Cups Web Admin Interface (was: Dependence on Gnome's System Menu)

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

Cups Web Admin Interface (was: Dependence on Gnome's System Menu)

Rocco Stanzione
I originally brought this up as part of a discussion on the practice of
removing or crippling existing, reliable tools that many users are
comfortable with in favor of pointing users to the appropriate Gnome
interface.  I was admonished to address the specific issues instead.

If I run CUPS, I can visit http://localhost:631 and poke around a bit, but I
can't do anything useful.  Specifically, the Admin functions are deliberately
disabled.  A message at the top of the page lets me know this and points me
to a Gnome interface which, not being a Gnome user, I don't have.  It was
suggested that this was disabled due to a policy of having no running
servers.  Does such a policy really exist?  If so, does crippling the
functionality of the CUPS web service satisfy this policy?  If the answer to
both questions is Yes, I'd like to suggest that we need a new
desktop-independent printer administration interface.  KDE's kcontrol has an
applet similar to Gnome's, but it doesn't work very well and a lot of users
use neither KDE nor Gnome.  The solution I'm suggesting, though, is to leave
cupsd.conf more or less as it is in Debian's package, where the admin
interface is available to any member of the lpadmin group and the web
interface listens only on localhost (as it does in the Ubuntu package).

Thanks,

Rocco Stanzione

--
ubuntu-devel mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Cups Web Admin Interface (was: Dependence on Gnome's System Menu)

Ante Karamatic-2
Rocco Stanzione wrote:

> If I run CUPS, I can visit http://localhost:631 and poke around a bit, but I
> can't do anything useful.  Specifically, the Admin functions are deliberately
> disabled.  A message at the top of the page lets me know this and points me
> to a Gnome interface which, not being a Gnome user, I don't have.  It was
> suggested that this was disabled due to a policy of having no running
> servers.  Does such a policy really exist?  If so, does crippling the
> functionality of the CUPS web service satisfy this policy?  If the answer to

Policy is not having open ports on extern interface. CUPS isn't
crippled. It's configured to forrbid any configuration via web
interface. Few '#' in /etc/cups/cupsd.conf would make that go away.

--
Ante Karamatic | 0xD3BDA225 | 0x0A4A0161
[hidden email] | [hidden email] | ivoks.blogspot.com
"Tomorrow is my day off, so please stay off the powder!"

--
ubuntu-devel mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Cups Web Admin Interface (was: Dependence on Gnome's System Menu)

Rocco Stanzione
On Wednesday 22 February 2006 16:12, Ante Karamatic wrote:
> Policy is not having open ports on extern interface. CUPS isn't
> crippled. It's configured to forrbid any configuration via web
> interface. Few '#' in /etc/cups/cupsd.conf would make that go away.

Not listening on an external interface is separate from this issue.  CUPS
listens only on localhost (which is fine with me) AND the admin interface is
disabled.

--
ubuntu-devel mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Cups Web Admin Interface (was: Dependence on Gnome's System Menu)

Martin Pitt-4
In reply to this post by Rocco Stanzione
Hi Rocco!

Rocco Stanzione [2006-02-22 15:53 -0600]:
> If I run CUPS, I can visit http://localhost:631 and poke around a bit, but I
> can't do anything useful.  Specifically, the Admin functions are deliberately
> disabled.  A message at the top of the page lets me know this and points me
> to a Gnome interface which, not being a Gnome user, I don't have.  It was
> suggested that this was disabled due to a policy of having no running
> servers.  Does such a policy really exist?

That's not quite correct; of course we do have running servers. The
policy is to have no open ports to the outside world by default.

> If so, does crippling the functionality of the CUPS web service
> satisfy this policy?

No, the disabling of the admin functionality was just a precautionary
means to disallow access to /etc/shadow for cups. The message says

  "/usr/share/doc/cupsys/README.Debian.gz describes the details and
  how to reenable it again."

and there you will find "sudo adduser cupsys shadow".

Martin

--
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?

--
ubuntu-devel mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (198 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Cups Web Admin Interface (was: Dependence on Gnome's System Menu)

Rocco Stanzione
On Thursday 23 February 2006 03:38, Martin Pitt wrote:

> Hi Rocco!
>
> Rocco Stanzione [2006-02-22 15:53 -0600]:
> > If I run CUPS, I can visit http://localhost:631 and poke around a bit,
> > but I can't do anything useful.  Specifically, the Admin functions are
> > deliberately disabled.  A message at the top of the page lets me know
> > this and points me to a Gnome interface which, not being a Gnome user, I
> > don't have.  It was suggested that this was disabled due to a policy of
> > having no running servers.  Does such a policy really exist?
>
> That's not quite correct; of course we do have running servers. The
> policy is to have no open ports to the outside world by default.
>
> > If so, does crippling the functionality of the CUPS web service
> > satisfy this policy?
>
> No, the disabling of the admin functionality was just a precautionary
> means to disallow access to /etc/shadow for cups. The message says
>
>   "/usr/share/doc/cupsys/README.Debian.gz describes the details and
>   how to reenable it again."
>
> and there you will find "sudo adduser cupsys shadow".
>
> Martin

Thanks Martin for this explanation.  I can certainly understand not wanting
CUPS to have access to /etc/shadow.  It's a much better answer than I've been
getting on irc and elsewhere on the list.  I suspect there's a better
solution than disabling the functionality of the admin interface, but since I
don't know what that might be right now I'll shut up until I come up with
some thing better.

--
ubuntu-devel mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel