Re: The Horror Of CUPS. In Eric S. Raymond's Own Words.

From: Jim Richardson (warlock_at_eskimo.com)
Date: 03/03/05 

Date: Thu, 3 Mar 2005 13:38:22 -0800

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 3 Mar 2005 15:05:17 GMT,
 Bill Unruh <unruh@string.physics.ubc.ca> wrote:
> Jim Richardson <warlock@eskimo.com> writes:
>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>
>>On 2 Mar 2005 21:46:58 GMT,
>> Bill Unruh <unruh@string.physics.ubc.ca> wrote:
>>> Mart van de Wege <mvdwege.usenet@wanadoo.nl> writes:
>>>
>>>>ESR was right in his condemnation of CUPS. It *is* hard to set up a
>>>>network printer, whether you use the provided distro tools or the
>>>>http://localhost:631 interface.
>>>
>>> It depends on what you mean by a networked printer. If it is a printer
>>> which does lpd protocol, which most standalone network printers do, then
>>> the setup is not hard. As has been said various distros have tools which
>>> does most of the job for you.
>>>
>
>
>>What to you mean by a printer that "does the lpd protocol"? lpd is the
>>daemon that spools to the printer, it's not a protocol, unless you mean
>>something else.
>
> LPD is a specific protocol for connection-- through the printer service
> port I believe it is. It is how one machine can transfer printer jobs to
> another machine. lpd impliments the protocol.
>

interesting, I had not heard of this. (not that unusual though :)

>>> But I have run into some real holes. I have a somewhat unusual situation--
>>> a network at a Uni with loads of different things on the net, including
>>> different printers.
>>>
>>> a) How do you make a printer the default printer. Cups itself (it may have
>>> changed in the latest incarnation-- I last looked at their :631 web based
>>> about a year ago) does not give you a way to do it. And there is nothing in
>>> the docs which tells you what you can change in which file to do it.
>>> Mandrake's printerdrake does allow you to do it.
>
>>CUPS doesn't do this, as the cupsd daemon may be running on a machine in
>>which you have no access (other than printing) to. It would be silly to
>>have CUPS constrol the default printer for any and all folks who use the
>>printers, since they may have different choices for default options.
>
> ??? Cups DOES do this. It is just that they do not allow you to set it up
> via their setup service. Ie, the cups running on machine A can be set up to
> regard printer X as the default, the printer to which stuff is sent if lp
> is run with no -d options. And it certainly does make sense to do this on a
> machine wide basis.
>

You are talking (it seems) of the local client side, not the server
side, which is what I thought you meant. Yes, cups can replace the lp
command, and direct it wherever you set it up.

>
>>Instead, the print system on your machine (whichever one that is) is the
>>one that controls this. For example, on this Ubuntu laptop, (which
>
> Yes. That print system is called cups.
>
>>prints via a different machine) GNOME controls this, via the
>>gnome-cups-manager app. The name is a tad misleading, as it can sent
>
> No it is cups, with the gnome manger a gui interface to cups.
>
>>print jobs to many printers, controlled by other systems than CUPS.
>
> Of course. That is how cups works.
>
>>>
>>> b) How do you stop your printer being advertised to other people's
>>> machines. Having your printer advertised for use by people in other groups
>>> is NOT something you want to do-- I pay for the expenses, not they for one
>>> thing. HOw do you set up cups so that your printer is only advertised to
>>> the group of machines you want it to be advertised to. Again there seems
>>> nothing in either cups or in printerdrake which allows you to set this up.
>>> I think I have discovered how-- by editing /etc/cups/cupsd.conf and in
>>> particular setting up the BrowseAddress , the <Location /printers> Allow
>>> addresses.
>
>>via cupsd.conf on the print server. (whichever machine is running the
>>cupsd. ) man cupsd.conf for details, but essentially, a section in the
>>file something like this
>
> No, cupsd.conf is not well documented. and you should NOT have to go
> rooting around in cusd.conf to set this up.
> What "Browse" means is never well defined (it actually means to eat grass
> and other forage from all over a fields, which is not very helpful in this
> context) and how Browse refers to outgoing
> or incoming printers is certainly not well defined. I figured it out by
> trial and error, and that should NEVER be the way a system should be set
> up. I should be able to in the cups web interface, be able to tell cups "Do
> not ever listen to this printer from this server." or" Do not let this
> client ever print on the local printer" Or "Do not reexport printers which
> you have gotten off the web"
>
>><Location />
>>Order Deny,Allow
>>Deny From All
>>Allow From 127.0.0.1
>></Location>
>
>
>>You can add another ip (or range, or hostname, etc) to the Allow From
>>section, or you can use auth methods like password/username, ssl, etc.
>>The docs explain it rather thoroughly. The man pages are a brief precis.
>
> Of course you can. By why in the world would permission to location / be
> the key to allowing or not other machines to print on your printer? And why
> should BrowseAllow be the key to restricting your machine from printing on
> other printers? Neither of these are documented, and neither are set up by
> the complex web setup gui.
>

location / is all printers serviced by that server. You can also
restrict it to a given printer, with the appropriate naming. For
example,

<Location /printers/big_honking_calcomp>

will control access to that big plotter I have always wanted.

<http://www.cups.org/doc-1.1/sam.html#Location>

>
>
>>> c) if other people are careless and advertise their printer all over the
>>> place, how do you stop those machine from appearing in your list of
>>> printers. (Note that if you use OpenOffice it will test each and every one
>>> of those printers, and if one of them does not work, openoffice will freeze
>>> perhaps forever.
>>>
>
>>By default, all the distro's I have tried with CUPS, don't allow
>>non-local users to print, they don't listen on the network connection,
>>only on localhost. You have to activate network accessible printing in
>>some fashion.
>
> Yes, and if you do you get ALL printers from everywhere being advertised on
> your machine. So there you have 50 printers all advertised, of which you
> are only "allowed" to use two of them. (allowed by the rules of who owns
> the printers and whose offices they are in, since allowing or denying them
> within cups is apparently a secret. )

Hardly a secret. Google found it for me. It would be nice if it were in
the docs a little more clearly, but it's easily discoverable.

>
>
>
>
>
>>> Here you seem to need the BrowseAllow option. Note that none of this is
>>> listed in the docs. YOu have to intuit which amongst th Browse options are
>>> really for incoming and which for outgoing stuff.
>>>
>
>>I find the cupsd.conf quite well commented. For example
>
>># BrowseAddress: specifies a broadcast address to be used. By
>># default browsing information is not sent!
> oWhat does Browse mean? Sent to whom? Why is my client sending any info?
> How do I restrict to whom my server sends stuff?

Not sure I understand the question really. When one talks about sending
something, one is generally (absent other contextual info) talking about
sending it one's self...

I didn't want to quote huge chunks of the cupsd.conf, but the next bit
might help.

<quote>

#
# BrowseAddress: specifies a broadcast address to be used. By
# default browsing information is not sent!
#
# Note: HP-UX does not properly handle broadcast unless you have a
# Class A, B, C, or D netmask (i.e. no CIDR support).
#
# Note: Using the "global" broadcast address (255.255.255.255) will
# activate a Linux demand-dial link with the default configuration.
# If you have a LAN as well as the dial-up link, use the LAN's
# broadcast address.
#
# The @LOCAL address broadcasts to all non point-to-point interfaces.
# For example, if you have a LAN and a dial-up link, @LOCAL would
# send printer updates to the LAN but not to the dial-up link.
# Similarly, the @IF(name) address sends to the named network
# interface, e.g. @IF(eth0) under Linux. Interfaces are refreshed
# automatically (no more than once every 60 seconds), so they can
# be used on dynamically-configured interfaces, e.g. PPP, 802.11, etc.
#
</quote>

>
>
>
>
>
>>> And Certainly Mandrake does not allow you to control this stuff from
>>> printerdrake.
>>>
>>> Cups has a lot of problems. The main one is that the docs are written by
>>> people who designed the system, always a disaster since they carry all
>>> their knowledge and presumptions into writing the docs.
>>>
>
>>This is a common complaint really, and is justified. But the data you
>>seek for CUPS is there, it just takes a bit of work to tease it out
>>sometimes. Cups isn't perfect, and the docs especially, could use some
>>work, but it works very well, and has served me well in several systems.
>
> I never said it does not work, nor did Raymond. What we said was that it
> was terribly documented and the setup "help " was poorly designed.
>

Agreed in part, however, it's neither as hard as it's being made out to
be, nor is it static, it *has* improved since ESR's well deserved rant,
and it will likely continue to do so.

>
>>Although I also like lprng, and find it far simpler, if less flexible,
>>to setup. But Ubuntu does a good job of setting cups up for local use,
>>and a quick look at their faq has all the info needed to setup the
>>daemon for network printing.
>
> Maybe. But the number of people who use Ubuntu is small.

So what?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFCJ4PNd90bcYOAWPYRAtYfAKCTnDfbRGisNS7yYFdU4N/sMEhFNgCgqIl0
+7SPH2V9sVHB1JShZf6g3CI=
=HjiE
-----END PGP SIGNATURE----- 

-- 
Jim Richardson     http://www.eskimo.com/~warlock
 In questions of science the authority of a thousand is not worth the
humble reasoning of a single individual.
    --Galileo

Relevant Pages

  • RE: e-mail scan
    ... many different virus programs, and also has a good web interface for maintaining the system. ... daemon, and teh MTA receives the mail, passes it to ... > I run MailScanner and love it, but I'll never say Amavis is bad, since I ...
    (RedHat)
  • Re: Interaction between ipfw, IPSEC and natd
    ... > Just sort of thinking out loud here, would some kind of daemon (or ... > interface, like pipsecd does, but use the kernel's IPSec facility to ... I think so - but I don't see why a daemon whould be necessary. ...
    (FreeBSD-Security)
  • Re: F6C800-UNV Belkin UPS?
    ... I think I recall that Fedora Linux also had an application to interface ... I use apsupsd with an APC device. ... page claims the daemon works with others. ...
    (Fedora)
  • Re: removing virtual IPs in solaris 10
    ... unplumbing the whole stack of aliases and primary interface or rebooting. ... Unix wouldn't signal the app daemon process that an interface is ... I would stop/restart any daemons listening on the virtual interfaces ...
    (comp.unix.solaris)
  • Re: Different behavior of pinging INADDR_BROADCAST?
    ... interface that is specified via its broadcast address. ... taking "local hardware network" to be the specific interface that is to be ... And a patch for 'ping' should be applied ...
    (freebsd-net)