capability to disable/enable printer

[Elena Leontieva]

Hi,

I wonder if a regular user

a. has
b. can have
c. should have

a capability to disable/enable printers on a Unix server?

I figured that a user can run an lpstat.

Elena.

[Charlie Rubeor]

Regular users can enable/disable printers. Any print jobs currently being printed will be re-printed when the queue is enabled.

[Chris Wilshaw]

As a default, all users have access to enable/disable printers.

Looking at /usr/bin/enable|disable, we see;

-r-sr-xr-x 1 lp bin 24576 Nov 14 2000 /usr/bin/disable
-r-sr-xr-x 1 lp bin 20480 Nov 14 2000 /usr/bin/enable

Through the use of the setuid bit on the permissions, anyone who runs these commands is effectively seen as the user "lp", which owns the printing subsystem.



You can prevent users from enabling/disabling printers by using

chmod o-x /usr/bin/disable /usr/bin/enable

Then, when the users try to enable/disable the printers; they see

/usr/bin/sh: disable: Execute permission denied.

[Pete Randall · Accepted solution]

Elena,

a. yes
b. see a above
c. in my opinion - no

I can't imagine a reason where a normal user would need to disable/enable printers. If they have an issue with the printer, I think they should be working with support and not fiddling around themselves.


Pete

[Elena Leontieva]

Thanks to everybody. I just want to hear your opinion.

Elena.