samba - Sep 2006 - Setting Windows drivers gives access denied error

Good morning!

For some time I have been experiencing a problem with adding Windows 
drivers for printers available and configured in CUPS already. Not being 
utterly familiar with how the process works I first tried it as root 
from different Windows machines, both W2K and XP Pro. I saw the driver 
files being uploaded, but then got an error message 'Printer settings 
could not be saved. Access is denied.'.

So I decided to do it 'on foot' like the official Samba-3 book 
describes. Adding the drivers again was not a problem, but setting them 
gave a 'SetPrinter call failed! result was WERR_ACCESS_DENIED'.

Version of Samba is 3.0.7 on Solaris 5.9, so not the latest one, but it 
used to work, and now it doesn't, without any of my colleagues or me 
having changed a setting (at least not consciously).


testparm smb.conf showed no errors. The relevant bits in smb.conf
looks like this:

[global]
         workgroup = [snipped]
         netbios name = [snipped]
         server string = [snipped]
         interfaces = [snipped]
         nt acl support = yes
         wins server = [snipped]
         socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
         security = domain
         encrypt passwords = Yes
         hosts allow = [snipped]
         update encrypted = Yes
         log file = /var/log/samba.d/smb.%m
         max log size = 10000
         log level = 2
         name resolve order = lmhosts hosts wins bcast
         add user script = /usr/sbin/useradd -d /dev/null -g 212 -s 
/bin/false -M %u
         winbind trusted domains only = yes
         logon script = %U.pyw
         logon path = \\%L\%u\profile
         logon home = \\%L\%u
         logon drive = H:
         password server = [snipped]
         domain master = No
         preferred master = No
         domain logons = No
         os level = 69
         dns proxy = No
         load printers = yes
         printing = cups
         printcap name = cups
         printer admin = root, pcadmin
         #disable spoolss = No
         use client driver = No
         message command = /bin/mailx -s 'message from %f' \
         root < %s; rm %s

[print$]
         path = /usr/local/samba/printers
         browseable = yes
         read only = yes
         write list = root, pcadmin
         guest ok = Yes

[printers]
         comment = Test all printers
         path = /tmp
         browseable = no
         writeable = no
         printable = yes
         printer admin = root, pcadmin
         create mask = 0600
         guest ok = Yes
         use client driver =yes



I came as far as successfully adding the drivers to the
appropriate directory with

% /usr/local/samba/bin/smbclient //localhost/print\$ -U root \
-c 'cd W32X86; put [list of drivers snipped]'
Password:
Domain=[snipped] OS=[Unix] Server=[Samba 3.0.7]
[list of drivers snipped]

% /usr/local/samba/bin/rpcclient -U root -c \
'adddriver "Windows NT x86" "gavin:[list of drivers
snipped]"' \
localhost

and got a success message. But trying to set the drivers resulted in an
error:

% /usr/local/samba/bin/rpcclient -U root -c \
'setdriver gavin gavin' localhost
added interface ip=[snipped] bcast=[snipped] nmask=[snipped]
Password:
SetPrinter call failed!
result was WERR_ACCESS_DENIED


First I tried setting 'use client driver =no' in the printers section, 
but that didn't make any difference.


Then I got advised by a friend to change the following settings:
[global]
         log level = 7
         debug uid = yes

[print$]
         printer admin = root, pcadmin
         #write list = root, pcadmin


Having done that even copying the drivers failed, so I uncommented the 
write list entry again. Now I have some 1300 lines of output due to the 
high log level, but what should I actually be looking for?


Regards,
Gunde

Gundemarie Scholz wrote:
> For some time I have been experiencing a problem with adding Windows 
> drivers for printers available and configured in CUPS already. Not being 
> utterly familiar with how the process works I first tried it as root 
> from different Windows machines, both W2K and XP Pro. I saw the driver 
> files being uploaded, but then got an error message 'Printer settings 
> could not be saved. Access is denied.'.
> 
> So I decided to do it 'on foot' like the official Samba-3 book 
> describes. Adding the drivers again was not a problem, but setting them 
> gave a 'SetPrinter call failed! result was WERR_ACCESS_DENIED'.
> 
> Version of Samba is 3.0.7 on Solaris 5.9, so not the latest one, but it 
> used to work, and now it doesn't, without any of my colleagues or me 
> having changed a setting (at least not consciously).
Following up to myself, I now got the idea to use truss (strace 
equivalent for Solaris) in order to maybe see in more detail where 
exactly access is denied. In general, files seem to be opened readonly, 
except this one:

open64("/usr/local/samba/var/locks/gencache.tdb", O_RDWR|O_CREAT,
0644)
Err#13 EACCES


Changing the file to chmod 777 gave different output, but the error 
message in the end remained. Am I looking to the right direction there 
at all? More detailed logs can of course be provided if need be.

Regards,
Gunde

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/19/2006 07:50 AM, Gundemarie Scholz escreveu:
> Good morning!
> 
> For some time I have been experiencing a problem with adding Windows
> drivers for printers available and configured in CUPS already. Not being
> utterly familiar with how the process works I first tried it as root
> from different Windows machines, both W2K and XP Pro. I saw the driver
> files being uploaded, but then got an error message 'Printer settings
> could not be saved. Access is denied.'.
> 
> So I decided to do it 'on foot' like the official Samba-3 book
> describes. Adding the drivers again was not a problem, but setting them
> gave a 'SetPrinter call failed! result was WERR_ACCESS_DENIED'.
> 
> Version of Samba is 3.0.7 on Solaris 5.9, so not the latest one, but it
> used to work, and now it doesn't, without any of my colleagues or me
> having changed a setting (at least not consciously).
	That's *very* strange. Are you sure that nothing changed
in the Samba, CUPS and the OS itself? Did you tried with an early
version of Samba3? (3.0.14a and later).

	Did you check the procedures on the Chapter 22 of the
Official Samba HOWTO? Did you tried the cupsaddsmb?

> testparm smb.conf showed no errors. The relevant bits in smb.conf
> looks like this:
[...]
> [print$]
>         path = /usr/local/samba/printers
>         browseable = yes
>         read only = yes
>         write list = root, pcadmin
>         guest ok = Yes
	"guest ok" looks wrong here.

> [printers]
>         comment = Test all printers
>         path = /tmp
>         browseable = no
>         writeable = no
>         printable = yes
>         printer admin = root, pcadmin
>         create mask = 0600
>         guest ok = Yes
>         use client driver =yes
[...]
> First I tried setting 'use client driver =no' in the printers
section,
> but that didn't make any difference.
	The default is "use client driver = no". Check the manpage
of smb.conf about this paramenter and "disable spoolss", there are
some important points to be considered.


> Then I got advised by a friend to change the following settings:
> [global]
>         log level = 7
>         debug uid = yes
> 
> [print$]
>         printer admin = root, pcadmin
>         #write list = root, pcadmin
> 
> 
> Having done that even copying the drivers failed, so I uncommented the
> write list entry again. Now I have some 1300 lines of output due to the
> high log level, but what should I actually be looking for?
	You should be looking for permission problems to write in
the directory and permission problems to talk with CUPS to
register information, both are possible, depending on your setup.

> Regards,
> Gunde
	Kind regards,

- --
Felipe Augusto van de Wiel <felipe@paranacidade.org.br>
Coordenadoria de Tecnologia da Informa??o (CTI) - SEDU/PARANACIDADE
http://www.paranacidade.org.br/           Phone: (+55 41 3350 3300)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with Debian - http://enigmail.mozdev.org

iD8DBQFFGBJ8Cj65ZxU4gPQRAhiCAJ9jNS10SQyd/jZn4dKmT83wz9wqKQCgv2BW
JuDd4ef7MSnktCI0B2iNmvo=IZ1B
-----END PGP SIGNATURE-----

For adding printer drivers you should grant permission to the user whom you
ll use as printer operator / Administrator.
Login as a above mentioned delegated user in remote machine / local and add
printer / driver.

If you put  "guest ok = yes" in config file at "print$" , it
will consider
the connected user as a guest &  it wont validate credentials. In that case
even if you logged in as a privileged user , you will be treated as guest.
hence its not possible to add printer / driver as a guest.
remove guest ok = yes at print$.
Now when you login to remote windows machine / local and connect to cups
server then add drivers it will validate your credentials.
if already permission granted, driver will be successfully get added.
If you have any doubt on configuring printer server please go through

https://wiki.samba.org/index.php/Configuring_Point%27n%27Print_automatic_printer_driver_deployment

Thanks



--
View this message in context:
http://samba.2283325.n4.nabble.com/Setting-Windows-drivers-gives-access-denied-error-tp2425858p4694435.html
Sent from the Samba - General mailing list archive at Nabble.com.