LPD.PERMS(5)

NAME
lpd.perms - permissions control file for the LPRng line printer spooler system

DESCRIPTION
The file lpd.perms is used to provide permission information for the LPRng Printer spooler system. Blank lines and all characters after a hash sign (``#'') to the end of line are ignored. If a hash sign is desired in the permission information, it should be escaped with a backslash (``\''). All other lines specify permissions entry and should be of the following form:
    ACCEPT [ key = value[,value]* ]*
    REJECT [ key = value[,value]* ]*
    DEFAULT ACCEPT
    DEFAULT REJECT

LPD access control is provided by two means: the pathnames or programs specified by the perms_path configuration information and the printcap XU (check user) entry. These entries consist of a list of files separated by colons and/or a set of filters. For example:
/etc/lpd.perms:|/usr/local/lib/perms

would specify a file and a filter. The filter program is invoked with the filter_options specified in the configuration information, and is sent the name of the printer on the filter standard input. The filter should respond by writing a list of permissions entries on its standard output.

Each LPD service request is check against the entries in the permissions file and/or filter response. The following is a typical permissions file:
    # Set default permissions
    DEFAULT ACCEPT
    # Reject any connections from outside our subnet
    REJECT SERVICE=X NOT REMOTEIP=130.191.0.0/255.255.0.0
    # Only accept Printing (P) and spooling (LPR) from
    # Engineering Lab or the Dean's office
    REJECT SERVICE=P,R NOT REMOTEHOST=*.eng.sdsu.edu,dean.sdsu.edu
    # Do not accept forwarded jobs for printing
    REJECT SERVICE=P FORWARD
    # Allow only the administrators control access
    ACCEPT SERVICE=C,M REMOTEHOST=spooler.eng.sdsu.edu REMOTEUSER=root,papowell
    ACCEPT SERVICE=C,M SERVER REMOTEUSER=root,papowell
    # Allow only the user on the same host who spooled job to remove it
    ACCEPT SERVICE=M,U SAMEUSER SAMEHOST
    REJECT SERVICE=M,C,U

Permission checking is done by using a set of keys (or fields) with associated values to check for permission. The SERVICE key has value P for printing (i.e.- unspooling), R for spooling (i.e.- LPR request), C, S, and U for printer control, status, and user allowed operation respectively (i.e.- LPC request), M for removal (i.e.- LPRM request), Q for queue information (i.e.- LPRM request), and so forth. The key indicates the initial connection to the LPD spooler, and can be used to control connections from remote systems. The values of the USER, HOST, and IP keys taken from the control file which is being received or checked for permissions. The REMOTEUSER, REMOTEHOST and REMOTEIP keys are those either sent as part of a command, or derived from information about the current network connection. (See below for details involving Domain Name Service lookups and other information.) Each line of the permissions file is scanned for key names and values, and these are matched against the request keys information. When all matches on a line are made, then search terminates with the specified action (ACCEPT/REJECT). If no match is found the default permission value is used. The DEFAULT key is used to specify the current default permission to be used for successful matches or if there is no match after scanning the entire permissions database.

The PRINTER entry is used to specify the printer to be checked. The GROUP entry is used to check that the USER name appears in a group entry in the system user group database. For example, GROUP=student*,staff* would check to see if any of the group name matching student* or staff* have the specified user name in them. If a system has the netgroups capability, a printer, group, or remotegroup name starting with a @ will be treated as a netgroup name, and specified user name or printer will be checked to see if it is in the group. Note that wildcard matches are not performed on netgroups. Similarly, the REMOTEGROUP entry will check a remote user name.

The PORT entry can be used to ensure that a connection to the server orignates from a specified range of ports.

The permissions database is scanned in order of the fixed file entries and then by invoking the specified filters for each of the permissions lists. It is recommended that the filters be placed at the end of the permissions lists. The user name is one of the parameters passed to the filter, and can be used to determine if a user has permissions to print a file.

Key	Match	Connect	Job	Job	LPQ	LPRM	LPC
 	 	 	Spool	Print
SERVICE	S	'X'	'R'	'P'	'Q'	'M'	'C,S'
USER	S	-	JUSR	JUSR	JUSR	JUSR	JUSR
HOST	S	RH	JH	JH	JH	JH	JH
GROUP	S	-	JUSR	JUSR	JUSR	JUSR	JUSR
IFIP	IP	IFIP	IFIP	-	IFIP	IFIP	IFIP
IP	IP	RIP	JIP	JIP	RIP	JIP	JIP
PORT	N	PORT	PORT	-	PORT	PORT	PORT
REMOTEUSER	S	-	JUSR	JUSR	JUSR	CUSR	CUSR
REMOTEHOST	S	RH	RH	JH	RH	RH	RH
REMOTEGROUP	S	-	JUSR	JUSR	JUSR	CUSR	CUSR
REMOTEIP	IP	RIP	RIP	JIP	RIP	RIP	RIP
CONTROLLINE	S	-	CL	CL	CL	CL	CL
PRINTER	S	-	PR	PR	PR	PR	PR
FORWARD	V	-	SA	-	-	SA	SA
SAMEHOST	V	-	SA	-	SA	SA	SA
SAMEUSER	V	-	-	-	SU	SU	SU
SERVER	V	-	SV	-	SV	SV	SV
AUTH	V	-	AU	-	AU	AU	AU
AUTHTYPE	S	-	AU	-	AU	AU	AU
AUTHUSER	S	-	AU	-	AU	AU	AU
FWDUSER	S	-	AU	-	AU	AU	AU
KEY:
	JH = HOST	host in control file
	RH = REMOTEHOST	connecting host name
	JUSR = USER	user in control file
	CUSR = REMOTEUSER	user from control request
	JIP= IP	IP address of host in control file
	RIP= REMOTEIP	IP address of requesting host
	PORT=	connecting host origination port
	CONTROLLINE=	pattern match of control line in control file
	FW= IP of source of request = IP of host in control file
	SA= IP of source of request = IP of host in control file
	SU= user from request = user in control file
	SA= IP of source of request = IP of server host
	SV= matches if from same address as server
	AU= value determined by server authentication operation
	    NONE - no authentication, USER - user sending authentication
	    FWD - server forwarding authentication
	IFIP= matches the remote IP address of the connection
Match: S = string with wild card, IP = IPaddress[/netmask],
	N = low[-high] number range, V = exact value match
SERVICE: 'X' - Connection request; 'R' - lpr request from remote host;
    'P' - print job in queue; 'Q' - lpq request, 'M' - lprm request;
    'C' - lpc spool control request; 'S' - lpc spool status request
	'U' - administratively allowed user operation
NOTE: when printing (P action), the remote and job check values
	(i.e. - RUSR, JUSR) are identical.

The special key letter=patterns searches the control file line starting with the (upper case) letter, and is usually used with printing and spooling checks. For example, C=A*,B* would check that the class information (i.e.- line in the control file starting with C) had a value starting with A or B.

A permission line consists of a list of tests and a result value. If all of the tests succeed, then a match has been found and the permission testing completes with the result value. You use the DEFAULT reserved word to set the default ACCEPT/DENY result. The NOT keyword will reverse the sense of a test.

Each test can have one or more optional values separated by commas. For example USER=john,paul,mark has 3 test values. The Match value specifies how the matching is done.

S = string type match - string match with glob.
	Format:  string with wildcards (*)
		* matches 0 or more chars
	Character comparison is case insensitive.
	For example - USER=th*s matches uTHS, This, This, Theses

IP = IP address and submask.  IP address must be in dotted form.
	Format: x.x.x.x[/y.y.y.y or /z]
		x.x.x.x is IP address
	    y.y.y.y is optional submask, default is 255.255.255.255
        z is a netmask with most significant z bits set.
	Match is done by IP address to a 32 bit value and using:
		success = ((x ^ IP ) & y) == 0   (C language notation)
	i.e.- only bits where mask is non-zero are used in comparison.
	For example - IP=130.191.0.0/255.255.0.0 matches all address 130.191.X.X
	IP=130.191.0.0/16 has the same value.

N = numerical range  -  low-high integer range.
	Format: low[-high]
	Example: PORT=0-1023 matches a port in range 0 - 1023 (privileged)

The authentication entries AUTH, AUTHTYPE, AUTHUSER, and FWDUSER can be used to check permissions for authenticated operations. AUTH can have the values NONE (no authentication), USER (user authenticated), or FWD (forwarded authentication from a server). For example, to reject non-authenticated operations, we can use:
REJECT AUTH=NONE
To accept only authenticated jobs directly from users use REJECT AUTH=NONE,FWD in the permissions file. The AUTHTYPE can be used to match the authentication type being used or requested by the remote client or server. The AUTHUSER matches the authentication information originated by the client to user transfer; These may be identical to the user name, but also may be different values. The FWDUSER matches the authentication information originated by the server to server forwarding operation, and can be used to restrict these operations.

SERVER=U AND ALLOW_LPC CONFIGURATION VARIABLE

The allow_lpc configuration variable can be used to specify a subset of the standard lpc operations will be classified as U operations. The candidates for selection include hold, release, move, and topq. For example, if the allow_lpc variable had the value:
allow_lpc=hold,release

Then the following permissions entry would allows users to hold or release their own jobs:
ACCEPT SERVICE=U SAMEUSER SAMEHOST REJECT SERVICE=U

When checking permissions, if permission is explicitly granted for SERVICE=C operations, it must be done before the checks for U or S services.

DNS, IPV6, AND MULTIHOMED HOSTS

There is a subtle problem with names and IP addresses which are obtained for 'multi-homed hosts', i.e. - those with multiple ethernet interfaces, and for IPV6 (IP Version 6), in which a host can have multiple addresses, and for the normal host which can have both a short name and a fully qualified domain name.

The IFIP (interface IP) field can be used to check the IP address of the origination of the request, as reported by the information returned by the accept() system call. Note that this information may be IPV4 or IPV6 information, depending on the origination of the system. This information is used by gethostbyaddr() to obtain the orginating host fully qualified domain name (FQDN) and set of IP addresses. Note that this FQDN will be for the originating interface, and may not be the cannonical host name. Some systems which use the Domain Name Server (DNS) system may add the cannonical system name as an alias.

When performing an IP address match, the entire list of IP addresses for a system will now be checked. If one of these matches, then success is reported. Similarly, the entire list of host names and aliases will be checked. If one of these matches, then success will be reported.

In addition, when checking for printing, if the name lookup for the host reported in the control file fails, then we assume that the host is unknown and all match checks for names or IP addresses will fail. You can determine if a host has an entry by using the following check, which will reject all requests from a remotehost which does not have a DNS entry.
REJECT NOT REMOTEHOST=*

FILES

The files used by LPRng are set by values in the printer configuration file. The following are a commonly used set of default values.
/etc/lpd.conf		LPRng configuration file
/etc/printcap		printer description file
/etc/lpd.perms	printer permissions
/var/spool/printer*		spool directories
/var/spool/printer*/printer	lock file for queue control
/var/spool/printer*/control.printer	queue control
/var/spool/printer*/active.printer	active job
/var/spool/printer*/log.printer	log file

SEE ALSO
lpd.conf(5), lpc(8), lpd(8), lpr(1), lpq(1), lprm(1), printcap(5), lpd.perms(5), pr(1).

DIAGNOSTICS
Most of the diagnostics are self explanatory.
If you are puzzled over the exact cause of failure,
set the debugging level on (-D5) and run again.
The debugging information will
help you to pinpoint the exact cause of failure.

HISTORY

LPRng is a enhanced printer spooler system with functionality similar to the Berkeley LPR software. In 1988 Patrick Powell released the PLP (Public Line Printer) software, which went through several evolutions. Justin Mason (jmason@iona.ie) generated PLP4.0 from several older releases of PLP. In 1992 Patrick Powell release LPRng, a completely redesigned and newly written version of the software.

The LPRng mailing list is plp@iona.ie; subscribe by sending mail to plp-request@iona.ie with the word subscribe in the body. The software is available from ftp://iona.ie/pub/LPRng.

LPRng is distributed under the GNU software license for non-commercial use, the Artistic License for limited commercial use. Commerical support and licensing is available through Patrick Powell <papowell@sdsu.edu>.