setup Print Queue and do the Security aspects restrict access

[Gary L]

Hi

I wanna setup a printer queue(lp1) on a HP-UX server(server1). Make it print the reports to a remote server(server2)'s printer (lp2) and restrict access for the security aspects as the customer requirements.

whether the steps are:
on server1:
run "sam" - "add remote printer/plotter" Printer Name: lp1
Remote System Name: server2
Remote Printer Name: lp2
[ ] Remote Printer is on a BSD System check or not?

(The lp2 printer already be setup on server1.)

whether I should do some work in /etc/hosts of server1, vi /etc/hosts then add IP of printer hostname aliases. If yes, the IP of printer is lp1 or lp2, the hostname is server1 or server2?

whether I should do the follow, assign a print queue to a printer?
lpadmin -p lp1 -I any -s lp1

The important part is HOW TO SETUP THE RESTRICT ACCESS TO THE QUEUE FOR SECURITY?

thank a lots

[OldSchool · Accepted solution]

insufficient information.

What Operation Systems are you talking about, particularly for Server 2?

Is the printer a JetDirect printer or not?

What do you mean by "Setup the restrict access to the queue for security"? What are you trying to "restrict" (ie. only certain users can print to it, only certain users can delete jobs or what? Depending on what you mean, it may *not* be possible)

[Gary L]

Hi Oldschool

thank you very much for your fast apply.
server1 is HP-UX rp5470 HP-UX 11.11 OS
server2 is a windows workstation Win2003.
Printer is Lexmark T522

"etup the restrict access to the queue for security" is our customer's requirements. I think, they wanna restrict someone or some jobs, only specified print job could access this new print queue (I guess). I have no idea how to do the securit aspects that they need to restrict access to it.

[OldSchool]

For starters, somebody is going to have to define the "customer requirements" regarding "restrict access". Without a definition the request is worse than meaningless. How can *you* implement something if you don't know what it is? How could anyone help, if they don't know what it is you want to accomplish?

The LexMark can be used as a JetDirect printer if it meets one of the following:
a) a jetdirect card is installed or
b) it is connected to an external JetDirect print server.

Is either of above true? If so, you will need either the IP address or its DNS name. It can then set it up using the "add network printer" option in "sam" (or "hppi" command), and you won't have to mess w/ remote printing.

If neither is true, then you are stuck w/ remote printing.
In this case:
The "printer name" is what you want to call it on "server1", in your example, it is "lp1".
The "Remote System Name" is either "server2" or the IP address of "server2". (If you can't ping it by name, you can either add it to /etc/hosts or DNS as appropriate for your site. Do this *before* you attempt to config the printer).
The "Remote Printer Name" is the printer name as it is defined on "server2".
Since it (server2) is a windows server, I believe the "BSD" box should be checked, but I can't confirm that (Do a search on "network printer" here and you'll find more info regarding this). Note that the Windows server may need to be configured for LPR printing services as well.

Note that "remote printing" does not allow most options to be passed from Unix to Windows. The print will come out using the defaults for fonts and such as specified on the Windows machine. JetDirect is the preferred method if it is available. man "net_lj4x" for info on what options are available when using the "network printer" option.

Also, I've never run into a situation where I needed to restrict access to a printer based on application or userid. Their is nothing "built in" to HP-UX that would implement this that I am aware of (but I could be wrong)

[Gary L]

Hi OldSchool

Thank you very much for your detail explainations and steps.
I have discussed with my customers just now, their security requirements are: I should do some restrict job and work in server1 hp-ux server to deny other people print their job to this new print queue and allow specified people use this print queue. They don't wanna do any restrict on Windows side. In other words, If the guy who is denied run the command lp lp1 then HP-UX should respond a warnning message and restrict this print job.
How to do it??

Thanks a lot!

[A. Clay Stephenson]

Ok, this shouldn't be too difficult but I don't intend to script this fix for you; that would be doing you no favors. I will give you the essential data to complete your task.

Have a look at the interface file, /var/spool/lp/interface/myprinter.

When lp is called, this interface file (which is almost always a shell script) is supplied with a number of fixed parameters plus some optional parameters:

${1} --- request_id e.g. 'myprinter_999'
${2} --- user e.g 'mickey'
${3} --- title (often simply "")
${4} --- ncopies -- number of copies
${5} --- options
${6} --- filename to be printed

All you really have to do is see if the user ${2} is in some file that lists allowed users; if so take no action and let the interface file do it's thing otherwise send mail to user and immediately exit with a value of 1-127. In fact, lp will normally automatically notify the user that there was a problem -- so the mail may be optional. Exiting with a value in the 1-127 range will not disable future requests.

If you exit with a 129 status, the printer will be disabled. Note, that I skipped 128 -- this was intentional. 128 and values > 129 are reserved.

Now, doesn't this sound like a nice homework assignment for a budding young scripting genius?

[Gary L]

Hi A.Clay Stephenson

I will write a script for fixing the restriction task according as your suggestions and steps.

Yes, this is a nice homework assignment, when do you post the answer?

Happy weekend

-Gary

[Gary L]

Hi A.Clay Stephenson, thank you very much for your kindly helps.

[Bill Hassell]

Perhaps the word "security" is incorrect. It sounds like one department is paying for the new printer (toner, paper, repair, etc) and doesn't want anyone else printing on "their" printer. Don't worry, such corporate ownership is very common and rather than solve the problem with cooperation and courtesy, sysadmins are forced to solve social problems with scripts and programs. Another solution is to write an lp wrapper script which checks lp commands for the private printer then verifies the user ID.

[Gary L]

Hi Bill

Yes, you are totoal 100% correct on our "security" thing. This requirement is applied by one of our develop team. Sigh!
I think, you once done this thing before right?
Would you please give me some detail of how to write the wrapper script.
thanks a lot

[Bill Hassell]

A wrapper is just a name for a script or program that is named the same as another process and adds some additional functionality. This is an ultra-simple script to trap the name of the special printer, compare it with a list of users that are allowed access and rejects all others. A determined user will figure out a way around this wrapper so Clay's suggestion would be required when this happens.

#!/usr/bin/sh
set -u

# list of privileged users
set -A SPECUSERS billh julie jsb123 root
# special printer
SPECPRN=lp1234

# current userID
MYID=$(id -un)
[ $# -eq 0 ] && LPPARMS="" || LPPARMS="$@"

PRN=""
while getopts ":d:" OPTCHR
do
case $OPTCHR in
d) PRN=$OPTARG ;;
*) ;;
esac
done

if [ "$PRN" = $SPECPRN ]
then
for USERCHK in ${SPECUSERS[@]}
do
[ $USERCHK = $MYID ] && exec lp "$LPPARMS"
done
print -u2 "\n$MYID not allowed access to $SPECPRN\n"
exit 1
fi
exec lp "$LPPARMS"



Now this script is going to replace /usr/bin/lp and the original lp command will be renamed lp.orig in the same directory. To make sure the script has the same permissions, do these commands:

(copy-paste the above script into a temp file)
(edit the script to set the usernames and printer name)
cp -p /usr/bin/lp /usr/bin/lp.orig
cp temp-file /usr/bin/lp

Then try printing as an invalid user and then as an authorized user. NOTE: this is just a simple wrapper for lp. It will do nothing for programs that use system calls for printing. To cover that possibility, you need to use Clay's example above.

[Dennis Handly]

>Bill: cp -p /usr/bin/lp /usr/bin/lp.orig

Any reason you don't move it aside? If you are worried about someone trying to use lp while it is being replaced, you should use ln(1).

>It will do nothing for programs that use system calls for printing.

(How do you even do that?) Won't that bypass Clay's changes too?

[Gary L]

Hi buddies

Hi

Firstly, I'm gonna say thank you very much for your helps oldSchool, A.Clay Stephenson, Bill Hassell and Dennis Handly.
But I think, there will be some risks on changing OS command and probably, I could not got the approval of our Change Management Team. So, I post a new thread asking whether I could use "ACL" to do the print queue restiction?
If you have any good suggestions and recommendations, it will be appreciated.

[A. Clay Stephenson]

ACL's could work in a wrapper environment but you've already ruled that out. The lp subsystem is extremely sensitive to file mode and ownership. The underlying files have to be owned by the user lp so there is no changing the ownership or ACL's at the lpsubsystem level.

The method I described of changing the interface file would not be considered an OS or command change; in fact, it is very common to have to modify interface files after they are first copied from their model, original versions. For example, you might want to default printing from tray 3. That would be an interface file change. It's rather common to setup multiple print queues using a common physical printer and the different default behaviors of these queues is governed by changes in the interface file --- again, a normal expected sysadmin task that raises no security audit concerns.

It has taken me at least 10 times longer to explain this than would be required to actually implement this feature; it's the least evil way to do this so get to it.

Of course, the really dumb part of this request is that it is not a computer problem at all; it it a people problem.

[Gary L]

Hi A.Clay Stephenson

Thank you very much for your suggestions. Through testing, I think ACL method doeson't work or could not work well. Yes, "lp" is extremely sensitive to file mode and ownership, if I change the print queue to 444 and did setacl u:, the printer became "down" when I sent a print job in it.

I think, I should go back to your suggestion to do some on interface file.

Happy weekend

-Gary

[Gary L]

Hi A.Clay Stephenson

Would you please take a look this thread next week sometime. As I wanna do some on interface file, probably, I will have some questions.
thank you very much again.

[OldSchool]

Gary,

Clay may not look at this again since it has a "bunny" attached.

You may want to just post your question in another thread, with a link back to this.

if not, I can try and help

[Gary L]

Hi OldSchool

I have added a link to this thread from my "ACL" thread. And I have closed "ACL" thread also. "ACL" doen't fit for print filesystem.
I have been doing the interface file of lp now.
Thanks for your kindly help.

Have a great day

-Gary