can regular users disable/enable printer queues

[Unix Administrator_5]

I have several printers configured using hppi.
I thought that the enable/disable queue was only available to root; however it appears that anyone can "cycle" these queues.

Is this normal behavior?

[Bill Hassell · Accepted solution]

Perfectly normal. disable and enable are section 1 commands, therefore available to all users. If a user decides to disable a printer, it would be appropriate to use the -r option to specofy the reason. However, a printer is automatically disabled whenever a printer script returns a non-zero value. lpstat will report this error code. So it is more likely that there is a printer problem or for network printers, problems with communication that are disabling the printers.

[Unix Administrator_5]

Has this always been the case with enable/disable?

[Bill Hassell]

Yes, any user may disable any printer. This has been the case since HP-UX was introduced. You might be thinking about cancel which can be restricted to just the owner of a print job, but ONLY for remote printers, not local. If printers are being disabled without a reason code, then you can log the use of disable with a wrapper script. To use it, you rename /usr/bin/disable to disable.orig and put the attached script in place as /usr/bin/disable (make it executable). It will log eveery use of disable to syslog.d