topic Re: Printer Access in Operating System - HP-UX

Printer Access

Madanagopalan S — Mon, 25 Feb 2002 06:47:14 GMT

Is it possible to restrict the printing
of documents to number of pages or size
of documents. For example, restrict the
user to print only 10 pages or 1mb size
of docs in HPUX 11.

Re: Printer Access

Steven Sim Kok Leong — Mon, 25 Feb 2002 07:01:55 GMT

Hi,

You can write a wrapper script for lp. I did this once for SAP print jobs so that if they exceed a certain size, they are not printed.

I don't have it with my off-hand but it is something like this (simplied version assuming straightforward lp with only filename as parameter):

# mv /usr/bin/lp /usr/bin/lp.bin
# vi /usr/bin/lp

#!/sbin/sh
size=`ll $1|awk '{print $5}`
if [ "$size" -gt "2048" ]
then
echo $1 is too large for printing
exit 1
else
/usr/bin/lp.bin $*
fi

You can modify this wrapper script to suit your needs.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: Printer Access

Madanagopalan S — Mon, 25 Feb 2002 07:21:23 GMT

Hi steven (May I call u so),
lp command is suid program. If I write
some shell script for this lp, is there
any security issue other than binary.

Re: Printer Access

Steven Sim Kok Leong — Mon, 25 Feb 2002 07:28:20 GMT

Hi,

The /usr/bin/lp script should be 0755 and owned by root since it must be an executable script.

The /usr/bin/lp.bin script should retain its permissions and be 4555 (4 for setuid) and owned by root.

There is no security implications (ie. security level will be same as before the change) because you are not modifying the binary (known now as /usr/bin/lp.bin and previously as /usr/bin/lp) or its permissions. In addition, the shell script has no setuid/setgid bits on (thus not subjected to buffer overflow vulnerability issues which cause root compromises).

Hope this helps. Regards.

Steven Sim Kok Leong

Re: Printer Access

Madanagopalan S — Mon, 25 Feb 2002 08:10:53 GMT

Hi Steven,
Thanks for your idea.

I have developed the script and its working
fine with notification also..

Thanks .