> From [EMAIL PROTECTED] Mon Dec 17 22:16:51 2001
> Date: Mon, 17 Dec 2001 21:20:09 -0800 (PST)
> From: Patrick Powell <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: Re: LPRng: Interesting Packages, state of the art, and some comments
>
> > From [EMAIL PROTECTED] Mon Dec 17 14:46:00 2001
> > Date: Tue, 18 Dec 2001 08:51:16 +1100
> > To: [EMAIL PROTECTED]
> > Subject: Re: LPRng: Interesting Packages, state of the art, and some comments
> > From: [EMAIL PROTECTED] (Craig Small)
> >
> > On Mon, Dec 17, 2001 at 10:37:25AM -0800, Patrick Powell wrote:
> > > At the 2nd Printing Conference, Ben Woodard outlined a proposed
> > > structure for a 'new printing system'. One of the components was
> > > a 'device interface manager'. This would provide a layer of abstraction
> > > for local devices, as well as support device discovery and other
> > > things.
> >
> > If you're looking for something to do Patrick :) there have been
> > murmurings about why printer daemons NEED port 515 open when a Unix
> > socket could do the trick as well. Obviously if the local printer
> > is used by remote clients it is needed and this change would mean
> > a non-standard extension but it shouldn't be that hard I suspect.
> >
> > - Craig
> > --
> > Craig Small VK2XLZ GnuPG:1C1B D893 1418 2AF4 45EE 95CB C76C E5AC 12CA DFA5
> > Eye-Net Consulting http://www.eye-net.com.au/ <[EMAIL PROTECTED]>
> > MIEEE <[EMAIL PROTECTED]> Debian developer <[EMAIL PROTECTED]>
>
> Originally this was the way that it was done. You ALWAYS ran a
> server on your local machine, and then you would connect to a UNIX
> socket. The server was the one that did the network stuff. And
> then people decided that they wanted lightweight spooling - i.e.
> - no server on the localhost.
>
> I actually have code buried here (nods off to a legacy code branch)
> that does this. It checks to see if you are connecting to the
> localhost and then opens a connection to a unix socket.
>
> HOWEVER...
>
> What BENEFIT is there in doing this?
>
> First, you get all enthusiastic about security... and permissions...
> and then you discover that you have to run your clients SETUID root...
> Otherwise any program can connect to your UNIX socket...
> and then you get unenthusiastic again. I hate testing security.
> Beating the TCP/IP stuff to the ground was bad enough.
>
> The overhead difference in using TCP/IP over a UNIX domain socket
> in most systems is trivial. In fact, some systems FAKE sockets
> by using the TCP/IP network stack and effectively connecting to
> 127.0.0.2:port xxx where xxx maps into a node in the UNIX name
> space (excuse me while I whoop my cookies here...).
>
> And while you can get the 'local' benefit of 'knowing who the user
> is' at the local level, when you send to a remote site, you lose
> this... unless, of course, you use encryption. And now you need
> end to end encryption/authentication. Or trust tranference.
>
> And by the way, you will STILL have to have port 515 open for
> non-local access.
>
> But I will think about this...
I have thought about this and added the stuff from the other branch:
Version LPRng-3.8.4 - Thu Dec 13 08:25:17 PST 2001
ARGH! ARGH! screwed up lpq -a by forgetting to
get the 'all' printer information. Doh!
(Spotted by and slapped his forehead by:
Patrick Powell <[EMAIL PROTECTED]>)
"Why do we need a TCP/IP port?" quoth the raven, I mean
Craig Small <[EMAIL PROTECTED]>.
"I have a version that has this facility..." respondeth
Patrick ("Mr. Grumpy") Powell. "But I think you will not
be happy". I merged the two versions. Be Happy.
/etc/lpd.conf:
OPTION TYPE DEFAULT PURPOSE
unix_socket FLAG 1 enables/disables the UNIX socket
unix_socket_path STR /dev/lprng path to the pipe using this
Also: lpd_port = 0 will disable the TCP/IP port
lpd -p 0 - disables the TCP/IP port
or /etc/lpd.conf lpd_port=0
lpd -P /path - enables, unix socket specified by path
or /etc/lpd.conf unix_socket@
lpd -P off - disable unix socket
Permissions:
Connections to the UNIX socket will appear to come
from localhost, (127.0.0.1) port 0. You can use the
UNIXSOCKET to check for this condition, or explicitly for
localhost/port 0
ACCEPT/REJECT ... UNIXSOCKET
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
The address you post from MUST be your subscription address
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
