LPD not working -- "You are not authorized" errors

[Debbie Fleith]

Our HP-UX 11 system lpd print services are not working. When we do a lpstat, we get these errors after it displays remote queue names (running lpstat as root):
: lpd: You are not authorized for line printer access

Anyone know what the problem could be?

[James R. Ferguson]

Hi Debbie:

Verify that your permissions and ownership of '/usr/bin/lpstat' look like:

-r-sr-xr-x 1 lp bin 53248 Jun 2 2006 /usr/bin/lpstat

If not, do:

# chmod 4555 /usr/bin/lpstat
# chown lp:bin /usr/bin/lpstat

Regards!

...JRF...

[Debbie Fleith]

Permissions of lpstat match what you recommend.

[James R. Ferguson]

Hi (again) Debbie:

OK, verify:

-r-sr-xr-x 1 root bin 73728 Jun 2 2006 /usr/sbin/rlpdaemon

-r-sr-xr-x 1 root bin 53248 Jun 2 2006 /usr/sbin/lpsched
-r-sr-xr-x 1 lp bin 40960 Jun 2 2006 /usr/bin/cancel
-r-sr-xr-x 1 lp bin 28672 Jun 2 2006 /usr/bin/disable
-r-sr-xr-x 1 lp bin 20480 Jun 2 2006 /usr/bin/enable
-r-sr-xr-x 1 lp bin 53248 Jun 2 2006 /usr/bin/lpstat
-r-sr-xr-x 1 lp bin 16384 Nov 14 2000 /usr/bin/slp
-r-sr-xr-x 1 lp bin 20480 Jun 2 2006 /usr/sbin/accept
-r-sr-xr-x 1 lp bin 24576 Jun 2 2006 /usr/sbin/lpfence
-r-sr-xr-x 1 lp bin 28672 Jun 2 2006 /usr/sbin/lpmove
-r-sr-xr-x 1 lp bin 16384 Jun 2 2006 /usr/sbin/lpshut
-r-sr-xr-x 1 lp bin 20480 Jun 2 2006 /usr/sbin/reject

Regards!

...JRF...

[Debbie Fleith]

Those permissions check out OK too. The main problem is not with being able to view the print queues, lpd is not working.

[James R. Ferguson]

Hi (again) Debbie:

Does your '/etc/inetd.conf' have the daemon:

printer stream tcp nowait root /usr/sbin/rlpdaemon rlpdaemon -i

Regards!

...JRF...

[Debbie Fleith]

Yes, inet.conf is fine

[James R. Ferguson]

Hi Debbie:

Also verify:

-r-sr-xr-- 1 root lp 32768 Jun 2 2006 /usr/sbin/rlp

...and have a look at Technical Knowledge Base document ID: emr_na-c00879850-3

Regards!

...JRF...

[Bill Hassell]

There are a lot of parts to the spooler. Use this command to track down the permission problem:

swverify -v PrinterMgmt.LP-SPOOL

At the end of this command, there is a line for swjob that will show the results. Any errors in the /usr/share directory can be ignored -- these are just man page directories. The swverify command will look at every part of the spooler.

[VK2COT]

Hello,

From what I understand, you get "permission denied" from REMOTE PRINTER QUEUES (or at least
some of them). From your message,
it looks like you get correct status of
local printers, or am I wrong in assuming so?

a) Since you execute the command lpstat
as root, the permissions of commands are not
crucial part of your problem, unless some very
weird directory permissions on the spooling
directories.

b) If the errors happen for certain remote printers, then the problem is probably on the
remote server that manages the print queues.

For example, remote server (if it is an HP-UX host) might use /var/adm/inetd.sec to manage
access to printer protocol, or
maybe rlpdaemon is disabled in /etc/inetd.conf, or inetd is down, and so on).

c) Make sure that all printers are reachable
(basic check is ICMP test like ping,
or open port 9100 if JetDirect, 515 for standard spoolers, and so on).

I recently had an audit of a customer
who had around 500 printer queues on
HP-UX servers and only around 150 were
active (the rest were obsolete, dead
printers).

Cheers,

VK2COT