Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #239299 > unrolled thread

CUPS permissions

Back to article view | Back to linux.debian.user

Contents

  CUPS permissions Peter Ehlert <pb21a@sdi-baja.com> - 2021-08-25 14:50 +0200
    Re: CUPS permissions Henning Follmann <hfollmann@itcfollmann.com> - 2021-08-25 18:30 +0200
      Re: CUPS permissions Peter Ehlert <pb21a@sdi-baja.com> - 2021-08-25 20:50 +0200
        Re: CUPS permissions Greg Wooledge <greg@wooledge.org> - 2021-08-25 21:20 +0200
          Re: CUPS permissions Peter Ehlert <pb21a@sdi-baja.com> - 2021-08-26 14:10 +0200
            Re: CUPS permissions Tixy <tixy@yxit.co.uk> - 2021-08-26 14:30 +0200
            Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 14:40 +0200
              Re: CUPS permissions Greg Wooledge <greg@wooledge.org> - 2021-08-26 15:00 +0200
                Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 17:20 +0200
                Re: CUPS permissions Peter Ehlert <pb21a@sdi-baja.com> - 2021-08-28 16:20 +0200
                Re: CUPS permissions >Fixed Peter Ehlert <peter@sdi-baja.com> - 2021-08-28 16:40 +0200
                  Re: CUPS permissions >Fixed Greg Wooledge <greg@wooledge.org> - 2021-08-28 21:40 +0200
                    Re: CUPS permissions >Fixed Brian <ad44@cityscape.co.uk> - 2021-08-28 22:10 +0200
                  Re: CUPS permissions >Fixed Brian <ad44@cityscape.co.uk> - 2021-08-28 21:40 +0200
            Re: CUPS permissions Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-08-26 14:40 +0200
            Re: CUPS permissions Charles Curley <charlescurley@charlescurley.com> - 2021-08-26 14:50 +0200
    Re: CUPS permissions Keith Bainbridge <keithrboz@gmail.com> - 2021-08-26 01:40 +0200
      Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 14:10 +0200
        Re: CUPS permissions Peter Ehlert <pb21a@sdi-baja.com> - 2021-08-26 15:20 +0200
          Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 16:50 +0200
            Re: CUPS permissions Greg Wooledge <greg@wooledge.org> - 2021-08-26 17:00 +0200
              Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 17:30 +0200
                Re: CUPS permissions Greg Wooledge <greg@wooledge.org> - 2021-08-26 17:40 +0200
                  Re: CUPS permissions "Andrew M.A. Cater" <amacater@einval.com> - 2021-08-26 18:50 +0200
                    Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 21:00 +0200
                  Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 19:30 +0200
                    Re: CUPS permissions <tomas@tuxteam.de> - 2021-08-26 20:20 +0200
                      Re: CUPS permissions Greg Wooledge <greg@wooledge.org> - 2021-08-26 20:30 +0200
                        Re: CUPS permissions <tomas@tuxteam.de> - 2021-08-26 21:00 +0200
              Re: CUPS permissions Brian <ad44@cityscape.co.uk> - 2021-08-26 17:30 +0200

Page 2 of 2 — ← Prev page 1 [2]

#239341

On Thu, Aug 26, 2021 at 03:49:23PM +0100, Brian wrote:
> On Thu 26 Aug 2021 at 06:18:21 -0700, Peter Ehlert wrote:
> 
> [...]
> 
> > > It would be useful to have the outputs of
> > > 
> > >    groups
> > $ groups
> > peter cdrom floppy audio dip video plugdev netdev
> > > 
> > > and
> > > 
> > >    grep SystemGroup /etc/cups/cups-files.conf
> > $ grep SystemGroup /etc/cups/cups-files.conf
> > SystemGroup lpadmin
> > > 
> > > from the OP.
> 
> Follow Keith Bainbridge's advice and add your user to the lpadmin
> group. Edit /etc/group and /etc/group- to do this. I would use 'vigr'
> and 'vigr -s'.

Near as I can tell, /etc/group- is simply a backup copy of /etc/group
and shouldn't be edited.  You might be thinking of /etc/gshadow, which
has something to do with group passwords, which are a thing I have *never*
dealt with in my entire life.

[toc] | [prev] | [next] | [standalone]

#239345

On Thu 26 Aug 2021 at 10:56:55 -0400, Greg Wooledge wrote:

> On Thu, Aug 26, 2021 at 03:49:23PM +0100, Brian wrote:
> > On Thu 26 Aug 2021 at 06:18:21 -0700, Peter Ehlert wrote:
> > 
> > [...]
> > 
> > > > It would be useful to have the outputs of
> > > > 
> > > >    groups
> > > $ groups
> > > peter cdrom floppy audio dip video plugdev netdev
> > > > 
> > > > and
> > > > 
> > > >    grep SystemGroup /etc/cups/cups-files.conf
> > > $ grep SystemGroup /etc/cups/cups-files.conf
> > > SystemGroup lpadmin
> > > > 
> > > > from the OP.
> > 
> > Follow Keith Bainbridge's advice and add your user to the lpadmin
> > group. Edit /etc/group and /etc/group- to do this. I would use 'vigr'
> > and 'vigr -s'.
> 
> Near as I can tell, /etc/group- is simply a backup copy of /etc/group
> and shouldn't be edited.  You might be thinking of /etc/gshadow, which
> has something to do with group passwords, which are a thing I have *never*
> dealt with in my entire life.

I also forgot: after carrying out the corrected procedure, log out and
log back in.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239347

On Thu, Aug 26, 2021 at 04:25:54PM +0100, Brian wrote:
> On Thu 26 Aug 2021 at 10:56:55 -0400, Greg Wooledge wrote:
> 
> > On Thu, Aug 26, 2021 at 03:49:23PM +0100, Brian wrote:
> > > On Thu 26 Aug 2021 at 06:18:21 -0700, Peter Ehlert wrote:
> > > 
> > > [...]
> > > 
> > > > > It would be useful to have the outputs of
> > > > > 
> > > > >    groups
> > > > $ groups
> > > > peter cdrom floppy audio dip video plugdev netdev
> > > > > 
> > > > > and
> > > > > 
> > > > >    grep SystemGroup /etc/cups/cups-files.conf
> > > > $ grep SystemGroup /etc/cups/cups-files.conf
> > > > SystemGroup lpadmin
> > > > > 
> > > > > from the OP.
> > > 
> > > Follow Keith Bainbridge's advice and add your user to the lpadmin
> > > group. Edit /etc/group and /etc/group- to do this. I would use 'vigr'
> > > and 'vigr -s'.
> > 
> > Near as I can tell, /etc/group- is simply a backup copy of /etc/group
> > and shouldn't be edited.  You might be thinking of /etc/gshadow, which
> > has something to do with group passwords, which are a thing I have *never*
> > dealt with in my entire life.
> 
> I also forgot: after carrying out the corrected procedure, log out and
> log back in.

This is the part that I don't quite understand.  How does that matter?
Does the CUPS daemon connect to some already-running process of the
user that you log into the web agent with?  Does that mean you have to
run the web browser *as* the user you plan to use for printer admin, not
just log into the CUPS web agent with that user?

That doesn't sound right, given the fact that you can log into the web
agent as "root" without logging into Linux as root, or running the web
browser as root.

Given the above, I'd expect that the web agent spawns a brand new process
as root, and then inside of that, it drops privileges down to the user
that you specified.

Unless "root" is a special hard-coded exception somehow...?

[toc] | [prev] | [next] | [standalone]

#239348

On Thu, Aug 26, 2021 at 11:31:30AM -0400, Greg Wooledge wrote:
> On Thu, Aug 26, 2021 at 04:25:54PM +0100, Brian wrote:
> > On Thu 26 Aug 2021 at 10:56:55 -0400, Greg Wooledge wrote:
> > 
> > > On Thu, Aug 26, 2021 at 03:49:23PM +0100, Brian wrote:
> > > > On Thu 26 Aug 2021 at 06:18:21 -0700, Peter Ehlert wrote:
> > > > 
> > > > [...]
> > > > 
> > > > > > It would be useful to have the outputs of
> > > > > > 
> > > > > >    groups
> > > > > $ groups
> > > > > peter cdrom floppy audio dip video plugdev netdev
> > > > > > 
> > > > > > and
> > > > > > 
> > > > > >    grep SystemGroup /etc/cups/cups-files.conf
> > > > > $ grep SystemGroup /etc/cups/cups-files.conf
> > > > > SystemGroup lpadmin
> > > > > > 
> > > > > > from the OP.
> > > > 
> > > > Follow Keith Bainbridge's advice and add your user to the lpadmin
> > > > group. Edit /etc/group and /etc/group- to do this. I would use 'vigr'
> > > > and 'vigr -s'.
> > > 
> > > Near as I can tell, /etc/group- is simply a backup copy of /etc/group
> > > and shouldn't be edited.  You might be thinking of /etc/gshadow, which
> > > has something to do with group passwords, which are a thing I have *never*
> > > dealt with in my entire life.
> > 
> > I also forgot: after carrying out the corrected procedure, log out and
> > log back in.

_DON'T_ edit groups / shadow password files by hand unless really, absolutely 
necessary - the potential for mistakes is too high.

adduser [username] lpadmin as root/root equivalent using sudo is all that's 
needed. 

You don't need to reboot to do this: but you might need to log out/log back
in to pick up the added/changed groups for the user. 
> 
> This is the part that I don't quite understand.  How does that matter?
> Does the CUPS daemon connect to some already-running process of the
> user that you log into the web agent with?  Does that mean you have to
> run the web browser *as* the user you plan to use for printer admin, not
> just log into the CUPS web agent with that user?
> 
> That doesn't sound right, given the fact that you can log into the web
> agent as "root" without logging into Linux as root, or running the web
> browser as root.
> 
> Given the above, I'd expect that the web agent spawns a brand new process
> as root, and then inside of that, it drops privileges down to the user
> that you specified.
> 
> Unless "root" is a special hard-coded exception somehow...?
> 

All best, as ever,

Andy Cater

[toc] | [prev] | [next] | [standalone]

#239353

On Thu 26 Aug 2021 at 16:48:14 +0000, Andrew M.A. Cater wrote:

[...]

 
> _DON'T_ edit groups / shadow password files by hand unless really, absolutely 
> necessary - the potential for mistakes is too high.

I suppose finding the line with lpadmin in it and editing it is prone
to mistakes. Heaven help us! vigr is (or was) the recommended utility
to use. It comes in the required package, passwd

> adduser [username] lpadmin as root/root equivalent using sudo is all that's 
> needed. 

That give the OP another technique.

> You don't need to reboot to do this: but you might need to log out/log back
> in to pick up the added/changed groups for the user.

log out/log back is *definitely* necessary. Not "might need to...".

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239349

On Thu 26 Aug 2021 at 11:31:30 -0400, Greg Wooledge wrote:

> On Thu, Aug 26, 2021 at 04:25:54PM +0100, Brian wrote:

[...]

> > I also forgot: after carrying out the corrected procedure, log out and
> > log back in.
> 
> This is the part that I don't quite understand.  How does that matter?

The system needs to be updated on the groups the user is in. CUPS will
consult it.

> Does the CUPS daemon connect to some already-running process of the
> user that you log into the web agent with?  Does that mean you have to
> run the web browser *as* the user you plan to use for printer admin, not
> just log into the CUPS web agent with that user?
> 
> That doesn't sound right, given the fact that you can log into the web
> agent as "root" without logging into Linux as root, or running the web
> browser as root.
> 
> Given the above, I'd expect that the web agent spawns a brand new process
> as root, and then inside of that, it drops privileges down to the user
> that you specified.
> 
> Unless "root" is a special hard-coded exception somehow...?

My understanding is:

1. Administration operations in CUPS require an administrator to
   authenticate.

2. An administrator is either the root user or a member of the
   lpadmin group. The group is distro-specific.

3. Either of the two previous users have to be authorised by
   username/password when the web interface is used. This is not
   the case for lpadmin use.

4. The browser is run as the user. Authentication to CUPS is a
   separate issue.

5. pam comes into this somewhere, but I give up at that point.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#239350

[Multipart message — attachments visible in raw view] — view raw

On Thu, Aug 26, 2021 at 06:24:01PM +0100, Brian wrote:
> On Thu 26 Aug 2021 at 11:31:30 -0400, Greg Wooledge wrote:
> 
> > On Thu, Aug 26, 2021 at 04:25:54PM +0100, Brian wrote:
> 
> [...]
> 
> > > I also forgot: after carrying out the corrected procedure, log out and
> > > log back in.
> > 
> > This is the part that I don't quite understand.  How does that matter?
> 
> The system needs to be updated on the groups the user is in. CUPS will
> consult it.

there is also newgrp(1), that might do it (I haven't tried it explicitly).

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#239351

On Thu, Aug 26, 2021 at 08:16:23PM +0200, tomas@tuxteam.de wrote:
> On Thu, Aug 26, 2021 at 06:24:01PM +0100, Brian wrote:
> > On Thu 26 Aug 2021 at 11:31:30 -0400, Greg Wooledge wrote:
> > 
> > > On Thu, Aug 26, 2021 at 04:25:54PM +0100, Brian wrote:
> > 
> > [...]
> > 
> > > > I also forgot: after carrying out the corrected procedure, log out and
> > > > log back in.
> > > 
> > > This is the part that I don't quite understand.  How does that matter?
> > 
> > The system needs to be updated on the groups the user is in. CUPS will
> > consult it.
> 
> there is also newgrp(1), that might do it (I haven't tried it explicitly).

Do what?  What's "it"?

Why would opening a shell with a new set of group privileges inside your
interactive session change how a daemonized CUPS web agent acts?

Logging out and back in is necessary for ensuring that your interactive
shells, your word processors, your web browsers, and so forth, are running
with your newly acquired privileges.  But we're not running printer
administration commands from the shell here, so our shell doesn't actually
need these privileges, as far as I can see.

(If you were in fact going to try disabling/enabling/adding printers
from the shell, then yeah.  Logging out and back in, or running
"exec su - $LOGNAME" or an equivalent command in one of your shells, would
be a good starting point.)

[toc] | [prev] | [next] | [standalone]

#239354

[Multipart message — attachments visible in raw view] — view raw

On Thu, Aug 26, 2021 at 02:26:54PM -0400, Greg Wooledge wrote:
> On Thu, Aug 26, 2021 at 08:16:23PM +0200, tomas@tuxteam.de wrote:
> > On Thu, Aug 26, 2021 at 06:24:01PM +0100, Brian wrote:
> > > On Thu 26 Aug 2021 at 11:31:30 -0400, Greg Wooledge wrote:
> > > 
> > > > On Thu, Aug 26, 2021 at 04:25:54PM +0100, Brian wrote:
> > > 
> > > [...]
> > > 
> > > > > I also forgot: after carrying out the corrected procedure, log out and
> > > > > log back in.
> > > > 
> > > > This is the part that I don't quite understand.  How does that matter?
> > > 
> > > The system needs to be updated on the groups the user is in. CUPS will
> > > consult it.
> > 
> > there is also newgrp(1), that might do it (I haven't tried it explicitly).
> 
> Do what?  What's "it"?
> 
> Why would opening a shell with a new set of group privileges inside your
> interactive session change how a daemonized CUPS web agent acts?

I haven't looked into it. I don't even want to know how the client
passes the creds to the server (if at all) [1]. It seems (is it
confirmed?) that belonging to some group (lpadmin?) does the trick.

> Logging out and back in is necessary for ensuring that your interactive
> shells, your word processors, your web browsers, and so forth, are running
> with your newly acquired privileges [...]

That's the part I was proposing newgrp might "do", instead of logging
in anew.

Cheers

[1] I fear I'd get some depression if it is like that and I
   find out ;-)

 - t

[toc] | [prev] | [next] | [standalone]

#239346

On Thu 26 Aug 2021 at 10:56:55 -0400, Greg Wooledge wrote:

> On Thu, Aug 26, 2021 at 03:49:23PM +0100, Brian wrote:
> > On Thu 26 Aug 2021 at 06:18:21 -0700, Peter Ehlert wrote:
> > 
> > [...]
> > 
> > > > It would be useful to have the outputs of
> > > > 
> > > >    groups
> > > $ groups
> > > peter cdrom floppy audio dip video plugdev netdev
> > > > 
> > > > and
> > > > 
> > > >    grep SystemGroup /etc/cups/cups-files.conf
> > > $ grep SystemGroup /etc/cups/cups-files.conf
> > > SystemGroup lpadmin
> > > > 
> > > > from the OP.
> > 
> > Follow Keith Bainbridge's advice and add your user to the lpadmin
> > group. Edit /etc/group and /etc/group- to do this. I would use 'vigr'
> > and 'vigr -s'.
> 
> Near as I can tell, /etc/group- is simply a backup copy of /etc/group
> and shouldn't be edited.  You might be thinking of /etc/gshadow, which
> has something to do with group passwords, which are a thing I have *never*
> dealt with in my entire life.

Thanks for picking up on this; you are completely correct. I did not
check the name of the file 'vigr -s' opens. The OP may not want to
us vigr, so it is important to have the correct file names (/etc/group
and /etc/gshadow).

-- 
Brian.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web