Table of Contents

Printing with CUPS

FIXME this page is a work in progress FIXME

CUPS (the Common UNIX Printing System) is now the default printing subsystem in Slackware, after years of faithful service by the lprng package which is no longer part of Slackware. The commandline lpr program that some of you use is in fact part of CUPS, but it emulates the old lpr program that has been known in Linux/UNIX for ages and which was the way to print if you had lprng installed in Slackware. But a set of commandline tools is not all that CUPS installs on your system.

CUPS has a browser-based graphical user interface (check out yours at http://localhost:631/) for administering the service, like creating print queues, monitoring, deleting and restarting print jobs and such.
Not everything can be done through the graphical interface though. The basic initial setup of the CUPS service is still a matter of hand-editing certain configuration files.

CUPS can act as a server (when it has a queue configured that prints to a physical device) or a client (when there is no local printer configured but instead your job submissions are sent to a CUPS server on the network). The big plus of networked CUPS services is that they are able to talk to each other, so that printing from one CUPS machine (the client) to another CUPS machine (a CUPS server with attached printer) works automagically - the client machine will pick up the server print queues that are advertised on the network without you needing to configure anything.

Setting up the CUPS service

Slackware comes with a functional CUPS service out of the box. All you have to do is make the file /etc/rc.d/rc.cups executable and start the server. After that you can point your browser to http://localhost:631/ for the administratitive interface, and start adding queues for local printers or remote CUPS servers. 

chmod +x /etc/rc.d/rc.cups
/etc/rc.d/rc.cups start

If you need to setup a CUPS network server (other PC's should be able to print to your machine) then there is some extra work ahead.

The way Slackware runs CUPS out of the box is that only access from the localhost is allowed. The print queues which you define will not be advertised on your network.
Access to localhost is safe - no one else but you on your computer can talk to the localhost address (which is tied to the loopback interface or “lo” interface).

If localhost does not work for you when you type the URL in the browser, try the IP address for localhost which is 127.0.0.1. The URL would then look like this: http://127.0.0.1:631/. But in any case, this would indicate that you messed up your /etc/hosts file which should contain (among others) the line 
127.0.0.1       localhost

If that line is not present, you should add it. It's absence will break quite many network services.

For the sake of this article, I will present several examples containing IP addresses. Our example network will be as follows:

/etc/cups/cupsd.conf

The /etc/cups/cupsd.conf file is the server configuration file for CUPS. It determines how the job scheduler will run. The default content of this file (stripped of - very useful - comments and empty lines) looks like this: 

LogLevel info
Port 631
<Location />
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
</Location>
<Location /admin>
AuthType Basic
AuthClass System
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
</Location>

I will briefly go through the most important lines.

Since Basic Authentication sends passwords unencrypted to the server, it makes sense that access to the admin interface is restricted to the local host - this is what the line “Allow From 127.0.0.1” is for. If you want access to your CUPS server's administrative interface across the network, it is desirable to protect your password from network sniffers by using SSL encryption (i.e.using https:// URLs instead of http://). I will show you how to secure your access in the Securing the admin web interface section.

Now, I told you that CUPS services can talk to each other - they use the IPP protocol for that. Print queues on one CUPS server will automatically be available for use on another computer running CUPS. An example: you take your Slackware laptop with you and plug it into the network of your exmployer. If there is a CUPS server on that network, the queues on that server will suddenly pop up on your local CUPS server! Zero config here people. The big question is of course: how does one CUPS program find other CUPS programs in the network?
The answer is, you must make the CUPS server advertise itself on the network. These are the two lines you will add to your cupsd.conf file to make that happen: 

BrowseAddress @LOCAL
BrowseAllow 192.168.0.*

Meaning that your CUPS server will use all interfaces that it considers local. Any point-to-point interfaces (ppp, dial-up lines for instance) are not considered local. Also it will accept and answer browse requests from computers in our example IP range. A browse request is a query from another CUPS program, looking for peers on the network. Our server will now answer those browse requests, thereby making it's own print queues available for use by other CUPS clients in the network. The complete cupsd.conf file would look like 

LogLevel info
Port 631
BrowseAddress @LOCAL
BrowseAllow 192.168.0.*
<Location />
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
Allow From 192.168.0.*
</Location>
<Location /admin>
AuthType Basic
AuthClass System
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
</Location>

You'll notice that I also added that line Allow From 192.168.0.* otherwise network connections from outside would still be refused. I leave access to the /admin URL restricted to localhost for now. Later on, we will add some security by means of SSL encryption.

/etc/cups/client.conf

Creating print queues

Securing the admin web interface

In this section I will show you how you can prevent other people on the network from accessing your CUPS server's administrative interface by password protecting it and using encryption. It would be silly if all of a sudden your print queue would be disabled by a joker…

You've probably noticed the line “AuthClass System” in the definition of the “/admin” location. This line defines the “class” of users (in fact a Linux group taken from the /etc/group file) which CUPS considers as being “System users”. By default, CUPS will require the authenticating user to be a member of the “sys”, “system”, or “root” groups (the check is done in that order). That requirement fits only the root account, so that explains my statement of one of the previous sections. You can change the name of this group by uncommenting the line #SystemGroup sys in the cupsd.conf file, and changing the work sys to some other existing group. Alternatively, you can add your own acccount to the sys group of course.

Belonging to the right group is not enough though.
Suppose you have added “SystemGroup wheel” to cupsd.conf so that anyone in the wheel group can administer CUPS (I like to use wheel for administrative tasks). You will now have to create a password file for CUPS which holds your user account and an associated password. CUPS cannot read your Linux account/password (it needs PAM for that, and Slackware does not use PAM). If the password file does not yet exist, we create it as follows, assuming your user account is “alien”: 

lppasswd -g wheel -a alien

If the password file existed, then a line for the alien account would have been appended to it.
The contents of that file look like this now: 

# cat /etc/cups/passwd.md5
     alien:wheel:01234567890abcde1234567890abcde12

SSL encryption

FIXME

TODO

Configuring CUPS clients

TODO

Making CUPS work with Samba

Samba will pick up the CUPS printers and make them available to your Windows computers in the LAN when you have these lines in the [global] section of your /etc/samba/smb.conf file: 

   load printers = yes
   printcap name = cups
   printing = cups
   print command = lpr -oraw -r -P'%p' %s
   lpq command = /usr/bin/lpq -P%p

You should also have a [printers] section in smb.conf that would look like this: 

[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   # Set public = yes to allow user 'guest account' to print
   # A synonym for 'public = yes' is: 'guest ok = yes'
   public = yes
   writable = no
   printable = yes

The print spool directory which Samba uses (/var/spool/samba) must be different from the CUPS spool directory! Check if the directory exists (usually it should) and if it is writable by all: 

# ls -l /var/spool | grep samba
drwxrwxrwt   2 root   root    4096 2007-12-09 18:26 samba/

The 't' in drwxrwxrwt means that every user can write in this directory but their files cannot be deleted by anyone but themselves. If the directory does not exist, or it's permissions are incorrect, you can run the following three commands to fix that: 

mkdir -p /var/spool/samba
chown -R root:root /var/spool/samba
chmod 1777 /var/spool/samba

When print jobs from the Windows computers never show up in CUPS, you should increase the debug level for your CUPS server: 

LogLevel debug

and restart the CUPS server by running: 

/etc/rc.d/rc.cups restart

You will see the following error messages in /var/log/cups/error_log: 

    E [11/Nov/2004:20:30:25 +0100] print_job: Unsupported format 'application/octet-stream'!
    I [11/Nov/2004:20:30:25 +0100] Hint: Do you have the raw file printing rules enabled?
    D [11/Nov/2004:20:30:25 +0100] Sending error: client-error-document-format-not-supported

To resolve this, you need to edit two files (you will find the affected lines at the end) and afterwards restart CUPS:

Sometimes you will find that Samba does not pick up changes to your CUPS configuration, especially when you edited the smb.conf file. If you have computers connected to Samba shares and do not want to disconnect them, you can force the smbd processes on the Linux server to re-read their configuration while running. The following command will do that by sending a SIGHUP or hangup signal to these running processes: 
killall -HUP smbd

Even though it uses the command killall this does not mean that any process gets killed!

A PDF printer for CUPS

Usually, the CUPS print queues will print to paper of course. But there are cases when you want an electronic image of some document, or web page, that you do not need on paper. The PDF file format is the ideal candidate for this, since this format is supported on virtually all operating systems and architectures.
So, we need to add a print queue to CUPS which does not print our submitted jobs to paper sheets but instead generates a PDF file from our input, and makes this file available to us in some way.
This section describes exactly how to set this up, leaving the choice up to you whether you want your PDF files delivered to you via email, or have them dumped into a directory of your choice.
This setup uses no proprietary software to create the PDF files - all you need is already present on your Slackware machine. For those with several computers in a network, having a CUPS server to generate the PDF's has the additional advantage that it does not matter what the client computer is. Your Linux and Windows workstation, or your Mac, will be equally able to use this pdfprinter as long as your CUPS service allows job submissions from the network.

If you are running a network server with Samba, your CUPS pdfprinter will be integrated into the Samba configuration if you tell it to use CUPS for printing support (which is the default behaviour anyway). Windows clients will be able to generate PDF's by using a Samba print queue.

I came across an implementation of a PDF printer that supports CUPS and Samba. It can be found at http://www.linux-als-server.de/html/special-pdfprinter.php. My recipe below is based on the instructions found at that URL. Since the original text is in german, my article will help you non-german speaking persons setting this up I hope :-)

Required software

You will need to meet the following software requirements on your CUPS machine:

Only if you want to deliver PDF files by email, you'll need these too:

Installing a new CUPS backend

CUPS uses so-called backends to support output to printing devices. Examples of these backends are ipp, lpd and socket; they show up in the CUPS URI that you define when creating a new CUPS print queue, for instance printing via IPP: “ipp://192.168.0.1/print/hp6”.
We are going to create a new backend, which supports printing to PDF files and delivering these files to the correct end location (mailbox or directory path). The backend is going to be called pdf since that name is not yet being used.

Reminder: If you don't use the email delivery feature, you do not need to install the sendpdf script, and you don't have to deal with the Perl software requirements!

We're ready! The PDF printer setup is complete.

Using the PDF printer

Client computers (or you on your local computer) can create a PDF file of any printable data, by just printing to the CUPS print queue “pdfprinter”. Linux client computers on the network which have CUPS configured as a client, will pick up the CUPS server automatically (CUPS services talk among each other on the network) so this will all work completely transparently.

If you have a network with Windows computers, the best thing is to setup a Samba server on the CUPS server and let Samba use CUPS for printing. That way, our “pdfprinter” will automatically become available to these Windows computers as a network printer. Windows machines should install this network printer queue using a Generic PostScript driver.

PDF Printer Scripts