lprng-devel — ML for discussions regarding the development of lprng

[Lprng-devel] MacOS Lion, Kerberos, etc.

[Rick C. <rc...@co...>]

I have managed to figure out how to build LPRng under 10.6 in such a way that it 
works under 10.5 Intel/ppc, 10.6 Intel, and 10.7.  However, under 10.7 it works 
only if I disable Kerberos encryption of the print job data, and do not use 
cross-realm authentication.  The former doesn't bother me much.  The second is 
seriously annoying.

The Kerberos story for MacOS Lion is described here:
http://linsec.ca/blog/2011/07/26/kerberos-on-os-x-10-7-lion/

-Rick

Re: [Lprng-devel] missing var docu

[Craig S. <csm...@en...>]

On Fri, Jul 01, 2011 at 10:31:47AM +0200, walter harms wrote:
> i was trying to fix some connection problems by increasing the
> number of attempts the lpr does. Thereby i notices that lpr_send_try
> is not documented. did i make a mistake of is it really not documented ?
send_try is defined but not lpr_send_try and they're different.

send_try is used for server->printer while lpr_send_try is lpr->server

The man page isn't too explicit about that.

 - Craig
-- 
Craig Small VK2XLZ    http://www.enc.com.au/       csmall at : enc.com.au
Debian GNU/Linux      http://www.debian.org/       csmall at : debian.org
GPG fingerprint:       1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5

[Lprng-devel] missing var docu

[walter h. <wh...@bf...>]

hi list,
i was trying to fix some connection problems by increasing the
number of attempts the lpr does. Thereby i notices that lpr_send_try
is not documented. did i make a mistake of is it really not documented ?

re,
 wh

Re: [Lprng-devel] [PATCH] don't install monitor.1 manpage, as monitor is not installed either.

[walter h. <wh...@bf...>]

Thx for fixing

re,
 wh


Am 01.06.2011 11:52, schrieb Bernhard R. Link:
> ---
>  already pushed as quite trivial
> 
>  man/Makefile.am |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/man/Makefile.am b/man/Makefile.am
> index 0ff4c22..a6701d5 100644
> --- a/man/Makefile.am
> +++ b/man/Makefile.am
> @@ -1,8 +1,8 @@
>  MAINTAINERCLEANFILES = Makefile.in
>  man_MANS = cancel.1 checkpc.8 lp.1 lpbanner.1 lpc.8 lpd.8 lpd.conf.5 \
> -	 lpd.perms.5 lpf.1 lpq.1 lpr.1 lprm.1 lpstat.1 monitor.1 pclbanner.1 \
> +	 lpd.perms.5 lpf.1 lpq.1 lpr.1 lprm.1 lpstat.1 pclbanner.1 \
>  	 printcap.5 psbanner.1 lprng_certs.1 lprng_index_certs.1
> -CLEANFILES = $(man_MANS)
> +CLEANFILES = $(man_MANS) monitor.1
>  EXTRA_DIST = cancel.n checkpc.n lp.n lpbanner.n lpc.n lpd.n lpd.conf.n \
>  	 lpd.perms.n lpf.n lpq.n lpr.n lprm.n lpstat.n monitor.n pclbanner.n \
>  	 printcap.n psbanner.n  lprng_certs.n lprng_index_certs.n

[Lprng-devel] [PATCH] don't install monitor.1 manpage, as monitor is not installed either.

[Bernhard R. L. <br...@de...>]

---
 already pushed as quite trivial

 man/Makefile.am |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/man/Makefile.am b/man/Makefile.am
index 0ff4c22..a6701d5 100644
--- a/man/Makefile.am
+++ b/man/Makefile.am
@@ -1,8 +1,8 @@
 MAINTAINERCLEANFILES = Makefile.in
 man_MANS = cancel.1 checkpc.8 lp.1 lpbanner.1 lpc.8 lpd.8 lpd.conf.5 \
-	 lpd.perms.5 lpf.1 lpq.1 lpr.1 lprm.1 lpstat.1 monitor.1 pclbanner.1 \
+	 lpd.perms.5 lpf.1 lpq.1 lpr.1 lprm.1 lpstat.1 pclbanner.1 \
 	 printcap.5 psbanner.1 lprng_certs.1 lprng_index_certs.1
-CLEANFILES = $(man_MANS)
+CLEANFILES = $(man_MANS) monitor.1
 EXTRA_DIST = cancel.n checkpc.n lp.n lpbanner.n lpc.n lpd.n lpd.conf.n \
 	 lpd.perms.n lpf.n lpq.n lpr.n lprm.n lpstat.n monitor.n pclbanner.n \
 	 printcap.n psbanner.n  lprng_certs.n lprng_index_certs.n
-- 
1.7.2.5

Re: [Lprng-devel] how to prevent lprm-ing a spooled, active job to avoid accounting

[Iordan I. <io...@cd...>]

Hi Craig,

On 03/19/11 07:15, Craig Small wrote:
 > Would two queues do what you are after? one public queue and then push
 > the job to the second queue which cannot have jobs removed?

I had no idea that this could even be done. I'll look into it today.

Over the weekend I was thinking of doing something rougher than that.

The accounting script is called twice by ifhp - once in the beginning 
and once at the end (filestart and fileend). At filestart, for job M, I 
was thinking of dropping a file in (for example) 
"/var/run/printaccounting/printerN" with a username and pagecountM, and 
at fileend, removing that file. If the next printjob in printerN's spool 
"finds" a file in the directory, it can "correct" the quota of username 
by (pagecountM+1 - pagecountM).

That's a bit of a hack though. So I take it there is no neat way to tell 
LPD to disallow removal of active jobs? In most academic environments 
with enterprise printers, the removal of an "active" job does nothing 
because the job has been spooled anyway!

Cheers,
Iordan

Re: [Lprng-devel] how to prevent lprm-ing a spooled, active job to avoid accounting

[Bernhard R. L. <br...@de...>]

* Craig Small <csm...@en...> [110319 12:34]:
> On Fri, Mar 18, 2011 at 05:09:39PM -0400, Iordan Iordanov wrote:
> > How does one prevent a user from sending a job, and when the job has 
> > been spooled onto the printer (our printers spool), to lprm it, thus 
> > avoiding our accounting mechanism? Yes, with 5000 users, we are forced 
> > to do some form of accounting, otherwise the printers will be constantly 
> > empty and out of toner... Our users print stuff completely unrelated to 
> > their CS courses all the time :)
> Those sneaky CS students, I rememeber in my day.. but i digress.
>
> Would two queues do what you are after? one public queue and then push
> the job to the second queue which cannot have jobs removed?

If anyone has time, looking at job removal would be nice. There is also
the problem that if a filter rejects a job, the rejection message is
stored in that job but the job then removed so one gets "mysterious"
errors. Perhaps lprng needs to keep removed jobs a bit longer so that
accounting information and error messages are kept long enough.

	Bernhard R. Link

Re: [Lprng-devel] how to prevent lprm-ing a spooled, active job to avoid accounting

[Craig S. <csm...@en...>]

On Fri, Mar 18, 2011 at 05:09:39PM -0400, Iordan Iordanov wrote:
> How does one prevent a user from sending a job, and when the job has 
> been spooled onto the printer (our printers spool), to lprm it, thus 
> avoiding our accounting mechanism? Yes, with 5000 users, we are forced 
> to do some form of accounting, otherwise the printers will be constantly 
> empty and out of toner... Our users print stuff completely unrelated to 
> their CS courses all the time :)
Those sneaky CS students, I rememeber in my day.. but i digress.

Would two queues do what you are after? one public queue and then push
the job to the second queue which cannot have jobs removed?

 - Craig
-- 
Craig Small VK2XLZ    http://www.enc.com.au/       csmall at : enc.com.au
Debian GNU/Linux      http://www.debian.org/       csmall at : debian.org
GPG fingerprint:       1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5

[Lprng-devel] how to prevent lprm-ing a spooled, active job to avoid accounting

[Iordan I. <io...@cd...>]

Hello everyone,

It took me a little while to find the new mailing list (I was trying to 
subscribe to the old one). We are thinking of making use of lprng at the 
Dept. of Computer Science at University of Toronto, and I am currently 
making sure it will work within our environment.

How does one prevent a user from sending a job, and when the job has 
been spooled onto the printer (our printers spool), to lprm it, thus 
avoiding our accounting mechanism? Yes, with 5000 users, we are forced 
to do some form of accounting, otherwise the printers will be constantly 
empty and out of toner... Our users print stuff completely unrelated to 
their CS courses all the time :)

One way to deal with this would be to prevent users from removing the 
*active* job on the queue, right? I guess an evil hack would be to wrap 
lprm, but that won't prevent savvy users from finding the real lprm and 
just using it.

Another way would be to acknowledge the lprm request, and to stop 
sending data to the printer if data is still being sent, but to then let 
the (ifhp) filter continue with its accounting work.

I am successfully doing accounting with ifhp, and it's working great, 
except for lprng being quite compliant in allowing users to wipe out 
their own active jobs...

Many thanks in advance,
Iordan Iordanov

[Lprng-devel] GCOS

[walter h. <wh...@bf...>]

Google is running an other "Google Summer of Code".

I hope it would be a good idea to participate. The basic idea is to get
a student to look at the code and so some time test to improve responsiveness
especially with large numbers of files.

who is the position of the ML to this ? any objections ?

re,
 wh

FAQ: http://www.google-melange.com/document/show/gsoc_program/google/gsoc2011/faqs#owns

[Lprng-devel] LPRng 3.8.B released

[Bernhard R. L. <br...@de...>]

* walter harms <wh...@bf...> [110225 09:02]:
> IMHO we can go on and release. The bug noticed by Rick Cochran will need fixing
> but can wait for the next release.

Aye. 3.8.B uploaded

	Bernhard R. Link

Re: [Lprng-devel] DOS (sort of)

[walter h. <wh...@bf...>]

Am 25.02.2011 01:05, schrieb Rick Cochran:
> I'm currently using LPRng-3.8.32 under RHEL 5.  I should probably test 
> your distribution, but what I have has been working well ... except for 
> one thing.
> 
> Whenever our security folks do a Nessus scan, I get one spinning lpd 
> process on each of the four servers running LPRng.
> 
> I _never_ get spinning lpd processes otherwise.
> 
> Is this worth the effort to chase it down?
> 

I guess yes, it does not matter how you can trigger the bug.
lprng is stable and we can go and hunt rare bugs. Is it possible
to use our latest release and see if the problem reappears ?


> Has anyone else seen similar behavior?
> 
I have some strange effects normally associated with network problems.
But i was not able to reproduce it and is not associated with dataloss.

re,
 wh


> -Rick
> 

Re: [Lprng-devel] Patch for build failure on recent Ubuntu and Debian

[walter h. <wh...@bf...>]

brl, what do you think ?

IMHO we can go on and release. The bug noticed by Rick Cochran will need fixing
but can wait for the next release.

re,
 wh



Am 24.02.2011 22:50, schrieb Craig Small:
> On Sat, Feb 19, 2011 at 04:57:55PM +0100, Bernhard R. Link wrote:
>> I've applied the following patch. That tests for krb5_encrypt_size at
>> configure time, so it should be better to detect what libs to use and
>> at least fail at configure time instead of compile time.
> Good idea.
> Also, is that upcoming release nearly ready?  I've got an important bug
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=555565 that's pretty
> simple to fix with some compile time flags.  So I can rebuild the old
> package or update to the new.
> 
>  - Craig

[Lprng-devel] DOS (sort of)

[Rick C. <rc...@co...>]

I'm currently using LPRng-3.8.32 under RHEL 5.  I should probably test 
your distribution, but what I have has been working well ... except for 
one thing.

Whenever our security folks do a Nessus scan, I get one spinning lpd 
process on each of the four servers running LPRng.

I _never_ get spinning lpd processes otherwise.

Is this worth the effort to chase it down?

Has anyone else seen similar behavior?

-Rick

Re: [Lprng-devel] Patch for build failure on recent Ubuntu and Debian

[Craig S. <csm...@en...>]

On Sat, Feb 19, 2011 at 04:57:55PM +0100, Bernhard R. Link wrote:
> I've applied the following patch. That tests for krb5_encrypt_size at
> configure time, so it should be better to detect what libs to use and
> at least fail at configure time instead of compile time.
Good idea.
Also, is that upcoming release nearly ready?  I've got an important bug
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=555565 that's pretty
simple to fix with some compile time flags.  So I can rebuild the old
package or update to the new.

 - Craig
-- 
Craig Small VK2XLZ    http://www.enc.com.au/       csmall at : enc.com.au
Debian GNU/Linux      http://www.debian.org/       csmall at : debian.org
GPG fingerprint:       1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5

Re: [Lprng-devel] Patch for build failure on recent Ubuntu and Debian

[Bernhard R. L. <br...@de...>]

* Geoffrey Thomas <ge...@MI...> [110215 09:26]:
> gcc -g -O2 -Wl,-Bsymbolic-functions -o lpr lpr.o openprinter.o stty.o
>   child.o copyright.o debug.o errormsg.o fileopen.o gethostinfo.o getopt.o
>   getprinter.o getqueue.o globmatch.o initialize.o krb5_auth.o linelist.o
>   linksupport.o lockfile.o merge.o plp_snprintf.o printjob.o proctitle.o
>   sendjob.o sendauth.o sendreq.o ssl_auth.o user_auth.o utilities.o vars.o
>   md5.o -lkrb5 -lcrypto -lcom_err
> /usr/bin/ld: krb5_auth.o: undefined reference to symbol 'krb5_encrypt_size@@k5crypto_3_MIT'
> /usr/bin/ld: note: 'krb5_encrypt_size@@k5crypto_3_MIT' is defined in DSO /usr/lib/libk5crypto.so.3 so try adding it to the linker command line
> /usr/lib/libk5crypto.so.3: could not read symbols: Invalid operation
> collect2: ld returned 1 exit status
> make[3]: *** [lpr] Error 1
>
> So as mentioned by the error message, we need to have -lk5crypto on the
> command line. configure.ac checks for -lcrypto before -lk5crypto for some
> reason. One way to fix this would be to switch the order of those checks,
> but it seems to me cleaner to just use krb5-config --libs to figure out
> what libraries the installed Kerberos package says are needed.

I've applied the following patch. That tests for krb5_encrypt_size at
configure time, so it should be better to detect what libs to use and
at least fail at configure time instead of compile time.

I've moved the k5crypte to be tested first. It looks more special so
should be better than pulling in an unused crypto library.

krb5-config outputs -L/usr/lib here. That's too broken for me to call it
by default but I've added it as last check if the others do not work.


	Bernhard R. Link

[Lprng-devel] Patch for build failure on recent Ubuntu and Debian

[Geoffrey T. <ge...@MI...>]

Hi,

Debian will be updating its toolchain to use the --no-copy-dt-needed-entries
option, and Ubuntu has already updated its toolchain to do so. In short, 
this makes the linker much picker about command lines (e.g., you need to 
say "cc foo.o -lbar", not "cc -lbar foo.o"). See
   http://wiki.debian.org/ToolChain/DSOLinking
for more details.

The relevant part for LPRng, though, is that it fails to compile on 
Ubuntu Natty with the following error:

gcc -g -O2 -Wl,-Bsymbolic-functions -o lpr lpr.o openprinter.o stty.o
   child.o copyright.o debug.o errormsg.o fileopen.o gethostinfo.o getopt.o
   getprinter.o getqueue.o globmatch.o initialize.o krb5_auth.o linelist.o
   linksupport.o lockfile.o merge.o plp_snprintf.o printjob.o proctitle.o
   sendjob.o sendauth.o sendreq.o ssl_auth.o user_auth.o utilities.o vars.o
   md5.o -lkrb5 -lcrypto -lcom_err
/usr/bin/ld: krb5_auth.o: undefined reference to symbol 'krb5_encrypt_size@@k5crypto_3_MIT'
/usr/bin/ld: note: 'krb5_encrypt_size@@k5crypto_3_MIT' is defined in DSO /usr/lib/libk5crypto.so.3 so try adding it to the linker command line
/usr/lib/libk5crypto.so.3: could not read symbols: Invalid operation
collect2: ld returned 1 exit status
make[3]: *** [lpr] Error 1

So as mentioned by the error message, we need to have -lk5crypto on the 
command line. configure.ac checks for -lcrypto before -lk5crypto for some 
reason. One way to fix this would be to switch the order of those checks, 
but it seems to me cleaner to just use krb5-config --libs to figure out 
what libraries the installed Kerberos package says are needed.

I've attached a patch to use the output krb5-config if available; the 
patch applies cleanly to both 3.8.A and 3.8.B~rc2. I've also submitted 
this patch to Ubuntu at http://bugs.launchpad.net/bugs/719181 since you 
currently can't rebuild the Ubuntu package from source after the toolchain 
transition.

In case the patch doesn't get through e-mail, see also
   http://web.mit.edu/geofft/debathena/lprng-krb5-config.patch

-- 
Geoffrey Thomas
ge...@mi...

Re: [Lprng-devel] Moving to git?

[Craig S. <csm...@en...>]

On Thu, Feb 03, 2011 at 06:32:49PM +0100, Bernhard R. Link wrote:
> As it is very annoying to make changes to a git repository after its
> publishing, any corrections to the history should be ideally made before
> that is moved to SF.net, if we decide to switch to git.
I switched all of my SF.net projects to git and haven't looked back
since.  i think the only CVS archive I use now is the Debian website.

 - Craig
-- 
Craig Small VK2XLZ    http://www.enc.com.au/       csmall at : enc.com.au
Debian GNU/Linux      http://www.debian.org/       csmall at : debian.org
GPG fingerprint:       1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5

Re: [Lprng-devel] Release candidate 2 of 3.8.B

[Craig S. <csm...@en...>]

On Sun, Feb 06, 2011 at 09:01:25PM +0100, Bernhard R. Link wrote:
> * walter harms <wh...@bf...> [110206 20:21]:
> > Am 03.02.2011 22:14, schrieb Bernhard R. Link:
> > > I've just uploaded lprng-3.8.B~rc2.tar.gz to
> > > http://sourceforge.net/projects/lprng/files/lprng/
> > >
> > any reason for this "~" ?
> 
> Habit. (In Debian versions the ~ is needed to denote a part that does
> not increase the version but comes before anything without).
It also means that 3.8.B is "newer than" 3.8.B~rc2 if you use -rc2
its not newer.

 - Craig
-- 
Craig Small VK2XLZ    http://www.enc.com.au/       csmall at : enc.com.au
Debian GNU/Linux      http://www.debian.org/       csmall at : debian.org
GPG fingerprint:       1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5

Re: [Lprng-devel] Release candidate 2 of 3.8.B

[Bernhard R. L. <br...@de...>]

* walter harms <wh...@bf...> [110206 20:21]:
> Am 03.02.2011 22:14, schrieb Bernhard R. Link:
> > I've just uploaded lprng-3.8.B~rc2.tar.gz to
> > http://sourceforge.net/projects/lprng/files/lprng/
> >
> any reason for this "~" ?

Habit. (In Debian versions the ~ is needed to denote a part that does
not increase the version but comes before anything without).

	Bernhard R. Link

Re: [Lprng-devel] Moving to git?

[walter h. <wh...@bf...>]

Hello Bernhard,
thx for your effort.

i can not object the move the git.
personally i feel that CVS is more than enough
but since sourceforge does not like CVS (but i read
several people still like it, like me).

It is bad that this happens when we try to get the latest release out.

re,
 wh


Am 03.02.2011 18:32, schrieb Bernhard R. Link:
> As sourceforge.net has still not restored cvs after the SF compromise,
> the CVS repository for lprng is still not reachable currently.
> 
> Given those problems and that sourgeforge might discontinue CVS
> alltogether in a not too far future (at least
> http://sourceforge.net/blog/sourceforge-attack-full-report/
> says they are "considering the end-of-life of the CVS service" it might
> make sense to switch to another VCS.
> 
> I'd suggest git, and I have prepared a git repository with most of the
> CVS history included, which can be previewed via
> 
> git clone http://132.230.30.150/~brl/lprng.git (it's about 28 MB).
> 
> As it is very annoying to make changes to a git repository after its
> publishing, any corrections to the history should be ideally made before
> that is moved to SF.net, if we decide to switch to git.
> 
> In this suggestion, the "master" branch contains all changes done in the
> CVS repository, starting its history with the imported 3.8.28 version
> (and not including the parts of the tarfile included in the CVS
> repository back then).
> 
> There is also an additional "all-history" branch having that replayed on
> top of a history of all the old tar files I still have imported into git
> with as little changes as possible (some fixes to CHANGES to make
> finding the commit introducing some change easier and a .tbz file
> excluded to save space).
> 
> 	Bernhard R. Link
> 

Re: [Lprng-devel] Release candidate 2 of 3.8.B

[walter h. <wh...@bf...>]

Am 03.02.2011 22:14, schrieb Bernhard R. Link:
> I've just uploaded lprng-3.8.B~rc2.tar.gz to
> http://sourceforge.net/projects/lprng/files/lprng/
> 
> 	Bernhard R. Link
> 

any reason for this "~" ?

re,
 wh

[Lprng-devel] Release candidate 2 of 3.8.B

[Bernhard R. L. <br...@de...>]

I've just uploaded lprng-3.8.B~rc2.tar.gz to
http://sourceforge.net/projects/lprng/files/lprng/

	Bernhard R. Link

[Lprng-devel] Moving to git?

[Bernhard R. L. <br...@de...>]

As sourceforge.net has still not restored cvs after the SF compromise,
the CVS repository for lprng is still not reachable currently.

Given those problems and that sourgeforge might discontinue CVS
alltogether in a not too far future (at least
http://sourceforge.net/blog/sourceforge-attack-full-report/
says they are "considering the end-of-life of the CVS service" it might
make sense to switch to another VCS.

I'd suggest git, and I have prepared a git repository with most of the
CVS history included, which can be previewed via

git clone http://132.230.30.150/~brl/lprng.git (it's about 28 MB).

As it is very annoying to make changes to a git repository after its
publishing, any corrections to the history should be ideally made before
that is moved to SF.net, if we decide to switch to git.

In this suggestion, the "master" branch contains all changes done in the
CVS repository, starting its history with the imported 3.8.28 version
(and not including the parts of the tarfile included in the CVS
repository back then).

There is also an additional "all-history" branch having that replayed on
top of a history of all the old tar files I still have imported into git
with as little changes as possible (some fixes to CHANGES to make
finding the commit introducing some change easier and a .tbz file
excluded to save space).

	Bernhard R. Link

[Lprng-devel] How about releasing 3.8.B

[Bernhard R. L. <br...@de...>]

As there are quite some changes since 3.8.A I'd suggest we
release 3.8.B before including the ipp stuff (as that might still
need some changes until it is ready).

Walter, what do you think?

	Bernhard R. Link