42

I have an Ubuntu server in my apartment and I just got a printer, so it's time to share!

In the past I've used CUPS on my Desktop and I'd just point the browsers to localhost:631 to set things up. Can I used the web based admin tools remotely?

I've been playing with the /etc/cups/cupsd.conf file and am currently at the point where I can direct a browser on my LAN to server-ip:631 but I'm getting the 403 Forbidden error.

If it's not possible or it's a bad idea for security reasons to allow remote administrator of CUPS, would it be possible to accomplish this using an SSH tunnel to the sever?

43

I found this way to be simpler.

# cupsctl --remote-admin --remote-any --share-printers

It will update the /etc/cups/cupsd.conf file and restart cups for you, saving a backup of the previous configuration in the same folder.

It's the similar to the method presented in the official CUPS guide to printer sharing. I found the options --remote-admin in man cupsctl.

  • 5
    It's sad to see many people browsing/referencing distribution-specific docs, blogs, and other sources rather than CUPS online help. :/ – basilikode Oct 4 '14 at 11:54
  • 1
    Always use the recommended way first! They made the software! – FreeSoftwareServers Jul 27 '15 at 20:45
  • 5
    That's probably because they don't know what questions to ask; often, to use documentation, you either need to know exactly what you're looking for, or read the entire manual - not fun, and takes way too long. We also don't want to be CUPS experts, we just want to know how to flip one little switch. – Dagrooms Jun 1 '17 at 18:16
  • 1
    i had to do sudo service cups restart after this, but then it worked! :) (debian 10 32bit) – hanshenrik Mar 12 '18 at 8:41
  • no restart needed for me. Debian 8,9 and Arch – eri Apr 19 '18 at 10:13
30

The way I normally achieve this is to tunnel over ssh via an arbitrary port:

ssh admin@10.36.8.43 -T -L 3631:localhost:631

Secure, and allows remote access. Won't solve all problems but useful for irregular access.

  • 2
    This tip is awesome: without changing anything on the cups configuration, you can securely administrate cups. – gerlos Feb 27 '14 at 17:46
  • The -T option is not really needed; it will just prevent creation of a terminal session. Leave it out if you also need a terminal session for some reason. – user149408 Mar 4 '18 at 16:38
29

Mission achomplished! This page helped me out a lot.

All I had to do was add "Allow all" to to the access to the server and the admin pages so that my configuration now looked like:

# Restrict access to the admin pages...
<Location /admin>
  Order allow,deny
  Allow all
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
</Location>

Now I just need to figure out to only allow those on my local network to access the admin pages and the configuration files :) (though it's probably not a big deal since I don't have port forwarding for 631 set up on the router?).

EDIT: To only allow a certain computer I could have done something like

<Location /admin>
      Order allow,deny
      Allow from 10.10.10.5
</Location>

Or for the whole 10.10.10 subnet,

<Location /admin>
      Order allow, deny
      Allow from 10.10.10.*
</Location>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.