Setting up cupsd for PAM and Basic Auth – Office of Information Technology

Introduction

Here is a working cupsd.conf that we use to get CUPS 1.3.3 to work with Basic Auth. We have not included any information on actually setting up PAM. For most U*NIX servers, including Mac OS X, /etc/pam.d folder should contain a usable PAM configuration file named cups … if not then start at http://www.kernel.org/pub/linux/libs/pam/ to lean about PAM.

Working cupsd.conf for CUPS 1.3.3 and Basic Auth using PAM

# Run as daemon<br />User daemon<br /><br /># Log general information in error_log - change "info" to "debug" for<br /># troubleshooting...<br />LogLevel debug2<br /><br /># Name of server<br />ServerName print.ncsu.edu<br /><br /># Administrator user group...<br />SystemGroup sys root<br /><br /># Allow encryption<br />#Encryption IfRequested<br />Encryption Required<br /><br /># Listen for connections from the local machine.<br />Listen /local/cups/var/run/cups/cups.sock<br /><br /># Listen to any address on port 631<br />Listen *:631<br /><br /># Show shared printers on the local network.<br />Browsing Off<br />BrowseOrder allow,deny<br />BrowseAllow all<br /><br /># Default authentication type, when authentication is required...<br />DefaultAuthType Basic<br />Krb5Keytab /etc/krb5.keytab<br /><br /># Restrict access to the server...<br /><br />  Order allow,deny<br />  Allow from all<br /><br /><br /># Restrict access to the admin pages...<br /><br />  AuthType Basic<br />  Encryption Required<br />  Order deny,allow<br />  Allow localhost<br />  Require user @SYSTEM<br /><br /><br /># Restrict access to configuration files...<br /><br />  AuthType Basic<br />  Encryption Required<br />  Order deny,allow<br />  Allow localhost<br />  Require user @SYSTEM<br /><br /><br /># Set the default printer/job policies...<br /><br />  # Job-related operations must be done by the owner or an administrator...<br />  <br />    AuthType Basic<br />    Encryption Required<br />    Require user @OWNER @SYSTEM<br />    Order deny,allow<br />  <br /><br />  # All administration operations require an administrator to authenticate...<br />  <br />    AuthType Basic<br />    Encryption Required<br />    Require user @SYSTEM<br />    Order deny,allow<br />  <br /><br />  # All printer operations require a printer operator to authenticate...<br />  <br />    AuthType Basic<br />    Encryption Required<br />    Require user @SYSTEM<br />    Order allow,deny<br />  <br /><br />  # Only the owner or an administrator can cancel or authenticate a job...<br />  <br />    AuthType Basic<br />    Encryption Required<br />    Require user @OWNER @SYSTEM<br />    Order allow,deny<br />  <br /><br />  <br />    Order deny,allow<br />    Allow from all<br />  <br />

# Run as daemon User daemon # Log general information in error_log - change "info" to "debug" for # troubleshooting... LogLevel debug2 # Name of server ServerName print.ncsu.edu # Administrator user group... SystemGroup sys root # Allow encryption #Encryption IfRequested Encryption Required # Listen for connections from the local machine. Listen /local/cups/var/run/cups/cups.sock # Listen to any address on port 631 Listen *:631 # Show shared printers on the local network. Browsing Off BrowseOrder allow,deny BrowseAllow all # Default authentication type, when authentication is required... DefaultAuthType Basic Krb5Keytab /etc/krb5.keytab # Restrict access to the server... Order allow,deny Allow from all # Restrict access to the admin pages... AuthType Basic Encryption Required Order deny,allow Allow localhost Require user @SYSTEM # Restrict access to configuration files... AuthType Basic Encryption Required Order deny,allow Allow localhost Require user @SYSTEM # Set the default printer/job policies... # Job-related operations must be done by the owner or an administrator... AuthType Basic Encryption Required Require user @OWNER @SYSTEM Order deny,allow # All administration operations require an administrator to authenticate... AuthType Basic Encryption Required Require user @SYSTEM Order deny,allow # All printer operations require a printer operator to authenticate... AuthType Basic Encryption Required Require user @SYSTEM Order allow,deny # Only the owner or an administrator can cancel or authenticate a job... AuthType Basic Encryption Required Require user @OWNER @SYSTEM Order allow,deny Order deny,allow Allow from all

Getting More Help
For more help or questions on setting up CUPS print services look at http://www.cups.org.