Ubuntu + CUPS = Cannot Admin via {hostname}:631

[LydaRA]

PLEASE HELP!

I'm trying to build a new print server on Ubuntu 12.04 + CUPS. (Coming over from other distros....want to standardize on Ubuntu, if I can make it work!)


I can use the basic Ubuntu System Settings to add a printer, but not the CUPS http://{hostname}:631 page for remote administration! The page comes up and most functions appear fine.

But try anything like the "Add Printer" button and a prompt asks "A username and password are being requested by http://localhost:631. The site says: "CUPS"--but then it doesn't appear to accepts ANY credentials (my sysop, root, nor Windows AD PrinterAdmins group members!!! "The connection was reset" is all Firefox shows...

Any ideas are appreciated!

[pkadeel]

PLEASE HELP!

I'm trying to build a new print server on Ubuntu 12.04 + CUPS. (Coming over from other distros....want to standardize on Ubuntu, if I can make it work!)


I can use the basic Ubuntu System Settings to add a printer, but not the CUPS http://{hostname}:631 page for remote administration! The page comes up and most functions appear fine.

But try anything like the "Add Printer" button and a prompt asks "A username and password are being requested by http://localhost:631. The site says: "CUPS"--but then it doesn't appear to accepts ANY credentials (my sysop, root, nor Windows AD PrinterAdmins group members!!! "The connection was reset" is all Firefox shows...

Any ideas are appreciated!

It needs a user id and password of a user on the ubuntu machine.

[LydaRA]

Yes, I'm not even focused on the AD PrinterAdmins group yet. But I cannot even get it to take root or sysop (obviously both local admin accounts on the Ubuntu server.

I saw somewhere else that I needed to add the local user cupsys to the shadow group. But the command tells me that cupsys doesn't exist!

[pkadeel]

I'm not even focused on the AD PrinterAdmins group yet. But I cannot even get it to take root or sysop

I couldn't exactly understand what you said sorry.
You can create a new user for accessing cups using the useradd command
or you can edit /etc/cups/cupsd.conf file and comment the "Require user @SYSTEM" for your desired portion i.e. change

  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

to

  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
#    AuthType Default
#    Require user @SYSTEM
    Order allow,deny
  </Limit>

while you are testing your system and have not started using it in production

[LydaRA]

cupsd.conf:

LogLevel warn
MaxLogSize 0
SystemGroup root sysop lpadmin HHP\PrinterAdmins
# Allow remote access
Port 631
Listen /var/run/cups/cups.sock
# Share local printers on the local network.
Browsing On
BrowseOrder allow,deny
BrowseRemoteProtocols
BrowseAddress @LOCAL
BrowseLocalProtocols CUPS dnssd
DefaultAuthType Basic
WebInterface Yes
<Location />
# Allow shared printing...
Order allow,deny
Allow from @LOCAL
</Location>
<Location /admin>
Order allow,deny
Allow from @LOCAL
</Location>
<Location /admin/conf>
AuthType Default
Require user @SYSTEM
Order allow,deny
Allow from @LOCAL
</Location>
<Policy default>
JobPrivateAccess default
JobPrivateValues default
SubscriptionPrivateAccess default
SubscriptionPrivateValues default
<Limit Create-Job Print-Job Print-URI Validate-Job>
Order deny,allow
</Limit>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Cancel-Job CUPS-Authenticate-Job>
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>
<Policy authenticated>
JobPrivateAccess default
JobPrivateValues default
SubscriptionPrivateAccess default
SubscriptionPrivateValues default
<Limit Create-Job Print-Job Print-URI Validate-Job>
AuthType Default
Order deny,allow
</Limit>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
AuthType Default
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Cancel-Job CUPS-Authenticate-Job>
AuthType Default
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>

[dannyboy79]

not sure this would help:
http://ubuntuforums.org/showthread.php?p=1831119

[pkadeel]

cupsd.conf:

LogLevel warn
MaxLogSize 0
SystemGroup root sysop lpadmin HHP\PrinterAdmins
# Allow remote access
Port 631
Listen /var/run/cups/cups.sock
# Share local printers on the local network.
Browsing On
BrowseOrder allow,deny
BrowseRemoteProtocols
BrowseAddress @LOCAL
BrowseLocalProtocols CUPS dnssd
DefaultAuthType Basic
WebInterface Yes
<Location />
# Allow shared printing...
Order allow,deny
Allow from @LOCAL
</Location>
<Location /admin>
Order allow,deny
Allow from @LOCAL
</Location>
<Location /admin/conf>
AuthType Default
Require user @SYSTEM
Order allow,deny
Allow from @LOCAL
</Location>
<Policy default>
JobPrivateAccess default
JobPrivateValues default
SubscriptionPrivateAccess default
SubscriptionPrivateValues default
<Limit Create-Job Print-Job Print-URI Validate-Job>
Order deny,allow
</Limit>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Cancel-Job CUPS-Authenticate-Job>
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>
<Policy authenticated>
JobPrivateAccess default
JobPrivateValues default
SubscriptionPrivateAccess default
SubscriptionPrivateValues default
<Limit Create-Job Print-Job Print-URI Validate-Job>
AuthType Default
Order deny,allow
</Limit>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
AuthType Default
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Cancel-Job CUPS-Authenticate-Job>
AuthType Default
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>

If I understood right and this is what you want then you have to change the highlighted text in the quote above to the below given text

<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    #AuthType Default
    #Require user @SYSTEM
    Order deny,allow
  </Limit>

[LydaRA]

Yes, pkadeel--that did it!

So we've confirmed that the CUPS web services is still listening, but there is some authentication handling problem?

What user does the CUPS process run as? What permissions/group memberships does it need in Ubuntu? (See my prior comment about "cupsys" not existing...)

[LydaRA]

dannyboy79: You like several other posts I've seen recommend:

Allow CUPS to read the password file
To do admin tasks remotely using the web interface, it will ask you for a password. In order to check this password CUPS needs to be able to read the password shadow file. To do this 'cupsys' needs to be a member of the group 'shadow'.

adduser cupsys shadow

But I get:

adduser: The user `cupsys' does not exist.

Does Ubuntu run this process as some other user???

[pkadeel]

dannyboy79: You like several other posts I've seen recommend:

But I get:



Does Ubuntu run this process as some other user???

the link dannyboy79 posted is a summarized version of a long manual.

My understanding is (I may be wrong) that cupsys user is not created automatically, you have to do it manually. After creating this user you assign the shadow group so that it can do the admin tasks.

You might be interested in the following ubuntu help page which eventually directs you to the CUPS Admin Manual here
http://www.cups.org/doc-1.1/sam.html#13_4

Read these and you will understand what to do next. I hope the problem is solved.