Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Руководство по установке

Страница: 466 / 982

This is the best CUPS configuration for printing over remote CUPS servers.
However, there is a risk that an attacker sends IPP broadcasts with queues and the
local daemon accesses a counterfeit queue. If it then displays the queue with the
same name as another queue on the local server, the owner of the job may believe
the job is sent to a local server, while in reality it is sent to the attacker's server.
YaST can find CUPS servers by scanning local network hosts to see if they offer the
IPP service or by listening to IPP broadcasts. This requires the firewall to allow incoming
packets on port 631/UDP (service IPP client) to pass through. This is automatically
enabled when you have configured your machine to be in the internal firewall zone.
Opening a port to configure access to remote queues in the external zone can be a secu-
rity risk because an attacker could broadcast a server that might be accepted by users.
By default, IPP broadcasts are rejected in the external zone. See
Section 43.4.1, “Con-
figuring the Firewall with YaST” (page 822) for details of firewall configuration.
Alternatively, the user can detect CUPS servers by actively scanning the local network
hosts or configure all queues manually. However, this method is not recommended.
23.8.2 Changes in the CUPS Print Service
cupsd Runs as the User lp
On start-up,
cupsd
changes from the user
root
to the user
lp
. This provides a much
higher level of security, because the CUPS print service does not run with unrestricted
permissions, only with the permissions needed for the print service.
However, the authentication (the password check) cannot be performed via
/etc/
shadow
, because
lp
has no access to
/etc/shadow
. Instead, the CUPS-specific
authentication via
/etc/cups/passwd.md5
must be used. For this purpose, a CUPS
administrator with the CUPS administration group
sys
and a CUPS password must
be entered in
/etc/cups/passwd.md5
. To do this, enter the following as
root
:
lppasswd -g sys -a CUPS-admin-name
This setting is also essential if you want to use the CUPS administration Web front-end
or the KDE printer administration tool.
When
cupsd
runs as
lp
,
/etc/printcap
cannot be generated, because
lp
is not
permitted to create files in
/etc/
. Therefore,
cupsd
generates
/etc/cups/
448 Installation and Administration