Configuring and using a CUPS printing server

Procedure

1. Install the cups package:

   # dnf install cups

2. If you configure CUPS as a print server, edit the /etc/cups/cupsd.conf file, and make the following changes:

   1. If you want to remotely configure CUPS or use this host as a print server, configure on which IP addresses and ports the service listens:

      Listen 192.0.2.1:631
      Listen [2001:db8:1::1]:631

      By default, CUPS listens only on localhost interfaces (127.0.0.1 and ::1). Specify IPv6 addresses in square brackets.

      重要

      Do not configure CUPS to listen on interfaces that allow access from untrustworthy networks, such as the internet.

   2. Configure which IP ranges can access the service by allowing the IP ranges in the <Location /> directive:

      <Location />
        Allow from 192.0.2.0/24
        Allow from [2001:db8:1::1]/32
        Order allow,deny
      </Location>

   3. In the <Location /admin> directive, configure which IP addresses and ranges can access the CUPS administration services:

      <Location /admin>
        Allow from 192.0.2.15/32
        Allow from [2001:db8:1::22]/128
        Order allow,deny
      </Location>

      With these settings, only the hosts with the IP addresses 192.0.2.15 and 2001:db8:1::22 can access the administration services.

   4. Optional: Configure IP addresses and ranges that are allowed to access the configuration and log files in the web interface:

      <Location /admin/conf>
        Allow from 192.0.2.15/32
        Allow from [2001:db8:1::22]/128
        ...
      </Location>
      
      <Location /admin/log>
        Allow from 192.0.2.15/32
        Allow from [2001:db8:1::22]/128
        ...
      </Location>

3. If you run the firewalld service and want to configure remote access to CUPS, open the CUPS port in firewalld:

   # firewall-cmd --permanent --add-port=631/tcp
   # firewall-cmd --reload

   If you run CUPS on a host with multiple interfaces, consider limiting the access to the required networks.

4. Enable and start the cups service:

   # systemctl enable --now cups

Procedure

1. Edit the /etc/cups/cups-files.conf file, and add the following setting to disable the automatic creation of self-signed certificates:

   CreateSelfSignedCerts no

2. Remove the self-signed certificate and private key:

   # rm /etc/cups/ssl/<hostname>.crt /etc/cups/ssl/<hostname>.key

3. Optional: Display the FQDN of the server:

   # hostname -f
   server.example.com

4. Store the private key and server certificate in the /etc/cups/ssl/ directory, for example:

   # mv /root/server.key /etc/cups/ssl/server.example.com.key
   # mv /root/server.crt /etc/cups/ssl/server.example.com.crt

   重要

   CUPS requires that you name the private key <fqdn>.key and the server certificate file <fqdn>.crt. If you use an alias, you must name the files <alias>.key and <alias>.crt.

5. Set secure permissions on the private key that enable only the root user to read this file:

   # chown root:root /etc/cups/ssl/server.example.com.key
   # chmod 600 /etc/cups/ssl/server.example.com.key

   Because certificates are part of the communication between a client and the server before they establish a secure connection, any client can retrieve the certificates without authentication. Therefore, you do not need to set strict permissions on the server certificate file.

6. Restore the SELinux context:

   # restorecon -Rv /etc/cups/ssl/

7. Optional: Display the CN and SAN fields of the certificate:

   # openssl x509 -text -in /etc/cups/ssl/server.example.com.crt
   Certificate:
     Data:
       ...
       Subject: CN = server.example.com
       ...
       X509v3 extensions:
         ...
         X509v3 Subject Alternative Name:
           DNS:server.example.com
     ...

8. If the CN or SAN fields in the server certificate contains an alias that is different from the server’s FQDN, add the ServerAlias parameter to the /etc/cups/cupsd.conf file:

   ServerAlias alternative_name.example.com

   In this case, use the alternative name instead of the FQDN in the rest of the procedure.

9. By default, CUPS enforces encrypted connections only if a task requires authentication, for example when performing administrative tasks on the /admin page in the web interface.

   To enforce encryption for the entire CUPS server, add Encryption Required to all <Location> directives in the /etc/cups/cupsd.conf file, for example:

   <Location />
     ...
     Encryption Required
   </Location>

10. Restart CUPS:

    # systemctl restart cups

Verification

1. Use a browser, and access https://<hostname>:631/admin/. This requires that your browser trusts the CA certificate. If the connection succeeds, you configured TLS encryption in CUPS correctly.
2. If you configured that encryption is required for the entire server, access http://<hostname>:631/. CUPS returns an Upgrade Required error in this case.

Procedure

1. Create a group for CUPS administrators:

   # groupadd cups-admins

2. Add the users who should manage the service in the web interface to the cups-admins group:

   # usermod -a -G cups-admins <username>

3. Update the value of the SystemGroup parameter in the /etc/cups/cups-files.conf file, and append the cups-admin group:

   SystemGroup sys root wheel cups-admins

   If only the cups-admin group should have administrative access, remove the other group names from the parameter.

4. Restart CUPS:

   # systemctl restart cups

Verification

1. Use a browser, and access https://<hostname_or_ip_address>:631/admin/.

   注記

   You can access the administration area in the web UI only if you use the HTTPS protocol.

2. Start performing an administrative task. For example, click Add printer.

3. The web interface prompts for a username and password. To proceed, authenticate by using credentials of a user who is a member of the cups-admins group.

   If authentication succeeds, this user can perform administrative tasks.

Procedure

1. Use a browser, and access https://<hostname>:631/admin/.

   You must connect to the web interface by using the HTTPS protocol. Otherwise, CUPS prevents you from authenticating in a later step for security reasons.

2. Click Add printer.
3. If you are not already authenticated, CUPS prompts for credentials of an administrative user. Enter the username and password of an authorized user.
4. If you decide to not use driverless printing and the printer you want to add is detected automatically, select it, and click Continue.

5. If the printer was not detected:

   1. Select the protocol that the printer supports.

      

      If your printer supports driverless printing and you want to use this feature, select the ipp or ipps protocol.

   2. Click Continue.

   3. Enter the URL to the printer or to the queue on a remote print server.

      
   4. Click Continue.

6. Enter a name and, optionally, a description and location. If you use CUPS as a print server, and other clients should be able to print through CUPS on this printer, select also Share this printer.

   
7. Select the printer manufacturer in the Make list. If the printer manufacturer is not on the list, select Generic or upload a PPD file for the printer.
8. Click Continue.

9. Select the printer model:

   • If the printer supports driverless printing, select IPP Everywhere. Note that, if you previously installed printer-specific drivers locally, it is possible that the list also contains entries such as <printer_name> - IPP Everywhere.
   • If the printer does not support driverless printing, select the model or upload the PPD file for the printer.
   
10. Click Add Printer

11. The settings and tabs on the Set printer options page depend on the driver and the features the printer supports. Use this page to set default options, such as for the paper size.

    
12. Click Set default options.

Verification

1. Open the Printers tab in the web interface.
2. Click the printer’s name.
3. In the Maintenance list, select Print test page.

Verification

1. Display the available printers:

   # lpstat -p
   printer Demo-printer is idle. enabled since Fri 23 Jun 2023 09:36:40 AM CEST

2. Print a test page:

   # lp -d Demo-printer /usr/share/cups/data/default-testpage.pdf

Procedure

1. Use a browser, and access https://<hostname>:631/printers/.

   You must connect to the web interface by using the HTTPS protocol. Otherwise, CUPS prevents you from authenticating in a later step for security reasons.

2. Click the name of the printer that you want to configure.
3. Depending on whether you want to perform a maintenance or administration task, select the required action from the list.
4. If you are not already authenticated, CUPS prompts for credentials of an administrative user. Enter the username and password of an authorized user.
5. Perform the task.

Procedure

1. Install the samba-krb5-printing, samba-client, and krb5-workstation packages:

   # dnf install samba-krb5-printing samba-client krb5-workstation

2. Optional: Authenticate as a domain administrator and display the list of printers that are shared on the Windows print server:

   # smbclient -L <windows_print_server> -U administrator@<AD_KERBEROS_REALM> --use-kerberos=required
   
   	Sharename       Type      Comment
   	---------       ----      -------
   	...
   	Example         Printer   Example
   	...

3. Optional: Display the list of CUPS models to identify the PPD name of your printer:

   lpinfo -m
   ...
   samsung.ppd Samsung M267x 287x Series PXL
   ...

   You require the name of the PPD file when you add the printer in the next step.

4. Add the printer to CUPS:

   # lpadmin -p "<printer_name>" -v smb://<windows_print_server>/<printer_share_name> -m samsung.ppd -o auth-info-required=negotiate -E

   The command uses the following options:

   • -p <printer_name> sets the name of the printer in CUPS.
   • -v <URI_to_Windows_printer> sets the URI to the Windows printer. Use the following format: smb://<host_name>/<printer_share_name>.
   • -m <PPD_file> sets the PPD file the printer uses.
   • -o auth-info-required=negotiate configures CUPS to use Kerberos authentication when it forwards print jobs to the remote server.
   • -E enables the printer and CUPS accepts jobs for the printer.

Verification

1. Log in to the RHEL host as an AD domain user.

2. Authenticate as an AD domain user:

   # kinit <domain_user_name>@<AD_KERBEROS_REALM>

3. Print a file to the printer you added to the local CUPS print server:

   # lp -d <printer_name> <file>

Procedure

1. Edit the /etc/cups/cups-browsed.conf file, and make the following changes:

   1. Add BrowsePoll parameters for each remote CUPS server you want to poll:

      BrowsePoll remote_cups_server.example.com
      BrowsePoll 192.0.2.100:1631

      Append :_<port>_ to the hostname or IP address if the remote CUPS server listens on a port different from 631.

   2. Optional: Configure a filter to limit which printers are shown in the local CUPS service. For example, to filter for queues whose name contain sales_, add:

      BrowseFilter name sales_

      You can filter by different field names, negate the filter, and match the exact values. For further details, see the parameter description and examples in the cups-browsed.conf(5) man page on your system.

   3. Optional: Change the polling interval and timeout to limit the number of browsing cycles:

      BrowseInterval 1200
      BrowseTimeout 6000

      Increase both BrowseInterval and BrowseTimeout in the same ratio to avoid situations in which printers disappear from the browsing list. This mean, multiply the value of BrowseInterval by 5 or a higher integer, and use this result value for BrowseTimeout.

      By default, cups-browsed polls remote servers every 60 seconds and the timeout is 300 seconds. However, on print servers with many queues, these default values can cost many resources.

2. Enable and start the cups-browsed service:

   # systemctl enable --now cups-browsed

Procedure

1. Edit the /etc/cups/cups-files.conf file, and set the AccessLog, ErrorLog, and PageLog parameters to the paths where you want to store these log files:

   AccessLog /var/log/cups/access_log
   ErrorLog /var/log/cups/error_log
   PageLog /var/log/cups/page_log

2. If you configure CUPS to store the logs in a directory other than /var/log/cups/, set the cupsd_log_t SELinux context on this directory, for example:

   # semanage fcontext -a -t cupsd_log_t "/var/log/printing(/.*)?"
   # restorecon -Rv /var/log/printing/

3. Restart the cups service:

   # systemctl restart cups

Verification

1. Display the log files:

   # cat /var/log/cups/access_log
   # cat /var/log/cups/error_log
   # cat /var/log/cups/page_log

2. If you configured CUPS to store the logs in a directory other than /var/log/cups/, verify that the SELinux context on the log directory is cupsd_log_t:

   # ls -ldZ /var/log/printing/
   drwxr-xr-x. 2 lp sys unconfined_u:object_r:cupsd_log_t:s0 6 Jun 20 15:55 /var/log/printing/

Procedure

1. Set up CUPS on two or more servers:

   1. Install and configure CUPS.
   2. Enable TLS encryption.

   3. Add print queues to all CUPS instances by using the lpadmin utility or the web interface. If you use the web interface, ensure that you select the Share this printer option while you add the printer. The lpadmin utility enables this setting by default.

      重要

      For the high-availability scenario, each queue on one print server requires a queue with exactly the same queue name on the other servers. You can display the queue names on each server by using the lpstat -e command.

      Optional: You can configure the queues on each server to refer to different printers.

2. On print clients:

   1. Edit the /etc/cups/cups-browsed.conf file, and add BrowsePoll directives for each CUPS print server:

      BrowsePoll print_server_1.example.com:631
      BrowsePoll print_server_2.example.com:631

   2. Enable and start both the cups and cups-browsed service:

      # systemctl enable --now cups cups-browsed

Procedure

1. Use a browser, and access http://<hostname_or_ip_address>:631/help/.
2. Expand the entries in Online Help Documents, and select the documentation you want to read.