samba - Dec 2001 - [printers], admin users, "print operators" deleting other people's jobs

Hello all.

I've been running Samba for quite some time but am now trying to move it
up from (some rather limited) file sharing into being a full PDC for our
network.  I figured out all the "hard stuff" but am having a heck of a
time with the printing.

What I need to make sure of is that certain people can pause/delete, etc
print jobs for other users, as well as start or stop the entire queue.
I'd sure like them *NOT* to be root (or at least have the root password)
to do this.

I had figured placing "admin users" in the printers section would do
this.
After an hour of trying to figure out why it wouldn't work I wrote a
little wrapper around the lprng commands to find that it seems samba will
submit print jobs for these people as root (the lpr command) but does not
do it for the other commands, in this case specifically the lppause
command.

I'm using 2.22 on Openbsd 3.0, with lprng using the ifhp filter.

I was about to switch to force user and write my own scripts to provide
this functionality, but this is such a common (I'd think) thing people
would want to do I must be doing something wrong.  For the life of my I
can't figure out what it is!

Any help would be greatly appreciated.  The pertinent portions of my
smb.conf are below:

# Printing stuff here
        printing = lprng
        disable spoolss = yes
        printcap name = /etc/printcap
        print command = /usr/local/bin/lpr  -U%U -P%p -r %s
        lpq command   = /usr/local/bin/lpq  -U%U -P%p
        lprm command  = /usr/local/bin/lprm -U%U -P%p %j
        lppause command = /usr/local/sbin/lpc -U%U hold %p %j
        lpresume command = /usr/local/sbin/lpc -U%U release %p %j
        queuepause command = /usr/local/sbin/lpc -U%U -P%p stop
        queueresume command = /usr/local/sbin/lpc -U%U -P%p start

[printers]
        comment = All Printers

        path = /var/spool/samba
        admin users = samm pulu mycall sepiuta samt
        printer admin = samm pulu mycall sepiuta samt
        guest ok = Yes
        printable = Yes


As an aside, is there a way to get the filenames of the jobs to end up
being close to or similar to what they were when they were submitted?
This isn't a really big deal, but it would be nice.

Pulu


----
Pulu 'Anau
Queen Salote College
http://www.qsc.to - (676) 24-911

Make the change noted below in your print command, and you should get
the file name in the print queue.  This will be only the first 20 or
so letters of the file name. A nuisance if you have a microsoft word
document with a long prefix (Microsoft document or some such). You could
use a preexec to remove unwanted prefixes from these file names.
Look into /etc/lpd.perms to see how to allow certain users rights to control
queues. It won't be obvious but it can be done, they claim.
Joel


On Wed, Dec 26, 2001 at 07:31:54AM +1300, Pulu 'Anau
wrote:
> Hello all.
> What I need to make sure of is that certain people can pause/delete, etc
> print jobs for other users, as well as start or stop the entire queue.
> I'd sure like them *NOT* to be root (or at least have the root
password)
> to do this.
> 
snip
> smb.conf are below:
> 
> # Printing stuff here
>         printing = lprng
>         disable spoolss = yes
>         printcap name = /etc/printcap
>         print command = /usr/local/bin/lpr  -U%U -J'%J' -P%p -r %s
                                                   
^^^^^
>         lpq command   = /usr/local/bin/lpq  -U%U -P%p
>         lprm command  = /usr/local/bin/lprm -U%U -P%p %j
snip
> As an aside, is there a way to get the filenames of the jobs to end up
> being close to or similar to what they were when they were submitted?
> This isn't a really big deal, but it would be nice.