Who is messing with cupsd.conf ?

holstebroe · #1 25th September 2005, 01:04 PM

Something is messing with my cupsd.conf all the time. I have disabled cups-config-daemon since I was unable to find any documentation for this thing. I have checked that it is not running, but every time I turn on my printer on my fedora server the cupsd.conf gets changed. And this is appended to the end:

Code:

<Location /printers/psc-2100-series--1>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
AuthType None
</Location>
Browsing On
BrowseProtocols cups
BrowseOrder Deny,Allow
BrowseAllow from @LOCAL
Listen 127.0.0.1:631

Autodetecting my printer is not a bad thing, but it only listens to 127.0.0.1 which makes the printer useless since it's connected to a server.

I see two solutions:
Stop the thing that changes my cupsd.conf
Make the thing that changes my cupsd.conf do some correct changes at least

I have not been able to find good documentation about and I have not experienced this problem before on SuSE or Gentoo distributions. Is Fedora suitable for a file/printer server at all or should I switch back to SuSE ? (I switched to Fedora after a HD crash just to try it out, but so far I must say that I prefer the ease of SuSE or Gentoo).

***Firewing1*** · #2 25th September 2005, 01:40 PM

It always does this. I use HPLIP, the HP Linux Pritning off their website. It uses a web hp:// protocall. Even though it's networked, my HP DJ 5550 still appears as a local printer and a web printer (it adds twice, like you said). Just (as root) go to http://localhost:631 and set the default printer to the one you want, ignore the other.
Firewing1

holstebroe · #3 25th September 2005, 05:14 PM

I can live with the extra printer device, but the problem is the line:

Code:

Listen 127.0.0.1:631

If I'm correct, this forces cups to listen only to connections from localhost, but I want to be able to print from any computer in my network. If I manually change the line to listen 631 it works, but as soon as I reconnect the usb-printer, the line is changed to listen 127.0.0.1:631 again. I can easily setup the cupsd.conf file manually, so what I really want is Fedora to stop messing with my config files or at least let me tell Fedora what to put into cupsd.conf automatically.
In SuSE there is a sysconfig folder under /etc where templates for "automatic" configurations are. Is there some similar way in Fedora to control the behavior of the auto-configuration ?
To me this smells like a Microsoft solution. Make some semi-intelligent agent take guesses at what the users want, but make it damn hard to change default behavior (in my case, printing from a client machine over network).

***Firewing1*** · #4 26th September 2005, 03:05 PM

so don't change it; add a new line underneath it
Firewing1

holstebroe · #5 26th September 2005, 03:45 PM

I doubt this will work. I can only imagine that cups will complain about the port already being taken. I haven't tried it yet, but that is what happens if I have a listen line before the automatically updated lines. What I really want is to stop Fedora from messing with my config files or at least change the way it does that. How can I do that ?

Twey · #6 26th September 2005, 05:12 PM

If you're sure you won't need it to, you can make it immutable with chattr +i /etc/cups/cupsd.conf. However, cupsd may have a temper tantrum over not being able to edit its config file.

holstebroe · #7 27th September 2005, 07:53 AM

I would rather avoid a hack like an attribute change of cupsd.conf. There must be a way for me to allow other hosts than localhost to connect to cups.
Who changes the cupsd.conf file ?
Where can I find the templates / configuration / documentation for the automatic changes ?
How can I stop the automatic changes ? There _must_ be a proper way, other distributions don't have this behavior.
I have not installed X on the server. Is this a mistake, I mean, am I missing important GTK tools for configuring the system ?

StephenH · #8 27th September 2005, 08:09 AM

I have been fighting with cups since I installed FC4 on my laptop. I already had it on my desktop system. I FINALLY got my laptop to print on the printer connected to the desktop system.

I wound up totally disabling SELINUX and the firewall on both systems. It then printed. Afterward, I could reenable both SELINUX and the firewall on both, and it kept printing. Of course, today's updates included a new update to selinux, and it immediately stopped working again. I had to repeat the process all over again to get it to work.

Why is SELINUX getting in the way of something so simple as printing anyway? It is quite frustrating.

Stephen

holstebroe · #9 27th September 2005, 08:16 AM

This sounds like the easiest solution for me is to kick out Fedora and reinstall SuSE which I am more familiar with.

StephenH · #10 27th September 2005, 08:29 AM

Quote:

Originally Posted by holstebroe

This sounds like the easiest solution for me is to kick out Fedora and reinstall SuSE which I am more familiar with.

I don't mean to discourage you. Things like this seem to be part and parcel of living on the (b)leading edge. One of these days, the updates probably will not cause the problem I experienced.

SuSE is nice from the short look I had at it, but I had problems with it too. So far overall, FC4 has behaved quite well. SELinux should make things more secure, especially if I were to take my laptop on the road and have to use a dialup connection. That would then test the system's security much more than now, when I am sitting behind a hardware firewall.

Regards,

Stephen

holstebroe · #11 27th September 2005, 08:45 AM

I have really simple needs for my fileserver. It should just run plain stable nfs, samba, apache, php, mysql, postgresql and cups. I run Gentoo on my client computer which is indeed bleeding edge, but with a very supportive community forum. For my fileserver I rather want the most no-hassle distribution I can get; something like Knoppix.

***Firewing1*** · #12 27th September 2005, 09:34 PM

well, have your tried to connect from another computer? To do this you have to 1) disable SELinux and 2) add 631:tcp, 631:udp to your firewall open ports.
Firewing1

***Firewing1*** · #13 28th September 2005, 09:43 PM

SE Linux is overrated. It is a super-security module that gives you a pain. Disable it unless you run a server. Local CUPS should not represent a security hazard. Even me, I run a HTTPD server (or used to) and never had SELinux enabled. I was fine. Also, type system-config-securitylevel to add ports to ur Firewall.
Firewing1

StephenH · #14 29th September 2005, 05:26 AM

Quote:

Originally Posted by Firewing1

SE Linux is overrated. It is a super-security module that gives you a pain. Disable it unless you run a server. Local CUPS should not represent a security hazard. Even me, I run a HTTPD server (or used to) and never had SELinux enabled. I was fine. Also, type system-config-securitylevel to add ports to ur Firewall.
Firewing1

It may be overrated, but for my laptop, I would prefer to keep it enabled since I am a bit paranoid and want the extra security. What I really NEED though is instructions on just what to configure in SELinux to allow printing without having to go through the hoops of disabling and reenabling it each time yum downloads a new security patch.

Better yet, I guess I need to file a report somewhere so those who build the security patches can set the defaults to allow cups printing.

Regards,

Stephen