1

This is driving me up the wall! I feel I'm so close, but I'm probably missing just one tiny detail.

I have a Ubuntu desktop setup to be a CUPS server. I need to add printers via the GUI interface, rather than the CUPS web-interface. When I'm logged in locally to the server, no problem, works great!

However, when I start a remote session via X2Go, with the same user, I can open and see printers that are already attached to the server, but that's its. I can't do anything else. No adding. No removing. No editing. Nothing. (There is one tiny exception to this: If I start a remote session via X2Go, logging in as root, this works. I can modify printers. Not sure on that one what the reason is.)

The "Unlock" icon in the top-right corner of the Printer GUI is greyed out and I get the "System policy prevents changes" when I hover over it. I've done enough research to know that this is something to do with the polkit in Ubuntu; however, I evidently don't have the .pkla file just right as nothing I put in it seems to makes a difference.

This is my current .pkla file:

[Modify printers remotely]
Identity=unix-user:{remote_user}
Action=org.opensuse.cupspkhelper.mechanism.printeraddremove
ResultInactive=auth_self
ResultActive=auth_self

It's stored in: /etc/polkit-1/localauthority/50-local.d.

Am I missing anything in the file that would prevent a remote-connected user from modifying the printers via GUI? Is this just not something that polkit is supposed to support? I'm completely out of ideas.

Server is running Ubuntu 20.04, CUPS 2.3.1, and pkaction version 0.105

Thanks everyone for any help!

1 Answer 1

1

This same issue was also giving me conniptions! I have a very similar configuration and experienced the inability to unlock printer settings when running a remote session from RDP on Windows. As you noted, the guidance from researching the existing materials wasn't particularly helpful either. It only got me to about the same place as you — i.e., not quite solving the issue completely. One would think modifying printers remotely is such a common task so as to have a solution in place already ... but apparently not.

However, just today, it seems like I've identified the final step that's needed to get over the finish line. It's only a minor adjustment from what you had, but the result is the ability to unlock printer settings remotely.

More data can be found in polkit man page (this link is to the Focal Fossa docs but should be quite similar for other versions).

The slightly modified file contents is as follows, right after you can find details about why this configuration:

[Modify printers remotely]
Identity=unix-user:{remote_user}
Action=org.opensuse.cupspkhelper.mechanism.*
ResultAny=auth_admin_keep

Inside square brackets there is title that must be unique inside the file.

The Identity key specify to which user or groups this rule applies.

In your example you used the two keys ResultActive and ResultInactive: both are referring to a local session, not a remote one; instead the key ResultAny refers to any subject. By testing on Ubuntu 20.04 LTS (Focal Fossa) I determined that adding only ResultAny does not affect the local session, so if you connect locally you do not have to enter admin password to edit printers (keep in mind that anyway this wold be limited to the user specified in the Identity).

I changed the Action key to a glob value org.opensuse.cupspkhelper.mechanism.* that includes more actions than just adding, editing or deleting a printer. You can see individual actions that are being allowed by running pkaction | grep org.opensuse.cupspkhelper.mechanism..

The location of the pkla file should be /etc/polkit-1/localauthority/50-local.d/. As far as the name of the file it could be anything you like, keeping in mind that, if there are multiple files, these are evaluated in order (for better understanding see man page linked above) — I happen to use "99-printing.pkla".

Note that polkit will recognize these settings immediately once the pkla file is created in the directory given above. When the pkla file is saved, it is immediately effective (no need to logout and login). In subsequent remote sessions the user will be able to unlock the printer settings by authenticating. If authenticating is deemed unnecessary, just replace auth_admin_keep in the pkla file with yes and the unlock step can be bypassed completely instead.

I hope this is useful!

2
  • Thanks! Very helpful
    – Alek_A
    May 12, 2022 at 9:27
  • Hi Alessandro and kotodama! With Ubuntu 22.04, i cannot add any printers in the settings dialog (I have to unlock this function by pressing the button "Unlock"). I am stuck, followed your instructions above! Any Tipps here?
    – pedda
    Oct 8, 2022 at 16:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .