Thanks for the patches to linelist.c; they do indeed fix the
coredumps in the worker lpds that we were seeing when running lpc
commands. I've merged them into our 3.6.13 source tree.
>> Yes, this actually was a mistake that was fixed.
>>
>> 'AUTHUSER' was supposed to be the 'end user'
>> 'AUTHFROM' was supposed to be the 'sender' which could be a
>> forwarder OR the 'end user'
>> 'FORWARD' was set when AUTHUSER != AUTHFROM
>>
>> As you say, you probably wanted
>>
>> REJECT AUTHFROM=?* PRINTER=</var/spool/printer/queues.secure NOT
>AUTHFROM=</var/spool/printer/hostkeys.allow
>> REJECT AUTHFROM=?* FORWARD NOT AUTHFROM=</var/spool/printer/hostkeys.allow
I don't believe either of these lines has the intended function. The
first one will clearly reject jobs from users whose Kerberos principals
aren't listed in hostkeys.allow who try to spool jobs to queues listed
in queues.secure. Adding a FORWARD to the first line in addition to the
second was seems correct.
For the record, I am now using the lpd.perms attached below, and are
having the following problems with a 3.6.13 lpd, but not a 3.6.1 lpd:
* lpc commands from users in /var/spool/printer/lpcaccess.top do
not work to queues listed in /var/spool/printer/queues.secure.
They do work to other queues remotely, and lpc to all queues
works as root on the print server.
* No one may remove jobs from a queue listed in
/var/spool/printer/queues.secure; attempts to do so both as the
user who spooled the job and an admin (defined as a user listed
in the lpcaccess.top file) fail. This again works as root on
the server.
Ideally, I would like an lpd.perms file which has identical
semantics to the one I've included below, and will work with both a
3.6.1 server and a 3.6.13 server, to minimize the pain of rolling out
the new version (we have a non-trivial number of people with private
print servers, and cannot mandate a flag day for upgrading).
Any help would be appreciated; falling back to the old meaning of
AUTHFROM/AUTHUSER would be acceptable as well, for now, if you can
provide a pointer to a convenient source patch to do so. IMHO, this
does constitute a semantic change (and you said there weren't any; tsk
tsk), even if it does correct a bug.
Thanks in advance for any help that can be provided.
Garry Zacheiss
MIT I/S, Athena Server Operations
# Allow anybody to connect, get status, list queue, or print (once a
# job is spooled)
ACCEPT SERVICE=X,S,Q,P
ACCEPT LPC=status,lpq,printcap
# Only trust certain host keys to forward jobs/commands
REJECT AUTHFROM=?* PRINTER=</var/spool/printer/queues.secure NOT
AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD
REJECT AUTHFROM=?* AUTHJOB NOT AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD
# Allow root to control and remove jobs
ACCEPT SERVICE=C,R SERVER REMOTEUSER=root
# Allow admins to control and remove jobs
ACCEPT SERVICE=C,R AUTH=USER AUTHUSER=</var/spool/printer/lpcaccess.top
# Printer-specific LPC ACLs
ACCEPT SERVICE=C,R PRINTER=money,money2 AUTH=USER
AUTHUSER=</var/spool/printer/money/lpcaccess
ACCEPT SERVICE=C,R PRINTER=sipb,meadow2 AUTH=USER
AUTHUSER=</var/spool/printer/sipb/lpcaccess
ACCEPT SERVICE=C,R PRINTER=sipb,sipb2 AUTH=USER
AUTHUSER=</var/spool/printer/sipb/lpcaccess
ACCEPT SERVICE=C,R PRINTER=vln,vln2 AUTH=USER
AUTHUSER=</var/spool/printer/vln/lpcaccess
ACCEPT SERVICE=C,R PRINTER=dagger,dagger2 AUTH=USER
AUTHUSER=</var/spool/printer/dagger/lpcaccess
# Reject jobs from unauthorized users to restricted queues
REJECT SERVICE=R PRINTER=rinter,rinter2 NOT
USER=</var/spool/printer/rinter/restrict.list
REJECT SERVICE=R PRINTER=dagger,dagger2 NOT
AUTHUSER=</var/spool/printer/dagger/restrict.list
# Accept authenticated jobs to all other printers
ACCEPT SERVICE=R AUTH=USER,FWD
# Allow authenticated users to lprm their jobs
ACCEPT SERVICE=M AUTH=USER,FWD AUTHJOB AUTHSAMEUSER
# Reject unauthentic print/lprm requests to authenticated queues
REJECT SERVICE=R,M PRINTER=</var/spool/printer/queues.secure
# Reject unauthentic print requests from off MITnet
REJECT SERVICE=R NOT REMOTEIP=</var/spool/printer/masks.allow
# Accept unauthentic print requests if same user and on MITnet
ACCEPT SERVICE=M NOT AUTHJOB SAMEUSER REMOTEIP=</var/spool/printer/masks.allow
# Reject any other lpc, or lprm. Accept all else
REJECT SERVICE=C,M
DEFAULT ACCEPT
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
The address you post from MUST be your subscription address
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
