Hi, I am back in the office. Did you resolve this?
Patrick Powell
> From [EMAIL PROTECTED] Tue Nov 7 22:30:04 2000
> To: [EMAIL PROTECTED]
> Subject: Re: LPRng: segfault, semantics changes?
> Date: Wed, 08 Nov 2000 00:23:48 -0500
> From: Garry Zacheiss <[EMAIL PROTECTED]>
>
> Thanks for the patches to linelist.c; they do indeed fix the
> coredumps in the worker lpds that we were seeing when running lpc
> commands. I've merged them into our 3.6.13 source tree.
>
> >> Yes, this actually was a mistake that was fixed.
> >>
> >> 'AUTHUSER' was supposed to be the 'end user'
> >> 'AUTHFROM' was supposed to be the 'sender' which could be a
> >> forwarder OR the 'end user'
> >> 'FORWARD' was set when AUTHUSER != AUTHFROM
> >>
> >> As you say, you probably wanted
> >>
> >> REJECT AUTHFROM=?* PRINTER=</var/spool/printer/queues.secure NOT
>AUTHFROM=</var/spool/printer/hostkeys.allow
> >> REJECT AUTHFROM=?* FORWARD NOT AUTHFROM=</var/spool/printer/hostkeys.allow
>
> I don't believe either of these lines has the intended function. The
> first one will clearly reject jobs from users whose Kerberos principals
> aren't listed in hostkeys.allow who try to spool jobs to queues listed
> in queues.secure. Adding a FORWARD to the first line in addition to the
> second was seems correct.
>
> For the record, I am now using the lpd.perms attached below, and are
> having the following problems with a 3.6.13 lpd, but not a 3.6.1 lpd:
>
> * lpc commands from users in /var/spool/printer/lpcaccess.top do
> not work to queues listed in /var/spool/printer/queues.secure.
> They do work to other queues remotely, and lpc to all queues
> works as root on the print server.
>
> * No one may remove jobs from a queue listed in
> /var/spool/printer/queues.secure; attempts to do so both as the
> user who spooled the job and an admin (defined as a user listed
> in the lpcaccess.top file) fail. This again works as root on
> the server.
>
> Ideally, I would like an lpd.perms file which has identical
> semantics to the one I've included below, and will work with both a
> 3.6.1 server and a 3.6.13 server, to minimize the pain of rolling out
> the new version (we have a non-trivial number of people with private
> print servers, and cannot mandate a flag day for upgrading).
>
> Any help would be appreciated; falling back to the old meaning of
> AUTHFROM/AUTHUSER would be acceptable as well, for now, if you can
> provide a pointer to a convenient source patch to do so. IMHO, this
> does constitute a semantic change (and you said there weren't any; tsk
> tsk), even if it does correct a bug.
>
> Thanks in advance for any help that can be provided.
>
> Garry Zacheiss
> MIT I/S, Athena Server Operations
>
> # Allow anybody to connect, get status, list queue, or print (once a
> # job is spooled)
> ACCEPT SERVICE=X,S,Q,P
> ACCEPT LPC=status,lpq,printcap
>
> # Only trust certain host keys to forward jobs/commands
> REJECT AUTHFROM=?* PRINTER=</var/spool/printer/queues.secure NOT
>AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD
> REJECT AUTHFROM=?* AUTHJOB NOT AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD
>
> # Allow root to control and remove jobs
> ACCEPT SERVICE=C,R SERVER REMOTEUSER=root
>
> # Allow admins to control and remove jobs
> ACCEPT SERVICE=C,R AUTH=USER AUTHUSER=</var/spool/printer/lpcaccess.top
>
> # Printer-specific LPC ACLs
> ACCEPT SERVICE=C,R PRINTER=money,money2 AUTH=USER
>AUTHUSER=</var/spool/printer/money/lpcaccess
> ACCEPT SERVICE=C,R PRINTER=sipb,meadow2 AUTH=USER
>AUTHUSER=</var/spool/printer/sipb/lpcaccess
> ACCEPT SERVICE=C,R PRINTER=sipb,sipb2 AUTH=USER
>AUTHUSER=</var/spool/printer/sipb/lpcaccess
> ACCEPT SERVICE=C,R PRINTER=vln,vln2 AUTH=USER
>AUTHUSER=</var/spool/printer/vln/lpcaccess
> ACCEPT SERVICE=C,R PRINTER=dagger,dagger2 AUTH=USER
>AUTHUSER=</var/spool/printer/dagger/lpcaccess
>
> # Reject jobs from unauthorized users to restricted queues
> REJECT SERVICE=R PRINTER=rinter,rinter2 NOT
>USER=</var/spool/printer/rinter/restrict.list
> REJECT SERVICE=R PRINTER=dagger,dagger2 NOT
>AUTHUSER=</var/spool/printer/dagger/restrict.list
>
> # Accept authenticated jobs to all other printers
> ACCEPT SERVICE=R AUTH=USER,FWD
> # Allow authenticated users to lprm their jobs
> ACCEPT SERVICE=M AUTH=USER,FWD AUTHJOB AUTHSAMEUSER
>
> # Reject unauthentic print/lprm requests to authenticated queues
> REJECT SERVICE=R,M PRINTER=</var/spool/printer/queues.secure
>
> # Reject unauthentic print requests from off MITnet
> REJECT SERVICE=R NOT REMOTEIP=</var/spool/printer/masks.allow
>
>
> # Accept unauthentic print requests if same user and on MITnet
> ACCEPT SERVICE=M NOT AUTHJOB SAMEUSER REMOTEIP=</var/spool/printer/masks.allow
>
> # Reject any other lpc, or lprm. Accept all else
> REJECT SERVICE=C,M
> DEFAULT ACCEPT
>
> -----------------------------------------------------------------------------
> YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
> The address you post from MUST be your subscription address
>
> If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
> or lprng-digest-requests) with the word 'help' in the body. For the impatient,
> to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
> with: | example:
> subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
> unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
>
> If you have major problems, send email to [EMAIL PROTECTED] with the word
> LPRNGLIST in the SUBJECT line.
> -----------------------------------------------------------------------------
>
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
The address you post from MUST be your subscription address
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
