Introduction
Here is a working cupsd.conf that we use to get CUPS 1.3.3 to work with Basic Auth. We have not included any information on actually setting up PAM. For most U*NIX servers, including Mac OS X, /etc/pam.d folder should contain a usable PAM configuration file named cups … if not then start at https://www.kernel.org/pub/linux/libs/pam/ to lean about PAM.
Working cupsd.conf for CUPS 1.3.3 and Basic Auth using PAM
# Run as daemon User daemon # Log general information in error_log - change "info" to "debug" for # troubleshooting... LogLevel debug2 # Name of server ServerName print.ncsu.edu # Administrator user group... SystemGroup sys root # Allow encryption #Encryption IfRequested Encryption Required # Listen for connections from the local machine. Listen /local/cups/var/run/cups/cups.sock # Listen to any address on port 631 Listen *:631 # Show shared printers on the local network. Browsing Off BrowseOrder allow,deny BrowseAllow all # Default authentication type, when authentication is required... DefaultAuthType Basic Krb5Keytab /etc/krb5.keytab # Restrict access to the server... <Location /> Order allow,deny Allow from all </Location> # Restrict access to the admin pages... <Location /admin> AuthType Basic Encryption Required Order deny,allow Allow localhost Require user @SYSTEM </Location> # Restrict access to configuration files... <Location /admin/conf> AuthType Basic Encryption Required Order deny,allow Allow localhost Require user @SYSTEM </Location> # Set the default printer/job policies... <Policy default> # Job-related operations must be done by the owner or an administrator... <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job> AuthType Basic Encryption Required Require user @OWNER @SYSTEM Order deny,allow </Limit> # All administration operations require an administrator to authenticate... <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default> AuthType Basic Encryption Required Require user @SYSTEM Order deny,allow </Limit> # All printer operations require a printer operator to authenticate... <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Basic Encryption Required Require user @SYSTEM Order allow,deny </Limit> # Only the owner or an administrator can cancel or authenticate a job... <Limit Cancel-Job CUPS-Authenticate-Job> AuthType Basic Encryption Required Require user @OWNER @SYSTEM Order allow,deny </Limit> <Limit All> Order deny,allow Allow from all </Limit> </Policy>