Re: CUPS permissions

[Brian <ad44@cityscape.co.uk>]

On Thu 26 Aug 2021 at 08:53:19 -0400, Greg Wooledge wrote:

[...]

> I suspect there's some *really* basic misunderstanding going on at some
> level.  Let's start from the beginning.
> 
> In order to administer a printer in CUPS, you do the following things:
> 
> 
> 1) Make sure the root account has a PASSWORD.  Make sure you know it.
>    Access to sudo doesn't count.

I have no experience of using sudo for the task in hand. Ubuntu uses
it by default but also puts the first user in the lpadmin group. Issues
with this seem to be almost non-existent.

> 2) Install cups.
> 
> 3) Visit http://localhost:631/ in a GUI web browser.  Make sure Javascript
>    is allowed.

Mmm. I invariabely use Lynx without a problem to access the CUPS web
interface and install a printer. Lynx doen't support Javascript.

> 4) At some point, when you try to do stuff to the printers in the browser,
>    you will be prompted for a username and password, using HTTP basic
>    authentication.  When this occurs, you should login as root, using
>    root's password.

Being asked for a username and password and logging in as root is my
experience too.

> 5) If you screwed up and logged in as yourself, restart the web browser
>    so that you can get the HTTP basic authentication dialog box again.  Go
>    to step 4.

I do not think CUPS allows logging in as a user unless that user is a
member of the lpadmin group. FWIW, my opinion is that "Unable to add
printer: Forbidden" is a conswquence of not being in that group.
 
> 6) Once the printer is set up via the browser, you should be able to see
>    it and print to it from the command line.  "lpstat -t" to see all of
>    the printers and their status.  "lp" or "lpr" to print a text file.

Agreed.

-- 
Brian.





> 
> 
> Any variants on this procedure will require knowledge that I don't
> personally possess.  E.g. if for some reason you refuse to set a root
> password, then you may have to set up a printer-admin account which
> has the appropriate privileges, and a password, and then use that
> instead of root.  I don't know what those privs would be.
>