[7771] in testers
Re: printer configuration password request
daemon@ATHENA.MIT.EDU (Adam Seering)
Wed Dec 10 09:37:04 2008
Message-ID: <493FD3BE.5090705@mit.edu>
Date: Wed, 10 Dec 2008 09:35:42 -0500
From: Adam Seering <aseering@MIT.EDU>
MIME-Version: 1.0
To: Jonathan Reed <jdreed@mit.edu>
CC: testers@mit.edu
In-Reply-To: <7E7648F8-4AA4-46C5-9F65-6083B7F1D426@mit.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
You could always edit the cups config files to use 'admin' rather than
'lpadmin' as the administrative group (as I recall, the file format is
pseudo-Apache-like).
As I recall, though, there are in fact multiple groups. On my current
(well-used) system, that account is currently in 'lpadmin', 'admin',
'netdev', and 'powerdev' (in addition to the mostly-hardware-related
plethora of groups that every desktop user gets auto-added to).
I don't know of an existing mechanism for adding an existing user to all
of these groups; the normal action is "create an account that's in these
groups". If someone has the exact list of accounts from a clean system,
though, it'd be a trivial script to write.
Adam
On 12/10/08 9:02 AM, Jonathan Reed wrote:
> Never mind, this appears to work. *sigh*. It helps if you actually log
> out and log back in after you change your group membership.
>
> I'm still not sure what causes it to want to connect to the socket file
> instead of localhost, but both seem to work now, so *shrug*
>
> However, we now have two groups (admin and lpadmin) that users need to
> add themselves to if they're using debathena-workstation and want to do
> administrative stuff. I wonder if there are any more, and if we should
> automate this process.
>
> -Jon
>
>
> On Dec 9, 2008, at 9:21 AM, Jonathan Reed wrote:
>
>> OK, something is clearly wrong here. I just tried it again, and when
>> CUPS prompts for a password, it's connecting to localhost, not
>> cups.mit.edu. When I try to authenticate the following is spewed to
>> CUPS' error_log:
>>
>> User "jdreed" does not exist!
>> cupsdAuthorize: pam_authenticate() returned 3 (Error in service module)!
>>
>> Changing the LogLevel to debug only seems to debug the HTTP
>> connection, not the pam errors.
>>
>> /etc/pam.d/cupsys appears to be sane (it includes common-auth,
>> common-account, and common-session, all of which are symlinks to the
>> debathena versions)
>>
>> I get the same errors whether or not jdreed is in lpadmin or not.
>> jdreed is also unable to log in via the web interface.
>>
>> If i hit "Cancel" in the password box, and then choose "Goto Server",
>> I can specify a username, and if I specify root, I'm able to log in
>> using root's password. But everytime a user opens the Printer Config
>> GUI, they're prompted for the password for $USER, not what was used
>> last time.
>>
>> Additionally, about half the time CUPS seems to want to connect to
>> localhost, and the rest of the time it seems to want to connect to
>> /var/run/cups/cups.sock. So something is really weird here.
>>
>> -Jon
>>
>>
>>
>> On Dec 8, 2008, at 7:34 PM, Adam Seering wrote:
>>
>>> Hm...; my assumption would have been "any valid password for your
>>> user account; but your account has to be in the local 'lpadmin'
>>> group" (or whatever group CUPS @SYSTEM access is granted to these
>>> days)... Could that be it?
>>>
>>> Adam
>>>
>>>
>>> On 12/8/08 6:58 PM, Evan Broder wrote:
>>>> I was mostly confused as to what to give it, but that's mostly
>>>> because I
>>>> don't actually remember any of the passwords for cups.mit.edu. I could
>>>> probably come up with a password for you to try...
>>>>
>>>> Remind me if I forget
>>>>
>>>> - Evan
>>>>
>>>> Jonathan Reed wrote:
>>>>> I believe so. I can verify tomorrow. ISTR discussing this with
>>>>> broder, who was also confused as to what password CUPS was asking for.
>>>>>
>>>>> -Jon
>>>>>
>>>>> On Dec 8, 2008, at 6:01 PM, William Cattey wrote:
>>>>>
>>>>>> Is this still a problem?
>>>>>>
>>>>>> -wdc
>>>>>>
>>>>>>
>>>>>>
>>>>>> On Oct 23, 2008, at 2:46 PM, Jonathan Reed wrote:
>>>>>>
>>>>>>> I verified this on my machine. I'm not sure what it's asking for (a
>>>>>>> CUPS BasicAuth password?), but the dialog is different than the one
>>>>>>> which prompts for your password if you try and, say, run the Network
>>>>>>> config applet, or run the updater.
>>>>>>>
>>>>>>> As with Alex's experience, it definitely will not accept Kerberos or
>>>>>>> local passwords.
>>>>>>>
>>>>>>> -Jon
>>>>>>>
>>>>>>> On Oct 23, 2008, at 2:34 PM, Alex T Prengel wrote:
>>>>>>>
>>>>>>>> System -> Administration -> Printing brings up a password request
>>>>>>>> dialog
>>>>>>>> asking for "password for alexp on localhost". It won't accept my
>>>>>>>> Kerberos
>>>>>>>> password or any other, and keeps presenting the dialog until I
>>>>>>>> dismiss it.
>>>>>>>> It does bring up the printer configuration window, but I can't make
>>>>>>>> any
>>>>>>>> changes since the password isn't accepted.
>>>>>>>>
>>>>>>>> Alex
>>>>
>>
>
>
