN did not show up in KDE > System Settings > Printers > Add Printer ... or so I thought! Under Local Printers there are 2 blank hash-marks, no printer names. However, if I click on one hash-mark or the other the IP address and port for each of those printers does show up. Clearly a bit of a bug in the KDE printer setup program.

In order to have Joe-Regular-User change settings in http://localhost:631, I had to further modify cupds.conf:

Code:

 <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
 AuthType None 
# AuthType Default 
# Require user @SYSTEM 
# Order deny,allow 
</Limit>

I added the line in bold and commented out the other lines. I did this in both the <Policy default> and <Policy authenticated> sections. If I don't do that, I have to enter the root or user's password -- annoying.

Still would like some help accessing the Windows shared printer. Has anybody done this?

kjhambrick · 01-10-2017, 02:07 AM

mfoley --

I've not done any Windows Shared Printers on Slackware64 14.2 because I don't have any WinDOS-Only printers at home.

However, lot's of our Customers do have Shared USB Printers and this Open SuSE Page is my GoTo Doc for proper cups URIs for Windows Shares:

SDB:Printing via SMB (Samba) Share or Windows Share

Skip to the bottom: The Correct DeviceURI for CUPS

Be careful with Spaces and other odd chars in ShareName, UserName, Password -- they'll have to be HTML-encoded

There are a zillion google-hits for Admins trying to encode special chars in those cups URIs without much luck.

HTH

-- kjh

BratPit · 01-10-2017, 03:07 AM

@mfoley

There is several ways to "share" printer:

https://wiki.archlinux.org/index.php...rinter_sharing

Select one and do not mix with others.

kjhambrick · 01-10-2017, 04:08 AM

Nice Reference Page, BratPit !

Thanks !!

-- kjh

mfoley · 01-11-2017, 04:50 PM

Sorry, all this is still failing for me. Do I have to reboot the Windows computer after adding the LPD component? I'm not is a position to do that.

For lpd I've tried: lpd://192.168.0.42/MarksOfficejet and using the NETBIOS name: lpd://ROVER/MarksOfficejet.

For smb I've tried smb://192.168.0.42/MarksOfficejet, smb://usernameassword@ROVER/MarksOfficejet and smb://usernameassword@192.168.0.42/MarksOfficejet and smb://192.168.0.42/MarksOfficejet with password enter in the KDE config.

All attempts result in Connection failed.

smbtree gives:

Code:

$ smbtree -N
ALLUNEEDIZLUV
        \\WKST_01                       Samba Server
                \\WKST_01\testLPD               test
                \\WKST_01\Officejet_Pro_6830_e-All-in-One       Marks Officejet Pro 6830
                \\WKST_01\zxcv                  zxcv
                \\WKST_01\IPC$                  IPC Service (Samba Server)
        \\WATCHER                       WATCHER Samba Server
        \\ROVER

where WKST_01 is the Linux computer, ROVER is the Windows computer, tesLPD is my LPD test config on Linux and zxcv is my samba test config on Linux. The printer Officejet_Pro_6830_e-All-in-One is the same printer connected to the printer's own wireless IP. That works just fine.

I'm missing something. smb.conf? Firewall? Windows setting?

smb.conf is

Code:

[global]
   workgroup = ALLUNEEDIZLUV
  printing = cups
   server string = Samba Server
   server role = standalone server
   log file = /var/log/samba.%m
   max log size = 50
   dns proxy = no

[homes]
   comment = Home Directories
   browseable = no
   writable = yes

[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = no
   writable = no
   printable = yes

kjhambrick · 01-12-2017, 04:03 AM

mfoley --

Shouldn't the smbtree command return printer shares on ROVER ?

If so, ROVER did not return any printers ??

Is ROVER sharing printers ???

-- kjh

BratPit · 01-12-2017, 07:56 AM

Where is your printer localized ?
On M$ /Rover/ , Linux Wkst or wireless ????

Is shared printer on Windows?
What Windows/98,XP,7.8.10/ ?
On ROVER smbtree do not see any printer shared and if you do not share it on W$

Quote:

smb://192.168.0.42/MarksOfficejet

has no right to act.

mfoley · 01-13-2017, 04:45 PM

The printer is physically connected to a Window 7 computer via USB. The computer name is ROVER, WORKGROUP: ALLUNEEDIZLUV. Control Panel > Hardware and Sound > Devices and Printers ? Right-click on HP Officejet PRO 6830 > Printer Properties > Sharing, shows the 'Shared' checkbox checked, and share name MarksOfficejet.

Yes, I would have expected to see this printer listed under ROVER in the `smbtree -N`. I must have something not set correctly in Windows. What?

BratPit · 01-14-2017, 03:41 AM

1.Check ROVER again for output with:

Quote:

smbclient -L ROVER -N

2.Check in W7 is in the same workgroup and subnetmask like other stations should be
OK but you never know.

3.There are no less than four Windows services that must be running in order for File and Print Sharing to work correctly and fully:

Computer Browser
Server
TCP/IP NetBIOS Helper
Workstation

Check It.

4. NetBIOS must be enabled on your network adapter as well. Check it.

5.For compatibility with Win 7 you need to add /maybe on samba4 it is default option / to your smb.conf (in [global] section) something like:

Quote:

ntlm auth = no
lanman auth = no
client ntlmv2 auth = yes

6.Turn on the W7 firewall rule

Quote:

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

7.Go to item 1.