samba - Apr 2005 - Can't setup Windows Print Driver on Samba 3 Server

Hi,

I'm trying to store a windows print driver on a samba 3 server (which is 
sharing a pseudo PDF printer) so that windows users in the domain can 
automatically have it installed (rather than having to choose a driver 
from their computer manually). I've tried the methods outlined in the 
samba howto but I can't get either of them to work. The one where you 
use a windows machine to install the drivers onto the samba server 
allows me to copy the drivers into the print$ share, however when I try 
to click "OK" or "Apply" in the actual printer dialog box I
get the
error "Permission Denied".

Also trying to do it manually on the Samba server using "rpcclient -U 
<username> -c 'adddriver ....' gives me a WERR_ACCESS_DENIED
error, even
when using the domain administrator as the username or the local root 
account. I have a feeling I have not set up my print admin correctly in 
my smb.conf, which is at the end of this email. I am using winbind by 
the way to let Domain Users login to the share.

Any help would be much appreciated

Regards,
Luke


Contents of my smb.conf:

# Global parameters
[global]
    idmap gid = 16777216-33554431
    wins server = <ip>
    interfaces = eth0
    encrypt passwords = yes
    winbind use default domain = no
    printer admin = "MYDOMAIN\Domain Admins"
    template shell = /sbin/nologin
    use client driver = Yes
    dns proxy = No
    netbios name = MYSERVER
    cups options = raw
    netbios aliases = MYSERVER2
    server string = .......
    printing = cups
    idmap uid = 16777216-33554431
    password server = PDC BDC
    workgroup = MYDOMAIN
    printcap name = cups
    security = domain
    preferred master = No
    max log size = 50
    bind interfaces only = Yes

[printers]
comment = All Printers
browseable = no
printable = yes
public = yes
read only = yes
create mode = 0700
directory = /tmp


[PDFPrinter]
    path = /tmp
    printing = bsd
    #guest ok = Yes
    printable = Yes
    writeable = yes
    print command = /usr/local/bin/printpdf %s %m %U
    lpq command = /bin/true
    comment = Colour PDF Creation
    valid users = "MYDOMAIN\Domain Users"

[PDFs]
    path = /home/pdfs
    browseable = yes
    valid users="MYDOMAIN\Domain Admins"

[print$]
comment = Printer Driver Download Area
path = /etc/samba/drivers
browseable = yes
guest ok = yes
read only = yes
write list = "MYDOMAIN\Domain Admins", root

Le Jeudi 14 Avril 2005 00:28, Luke a ?crit?:
> Hi,
>
> I'm trying to store a windows print driver on a samba 3 server (which
> is sharing a pseudo PDF printer) so that windows users in the domain
> can automatically have it installed (rather than having to choose a
> driver from their computer manually). I've tried the methods outlined
> in the samba howto but I can't get either of them to work. The one
> where you use a windows machine to install the drivers onto the samba
> server allows me to copy the drivers into the print$ share, however
> when I try to click "OK" or "Apply" in the actual
printer dialog box I
> get the error "Permission Denied".
>
> Also trying to do it manually on the Samba server using "rpcclient -U
> <username> -c 'adddriver ....' gives me a WERR_ACCESS_DENIED
error,
> even when using the domain administrator as the username or the local
> root account. I have a feeling I have not set up my print admin
> correctly in my smb.conf, which is at the end of this email. I am using
> winbind by the way to let Domain Users login to the share.
>
> Any help would be much appreciated
I've got the same problem, so I think i'll paste again my yesterday mail
here, as it is another formulation of the same issue...

<----------------------------------------------------------------------------------------------
Hello, all !

I'm setting up a print server with Samba and Cups. All goes fine, until I 
try to upload the drivers from a Win2000 box to the Samba server: The 
driver files are copied to the correct directory ([PRINT$]/W32X86/...), 
and everyone seems to be happy... Until I click on the "OK" button: I 
then get a message saying:

"The printer parameters could not be saved. Acces denied"

This is quite strange, because the file get actually copied to the 
[PRINT$] dir, and the logs show nothing really wrong... Moreover, I've 
done other print server using the same versions (The last one was 
yesterday), and they work correctly.

So, I suspect something is done by (samba|cups|windows) when cliking on 
the "OK" button, after the file copy, but I don't know what... I
don't
know the internals of Samba (And the CIFS protocol).

How can I track down the problem ? Has someone here got this issue 
before ?

For information, this Samba+Cups run in a Vserver 
(http://linux-vserver.org/), and this should not be ignored as a possible 
cause...
But I'd really like to know the basic step Samba performs when 
remote-installing a driver, to look in the good direction. For example, 
are there any communications between Samba and Cups at this particular 
moment ? More important, if there is such communications, is the loopback 
(lo) interface involved in any way ?

Thank by advance for your answers.
------------------------------------------------------------------------------------------------->

> Regards,
> Luke
>
>
> Contents of my smb.conf:
>
> # Global parameters
> [global]
>     idmap gid = 16777216-33554431
>     wins server = <ip>
>     interfaces = eth0
>     encrypt passwords = yes
>     winbind use default domain = no
>     printer admin = "MYDOMAIN\Domain Admins"
>     template shell = /sbin/nologin
>     use client driver = Yes
>     dns proxy = No
>     netbios name = MYSERVER
>     cups options = raw
>     netbios aliases = MYSERVER2
>     server string = .......
>     printing = cups
>     idmap uid = 16777216-33554431
>     password server = PDC BDC
>     workgroup = MYDOMAIN
>     printcap name = cups
>     security = domain
>     preferred master = No
>     max log size = 50
>     bind interfaces only = Yes
>
> [printers]
> comment = All Printers
> browseable = no
> printable = yes
> public = yes
> read only = yes
> create mode = 0700
> directory = /tmp
>
>
> [PDFPrinter]
>     path = /tmp
>     printing = bsd
>     #guest ok = Yes
>     printable = Yes
>     writeable = yes
>     print command = /usr/local/bin/printpdf %s %m %U
>     lpq command = /bin/true
>     comment = Colour PDF Creation
>     valid users = "MYDOMAIN\Domain Users"
>
> [PDFs]
>     path = /home/pdfs
>     browseable = yes
>     valid users="MYDOMAIN\Domain Admins"
>
> [print$]
> comment = Printer Driver Download Area
> path = /etc/samba/drivers
> browseable = yes
> guest ok = yes
> read only = yes
> write list = "MYDOMAIN\Domain Admins", root
-- 
  ,,
 (?>   Nicolas Costes
 /|\   IUT de La Roche / Yon
( ^ )  Cl? publique: http://www.keyserver.net/
 ^ ^   Musique libre: http://www.magnatune.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20050413/c7ddcfaa/attachment.bin

On Wednesday 13 April 2005 16:28, Luke wrote:
> Hi,
>
> I'm trying to store a windows print driver on a samba 3 server (which
is
> sharing a pseudo PDF printer) so that windows users in the domain can
> automatically have it installed (rather than having to choose a driver
> from their computer manually). I've tried the methods outlined in the
> samba howto but I can't get either of them to work. The one where you
> use a windows machine to install the drivers onto the samba server
> allows me to copy the drivers into the print$ share, however when I try
> to click "OK" or "Apply" in the actual printer dialog
box I get the
> error "Permission Denied".
>
> Also trying to do it manually on the Samba server using "rpcclient -U
> <username> -c 'adddriver ....' gives me a WERR_ACCESS_DENIED
error, even
> when using the domain administrator as the username or the local root
> account. I have a feeling I have not set up my print admin correctly in
Correct. You need administrative privilege to administer the printer drivers.
Samba-3.0.11 and later allow you to give any user printer admin rights. Check
http://www.samba.org/samba/docs/Samba-HOWTO-Collection.pdf chapter on User 
Rights and Privileges.

- John T.
> my smb.conf, which is at the end of this email. I am using winbind by
> the way to let Domain Users login to the share.
>
> Any help would be much appreciated
>
> Regards,
> Luke
>
>
> Contents of my smb.conf:
>
> # Global parameters
> [global]
>     idmap gid = 16777216-33554431
>     wins server = <ip>
>     interfaces = eth0
>     encrypt passwords = yes
>     winbind use default domain = no
>     printer admin = "MYDOMAIN\Domain Admins"
>     template shell = /sbin/nologin
>     use client driver = Yes
>     dns proxy = No
>     netbios name = MYSERVER
>     cups options = raw
>     netbios aliases = MYSERVER2
>     server string = .......
>     printing = cups
>     idmap uid = 16777216-33554431
>     password server = PDC BDC
>     workgroup = MYDOMAIN
>     printcap name = cups
>     security = domain
>     preferred master = No
>     max log size = 50
>     bind interfaces only = Yes
>
> [printers]
> comment = All Printers
> browseable = no
> printable = yes
> public = yes
> read only = yes
> create mode = 0700
> directory = /tmp
>
>
> [PDFPrinter]
>     path = /tmp
>     printing = bsd
>     #guest ok = Yes
>     printable = Yes
>     writeable = yes
>     print command = /usr/local/bin/printpdf %s %m %U
>     lpq command = /bin/true
>     comment = Colour PDF Creation
>     valid users = "MYDOMAIN\Domain Users"
>
> [PDFs]
>     path = /home/pdfs
>     browseable = yes
>     valid users="MYDOMAIN\Domain Admins"
>
> [print$]
> comment = Printer Driver Download Area
> path = /etc/samba/drivers
> browseable = yes
> guest ok = yes
> read only = yes
> write list = "MYDOMAIN\Domain Admins", root
-- 
John H Terpstra
Samba-Team Member
Phone: +1 (650) 580-8668

Author:
The Official Samba-3 HOWTO & Reference Guide, ISBN: 0131453556
Samba-3 by Example, ISBN: 0131472216
Hardening Linux, ISBN: 0072254971
Other books in production.