1

I have a printer hosted on Ubuntu 14.04 LTS that I've been tasked with locking down. The printer needs to be accessible to both legitimate Windows (7/10) and Ubuntu 14.04 users, but not generally accessible.

At this point, I can get the printer to broadcast via both CUPS and Samba, and I can print from the printer from any Windows computer, but I can't get the server to challenge the print attempt with a request for authentication. The Samba config challenges for a username/password when attempting to access a shared folder on the Ubuntu server from a Windows machine, but not when adding a printer.

Please let me know if I can provide any additional information, or if what I'm trying to do is impossible.

Thank you

  • Related: This old post had asked on "Ubuntu 12.04 network printing through Windows Samba server", which has one most upvoted answer that explained on how to set up credentials for the network printer. – clearkimura Jan 7 '16 at 9:30
1

I had a similar problem recently and the linked post in the singular comment above didn't actually answer the question posed here (setting up Windows with Samba authenticated printer shares, NOT the other way around). I wanted to only allow authenticated access to printers shared from Linux. In addition, I'm running Ubuntu Server LTS, which means command-line only access (via SSH in my case) so most tutorials/guides I'm finding show the Ubuntu GUI and are therefore useless to me.

The [printers] section with the option printable = yes defines the mapping to CUPS. Setting browseable = no prevents this option from being displayed in printer lists. It's the actual printer spool for print jobs, so that makes sense. However, by default, anyone with a correctly configured printer setup pointed at and can access the Samba server has implicit access to print without privileges (i.e. anonymous access). To force authenticated access to the print spooler, I used the valid users = bob, joe, mary option.

Windows looks for the print$ share name for printers. The associated section [print$] declares browseable = yes, which grants anyone who connects to the Samba server the ability to see the available printers. Even though guest ok = no is the default, Samba still allows what I consider to be anonymous access to any printer. To force authentication, I used the valid users = bob, joe, mary option. If you want to hide printers from being seen in the first place from unauthenticated users, you can try using browseable = no and then use the include = /etc/samba/print.%U.conf option to change browseable = yes for specific users as per this Unix StackExchange post:

https://unix.stackexchange.com/questions/245785/show-specific-samba-shares-only-to-some-users

Bringing it all together, /etc/samba/smb.conf now looks like:

[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700
   valid users = bob, joe, mary

[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
   valid users = bob, joe, mary

One side effect of requiring authentication that I ran into on Windows was that attempting to double-click on a printer to Open it (the default verb on Windows) as an unrecognized user caused an "Access Denied" message box to appear but was never prompted for credentials. Windows was probably passing along that user's logged in Windows credentials in that instance. Fortunately, right-clicking and selecting the "Connect..." option prompted for credentials. After connecting successfully, I was able to Open the printer, which asked me to manually set up my printer drivers since I don't attempt to deliver those via Samba and is beyond the scope of the answer to this question. Then I successfully printed a test page and all was well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.