HP-UX Allowing normal user "cancel" command for print requests

[Manoj Sooka]

Good day All

Could you please help with a printer requirement on HP-UX 11.11.

Certain users are required to have full printer control capabilities. When they try to cancel requests belonging to another user, the message received is "cancel: You must have root capability to use this option".

Can this be set so that the users do have this capability ? And if possible how can we implement this ?

I will be leaving for the day. Will supply any further details if required later.

Many thanks
Manoj

[Robert-Jan Goossens_1]

Hi Manoj,

Two options, restricted sam(sam -r) or you can install sudo.

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.8p9/

Regards,
Robert-Jan

[Bill Hassell]

The easiest way is to enable the lp user to allow logins, ie, have a HOME directory (*not* in the spool system) and a password. The users can use su - lp to login and cancel jobs. sudo is an alternative but users must be restricted to running as lp, *not* root.

sudo is quite versatile but it is too easy to give away root without some thought to the usage. Always start with 100% restriction and add an lp user group and allow only the cancel command. Add other commands to other groups and add users to those groups based on competency.

[Manoj Sooka]

Thanks Robert-Jan. I will do some testing with the restricted SAM.

Thanks Bill. I will also check out the lp user option. I tested with "su - lp" from thr root user and still got the same error as before. Should there be further configuration other then assigning a home directory and password for lp ?

I am not familiar at all with SUDO and will investigate further.

Thanks for the help so far.
Manoj

[Michal Toth]

or put desired users into lp group

[Bill Hassell]

> I will also check out the lp user option. I tested with "su - lp" from thr root user and still got the same error as before. Should there be further configuration other then assigning a home directory and password for lp?

That sounds like an ownership issue in the spooler directories. Check the spooler installation with the swverify command:

swverify PrinterMgmt

Look for errors using the swjob command at the end of the swverify output.

[Manoj Sooka]

Thanks guys.

We are using restricted SAM and the users are happy with that.

Appreciate the help.