Common UNIX Printing System Sweet phần 3 doc

< previous page page_94 next page > Page 94 Deny from all Allow from 127.0.0.1 </Location> Assuming that your local network has an address of 192.168.0.0 and a netmask of 255.255.0.0, the following change will enable remote printing from clients: <Location /> Order deny,allow Deny from all Allow from 127.0.0.1 Allow from 192.168.0.0/255.255.0.0 </Location> NOTE: Early versions of CUPS allowed connections from all hosts by default. Unless you will be providing an Internet-wide printing service, do not allow connections from all hosts. Although adding an ''Allow from all" line would seem to be the easiest way to configure your server, it will needlessly open your print server to unwanted print jobs and other denial-of-service attacks from outside systems. Next you need to enable broadcasting from your server by specifying the network broadcast address for your local network. Add the following directive to set the broadcast address to 192.168.255.255: BrowseAddress 192.168.255.255 After saving the changes to cupsd.conf, restart the server. All of your CUPS clients will now see the printers on the server and be able to print to them. NOTE: CUPS provides printer-browsing support to clients using UDP broadcasting. The BrowseAddress directive is so-named to allow for other types of browsing in the future such as multicasting, SLP, and LDAP. Easy Web Browsing Normally CUPS listens for HTTP requests on the IPP port, port 631. Users access the CUPS server with the following URL: < previous page page_94 next page > < previous page page_95 next page > Page 95 http://server:631 To make it easier for clients to access the CUPS server, add a second port directive to the cupsd.conf file to make the CUPS server listen on the normal HTTP port (80): Port 631 Port 80 Now your users will also be able to access the CUPS server with the following (simpler) URL: http://server Enhanced Security The default configuration of CUPS runs the CUPS server as the root user, but runs all external programs as an unprivileged user. Although this provides excellent security against unpriviledged access to system resources, because the server is running as root it may be possible to exploit an undiscovered bug to gain root access. CUPS provides a RunAsUser directive to run the server as an unpriviledged user after setting up the network services. Add the following line to cupsd.conf to enable this mode: RunAsUser Yes NOTE: When running the server as an unpriviledged user, the SIGHUP reconfigure mechanism is disabled. Any files under /etc/cups (and the /etc/cups directory itself) must be owned by the unpriviledged user as well. Also, any local devices (parallel, serial, and USB ports) must be accessible to the unpriviledged user, otherwise a ''permission denied" message will result when you print. Finally, some networked LPD printers may not work in unpriviledged mode because the LPD backend will be unable to reserve a privileged port as required by RFC 1179. Encryption CUPS supports 128-bit encryption of any request or response sent to the server. Encryption scrambles the data sent between the client and server so that an eavesdropper is unable to understand it. The most common use of encryption is to scramble passwords that are sent when doing administration tasks from a remote machine. It is also often used to print sensitive documents over the Internet. < previous page page_95 next page > < previous page page_96 next page > Page 96 Before you can enable encryption on your server, you must get an encryption certificate. This can be one purchased from one of the many Certificate Authorities (see Table 5.2) or an unsigned one you create by using the tools provided with the OpenSSL library. NOTE: Encryption certificates can be signed by a Certificate Authority or unsigned. A signed certificate includes information that identifies it as coming from an official source, whereas an unsigned certificate does not. Because unsigned encryption certificates are not generated by an official Certificate Authority, most browsers will generate a warning message when you access your server for the first time. The user must approve the new certificate before it can be used, so make sure your users are aware of this. Unsigned certificates are just as secure as signed certificates in most circumstances. However, it is more likely that successful man-in-the-middle attacks can be carried out with the unsigned certificate because your users are expecting the warning dialog and won't know whether the certificate is valid. For this reason, don't use unsigned certificates to provide encryption beyond your LAN. TABLE 5.2 Commercial Certificate Authorities Company URL 128i Ltd.(New Zealand) http://www.128i.com BelSign NV/SA http://www.belsign.be CertiSign Certificadora http://www.certisign.com.br Digital Ltda. Certplus SA (France) http://www.certplus.com Deutsches Forschungsnetz http://www.pca.dfn.de/dfnpca/certify/ssl/ Entrust.net Ltd. http://www.entrust.net/products/index.htm Equifax Inc. http://www.equifaxsecure.com/ebusinessid/ GlobalSign NV/SA http://www.GlobalSign.net IKS GmbH http://www.iks-jena.de/produkte/ca/ NetLock Kft.(Hungary) http://www.netlock.net NLsign B.V. http://www.nlsign.nl TC TrustCenter (Germany) http://www.trustcenter.de/html/Produkte/ Thawte Consulting http://www.thawte.com/certs/server/TC_server/885.htmrequest.html Verisign, Inc. http://www.verisign.com/guide/apache Generating an Unsigned Encryption Certificate If you decide to use the OpenSSL library to generate your own unsigned certificate, run the following commands: < previous page page_96 next page > < previous page page_97 next page > Page 97 openssl req -new -x509 -keyout /etc/cups/ssl/server.key \ -out /etc/cups/ssl/server.crt - days 365 -nodes ENTER Using configuration from /usr/ssl/openssl.cnf Generating a 1024 bit RSA private key ++++++ ++++++ writing new private key to '/etc/cups/ssl/server.key' You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. Country Name (2 letter code) ?: US ENTER State or Province Name (full name) [Some-State]: Maryland ENTER Locality Name (eg, city) []:Hollywood ENTER Organization Name (eg, company) [Internet Widgits Pty Ltd]:Easy Software Products ENTER Organizational Unit Name (eg, section) []: ENTER Common Name (eg, YOUR name) []:host.easysw.com ENTER Email Address []:mike@host. easysw.com ENTER chmod 600 /et/cups/ssl/server.* ENTER The openssl command creates the server key and certificate files in the /etc/cups/ssl directory. The chmod command makes sure that only the root user can read them. Getting a Signed Certificate If you decide to get a signed certificate, request a certificate to be used with the Apache or Stronghold Web servers—these certificates will be in the correct format for CUPS. Requesting a certificate involves some more openssl commands to generate the server key and certificate request. Start by generating the server key: openssl genrsa -des3 -out /etc/cups/ssl/server.key 1024 ENTER Generating RSA private key, 1024 bit long modulus ++++++ ++++++ e is 65537 (0×10001) Enter PEM pass phrase:password ENTER Verifying password - Enter PEM pass phrase:password ENTER The password you use is not important—you will be removing it in the last step of this process. < previous page page_97 next page > < previous page page_98 next page > Page 98 Next, generate your certificate request file with the following: openssl req -new -key /etc/cups/ssl/server.key -out /etc/cups/server.csr ENTER Using configuration from /usr/ssl/openssl.cnf Enter PEM pass phrase: password ENTER You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. Country Name (2 letter code) ?:US ENTER State or Province Name (full name) [Some-State]:Maryland ENTER Locality Name (eg, city) []:Hollywood ENTER Organization Name (eg, company) [Internet Widgits Pty Ltd]:Easy Software Products ENTER Organizational Unit Name (eg, section) []: ENTER Common Name (eg, YOUR name) []:host.easysw.com ENTER Email Address []:mike@host.easysw.com ENTER Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: ENTER An optional company name []: ENTER Send the file /etc/cups/ssl/server.csr to your Certificate Authority. They will provide you with a signed certificate that can be used with your CUPS server. The certificate should be copied to the file /etc/cups/ ssl/server.crt. Finally, remove the password from your server key with these commands cd /etc/cups/ssl ENTER mv server.key server.old ENTER openssl rsa -in server.old -out server. key ENTER rm server.old ENTER and then make sure that the files can be read only by the server chmod 600 server.* ENTER That's it! You now have an official, signed certificate for your server! Enabling Encryption in Your Server Now that your server certificate and key are installed, you need to tell CUPS to use them. CUPS provides two encryption methods—the dedicated https-type of service as < previous page page_98 next page > < previous page page_99 next page > Page 99 well as the newer HTTP Upgrade method. The https service encrypts the connection to the server immediately, while the HTTP Update method upgrades the connection only when the client or server requests it. Figure 5.1 shows how the two methods work. FIGURE 5.1 CUPS encryption methods. If you will be doing remote administration using a Web browser, you'll want to enable the https service. The SSLPort directive tells CUPS to use https on the specified port number: SSLPort 443 Port 443 is the standard port for https URLs. If you already have a secure Web server running on your system on port 443 you can generally use any other port number in addition to 80 and 631. The Encryption directive is another you'll want to use. It specifies the level of encryption that is required for various resources. For remote administration you'll need to update the following section reading: <Location /admin> # # You definitely will want to limit access to the administration functions. # The default configuration requires a local connection from a user who # is a member of the system group to do any admin tasks. You can change # the group name using the SystemGroup directive. # < previous page page_99 next page > < previous page page_100 next page > Page 100 AuthType Basic AuthClass System ## Restrict access to local domain Order Deny, Allow Deny From All Allow From 127.0.0.1 #Encryption Required </Location> Assuming that your local network has an address of 192.168.0.0 and a netmask of 255.255.0.0, the following changes will enable remote administration with encryption: </Location /admin> # # You definitely will want to limit access to the administration functions. # The default configuration requires a local connection from a user who # is a member of the system group to do any admin tasks. You can change # the group name using the SystemGroup directive. # AuthType Basic AuthClass System ## Restrict access to local domain Order Deny, Allow Deny From All Allow From 127.0.0.1 Allow from 192.168.0.0/255.255.0.0 Encryption Required </Location> Advanced Access Control CUPS supports access control based on the client address, the user certificate or username and password, and encryption. Address-based access control enables you to limit access to specific systems, networks, or domains. Although this does not provide authentication, it does enable you to limit the potential users of your system efficiently. Certificates, usernames, and passwords provide ways to limit access to individual people or groups. < previous page page_100 next page > < previous page page_101 next page > Page 101 Finally, you can require encryption on specific resources; this is often used to provide secure remote administration access, as described in the previous section titled ''Enabling Encryption in Your Server." Basics of Access Control CUPS maintains a list of locations that have access control, authentication, and encryption enabled. Locations are specified using the Location directive: <Location /resource> AuthClass AuthGroupName AuthType Encryption Order Allow from Deny from </Location> Locations generally follow the directory structure of the DocumentRoot directory; however, CUPS does have several virtual locations for administration, classes, jobs, and printers. Table 5.3 lists the virtual locations that CUPS provides. TABLE 5.3 CUPS Virtual Locations Resource Description /admin The resource for all administration operations /classes The resource for all classes /classes/ name The resource for class name /jobs The resource for all jobs /jobs/ id The resource for job id /printers The resource for all printers /printers/ name The resource for printer name /printers/ name.ppd The PPD file for printer name Authentication of Users CUPS supports user authentication through HTTP Basic and Digest authentication. Basic authentication uses Unix accounts and passwords, whereas Digest authentication uses a special MD5 password file just for CUPS. < previous page page_101 next page > < previous page page_102 next page > Page 102 NOTE: Basic authentication sends the username and password Base64-encoded from the client to the server, so it offers no protection against eavesdropping unless you are using encryption on the connection. This means that a malicious user can monitor network packets and discover valid users and passwords that could result in a serious compromise in network security. Use Basic authentication only in conjunction with encryption. Unlike Basic authentication, Digest passes the MD5 sum (basically a complicated checksum) of the username and password instead of the strings themselves. Also, Digest authentication does not use the Unix password file, so if an attacker does discover the original password it is less likely to result in a serious security problem as long as you use a different Digest password from the corresponding Unix password. Because most Web browsers do not support Digest authentication, your best choice is Basic authentication with Encryption enabled. CUPS also supports a local certificate-based authentication scheme that can be used in place of Basic or Digest authentication by clients connecting on the local machine. Certificate authentication is not supported or enabled from remote clients. Authentication is enabled using the following AuthType directive inside a location section: <Location /printer/DeskJet> AuthType Basic Encryption Required </Location> This example requires a Unix password when a user prints a file to a printer queue named DeskJet. To use Digest passwords instead, use the following: <Location /printer/DeskJet> AuthType Digest Encryption Required </Location> Digest authentication works with users and passwords defined in the /etc/cups/ passwd.md5 file. The lppasswd command is used to add, change, or remove accounts from the passwd.md5 file. To add a user to the default system group, type the following: lppasswd -a user ENTER Password: password ENTER Password: again: password ENTER After this is added, a user can change his/her password by typing lppasswd ENTER Old password: password ENTER Password: password ENTER Password again: password ENTER < previous page page_102 next page > < previous page page_103 next page > Page 103 To remove a user from the password file, type the following: lppasswd -x user ENTER Authentication of Groups Group authentication adds an extra requirement that the user is part of a Unix or Digest group. The default CUPS configuration uses group authentication to require that administration requests be performed by valid administrative users in the ''root,""sys," or "system" group, depending on your OS. The AuthClass directive specifies the type of group authentication to perform. Table 5.4 lists the authentication classes: TABLE 5.4 Authentication Classes Class Description None No group membership is required. System Membership in the system group is required. Group Membership in the named group is required. For System authentication, the user must be a member of the system group, which by default is set to the "root,""sys," or "system" group on your system. This group can be explicitly set using the SystemGroup directive: SystemGroup administrators <Location /admin> AuthType Basic AuthClass System Encryption Required </Location> For Group authentication, the AuthGroupName directive is used instead: <Location /admin> AuthType Basic AuthClass Group AuthGroupName administrators Encryption Required </Location> < previous page page_103 next page > [...]... provides background information on the Internet Printing Protocol, the network printing protocol from the Internet Engineering Task Force IPP forms the basis of the Common UNIX Printing System History of IPP The IPP working group was created in 1997 by the Internet Engineering Task Force (IETF) and Printer Working Group (PWG) to develop a standard network printing protocol that addressed the needs of... support the Internet Printing Protocol for printing Configuring SAMBA 2.0.x To configure SAMBA 2.0.0–2.0.5 for CUPS, edit the smb.conf file and replace the existing printing commands and options with the lines: printing = sysv printcap = lpstat print command = lp -d%p -oraw %s; rm -f %s To configure SAMBA 2.0.6 and 2.0.7 for CUPS, edit the smb.conf file and replace the existing printing commands and... implementations relied on a reserved source port number (721– 731 ) to ensure that the client (user) was printing from a trusted system Because only the root user (or an application that runs as root) can reserve a port under 1024, this was considered to be adequate security at the time < previous page page_122 next page > < previous page page_1 23 next page > Page 1 23 As computing matured, however, the limitations... universally agreed that the new Internet Printing Protocol should not be based on the LPD protocol Making a New Protocol When the decision to drop the LPD protocol was made, the group started working on a replacement based on the document printing application (DPA) standard (ISO 10175) The DPA standard is a rather broad document that covers everything from printing to administration It defines attributes... Relay the printers from subnet 1 and 2 to subnet 3 BrowseRelay 192.168.1 192.168 .3. 255 BrowseRelay 192.168.2 192.168 .3. 255 Load Balancing and Failsafe Operation When using server polling or broadcasting, CUPS clients can automatically merge identical printers on multiple servers into a single implicit class queue Clients assume that < previous page page_1 13 next page > < previous page page_114 next page... inetd super-daemon (most versions of Unix) , edit the /etc/inetd.conf file and add a line reading: printer stream tcp nowait lp /usr/lib/cups/daemon/cups-lpd cups-lpd After you have added this line, send the inetd process a HUP signal or reboot the system In IRIX and some servers of Linux, the command will be the following: killall -HUP inetd ENTER For other Unix systems, use the kill command after finding... single server for printing 3 Automatic configuration of print queues 4 Specifying multiple servers for printing 5 Relaying printers to other clients WHICH CONFIGURATION SHOULD I USE? The choice of client configuration depends a great deal on your network and client machines Running a local CUPS server on a client provides the best overall functionality, but does use a small amount of system resources... for a printer 0×000C Hold-Job Holds a print job 0×000D Release-Job Releases a print job for printing 0×000E Restart-Job Restarts the printing of a print job 0×0010 Pause-Printer Temporarily stops a printer 0×0011 Resume-Printer Resumes printing on a printer 0×0012 Purge-Jobs Cancels all jobs on a printer 0×00 13 Set-Printer-Attributes Changes printer job attributes 0×0014 Set-Job-Attributes Changes print... As printers are found using polling, they are relayed from client C to the rest of the clients through a broadcast on subnet 3 The rest of the clients can use the standard cupsd.conf configuration < previous page page_112 next page > < previous page page_1 13 next page > Page 1 13 FIGURE 6.1 A typical corporate network with multiple subnets NOTE: The BrowseRelay directive can also be used to relay browsing... you can run the lpsrv program for limited printing with the command lwsrv -n ''Share Name" -p name -a /usr/lib/adicts -f /usr/lib/LW+Fonts ENTER where "Share Name" is the name you want to use when sharing the printer, and name is the name of the CUPS print queue XINET KA/Spool KA/Spool is a commercial solution that is popular on high-end Unix boxes To use your system as a print server for Mac OS clients, . " ;system& quot; group on your system. This group can be explicitly set using the SystemGroup directive: SystemGroup administrators <Location /admin> AuthType Basic AuthClass System. membership is required. System Membership in the system group is required. Group Membership in the named group is required. For System authentication, the user must be a member of the system group, which. the specified port number: SSLPort 4 43 Port 4 43 is the standard port for https URLs. If you already have a secure Web server running on your system on port 4 43 you can generally use any other