Chapter 17. PaperCut NG on Linux

Table of Contents

The Installation Process
Manual extraction
The install process
CUPS Integration
Samba Integration
Advanced Configuration & Logs
Backups & System Management
User Directory and Authentication
Standard Unix
Samba/Windows Domain
Custom
Unix Command-Line Release Station Client
Installing the Command-Line Release Station Client
Removing PaperCut NG from a Linux server
Linux FAQ

This section is designed to supplement the Linux Quick Start guide (see the section called “Quick Start Guide (for Linux)”). It provides an in-depth explanation of the Linux installation process, the directory layout and tools.

Information in this chapter is technical in nature. It is expected that readers have prior experience with:

The Installation Process

The Linux version of PaperCut NG is supplied as a pre-compiled self-installing application. The installation process is designed to work with all major Linux distributions. Due to the varied nature of some installations and administrator preferences, often some manual configuration is required. This section describes the installation process in detail as well as some additional options available to system administrators.

Manual extraction

The Linux version of PaperCut NG is supplied in a self-extracting, self-installing archive. The archive is simply a tar archive compressed with gzip, and headed with a shell script to facilitate self-extracting. After extraction is complete, the installation script named install is executed to begin the install process. Some system administrators may like to inspect the contents of the archive, and possibly the installation process itself prior to the actual install. The self-extracting installer takes a number of command line arguments. The -e argument will extract the archive into the current working directory ready for inspection. Further options and documentation is available via the --help option.

  Usage: pcng-setup.sh [-e|-i|-l] [-v] [-n] [list ...]
     -e      Extract the files and then exit without installing.
     -i      Install after extracting the files (default).
     -l      List the contents of the archive and exit without extracting.
     -v      Verbose. Print the names of the files as they are extracted.
     list    The list of files to extract."
                

The install process

Even though the majority of the installation process is completed under the identity of the non-privileged user account called papercut, most administrators would like to know what the install process does. The main steps are outlined below:

Extraction

The first stage in the install process extracts the archive to /tmp or a location as defined by an environment variable TEMDIR. The command-line programs tar and gunzip are used during this phase.

Installation

After extraction is complete the installation script is called. The install script, called install, will present the EULA and request acceptance. The script then determines the install location. This is the papercut user's home directory. The home directory is determined by the HOME environment variable, or if not set, the result of a call to getpwnam().

Files are then copied into the papercut user's home directory. Care is taken not to overwrite any existing data or configuration files if this is an install-over-the-top upgrade.

Permissions

To ensure the default installation is secure by default, permissions are applied to key files. The following area of the application are restricted to the papercut user only:

AreaComments

~/server/server.properties

Contains server configuration including the default admin password.

~/server/data

This directory contains application data including database files. Some of this data may contain sensitive information.

~/server/bin/linux-i686

This directory contains a setuid-root binary. Even though the binary is no use to an end-user or hacker, good security practice stipulates that we should only allow the papercut user access to this directory.

Table 17.1. Secured Application Areas

Permissions can be checked and re-applied at any time post-install by running the scripts:

    ~/server/bin/linux-i686/setperms
    ~/providers/print/linux-i686/setperms
                    

Firewall

The PaperCut NG Application Server (pc-app process) listens on port 9191. This port is used for browser based administration access, for client access, and other services. Ensure that any firewall or local IP filtering software such as iptables is set to allow local network traffic access to this port.

Root Level Tasks

A small part of the install process needs to run as the root account. The tasks conducted as root include:

  • Setting the authpam binary as setuid-root. This binary is used for password verification.

  • Installing a CUPS backend. This is done by placing a symlink in the CUPS lib/backend directory.

  • Setting up SYSV style start scripts if the system uses this boot process. This is done by placing symlinks in the:

        /etc/init.d/
        /etc/rc3.d/
        /etc/rc5.d/
        and so on...
                                    

If the administrator decides not to run the root-level tasks during the install process, the tasks can be run again post-install by executing the shell scripts:

    ~/server/bin/linux-i686/roottasks
    ~/providers/print/linux-i686/roottasks
                    

Alternatively the administrator can view the scripts and make the required changes by hand.

CUPS Integration

CUPS, also known as the Common Unix Print System, is a popular system for managing printers on Linux servers. CUPS uses a chain-of-commands concept where filters and backends combine together to form a process steam - a workflow. PaperCut NG hooks into this workflow at the backend level intercepting the job before it's passed onto physical printer hardware.

The interception is done by wrapping or proxying the real CUPS backend. CUPS calls the PaperCut NG backend which processes the job. If the job is approved, it passes the document onto the real backend. If the job is denied, it is deleted and processes no further. The PaperCut NG backend is usually set up and installed by default during the standard installation.

Setting up the PaperCut NG CUPS backend proxy is a relatively simple task. All the administrator needs to do is prefix the existing DeviceURI with the papercut:. For example the entry:

    DeviceURI socket://192.168.1.200:9100
                

would become:

    DeviceURI papercut:socket://192.168.1.200:9100
                

The printer will register itself with the PaperCut NG system on the first print event.

PaperCut NG CUPS Architecture

The PaperCut NG CUPS backend is a native compiled binary. In PaperCut NG documentation it is referred to it as a Print Provider - that is a component that provides print event information to the Application Server. It's responsible for analyzing the print job and then communicating this information to the Application Server component. Communication is via an XML-RPC based Web Services call. This means that the backend does not even need to be on the same server as the system hosting the Application Server component.

Samba Integration

Samba is used to provide file and print sharing to Windows systems and is a popular solution. One of the main reasons for its popularity is that it avoids the need for expensive Microsoft Windows server licenses!

Samba exposes the locally set up Linux/Unix printers as network shared Windows printers. It does this by wrapping the underlying print system - usually CUPS or LPR/LPD. In the case of LPR, Samba calls the standard lp command line programs to perform printing. PaperCut NG works by wrapping or proxying the "print command". More information on how Samba interacts with the underlying print system is available in the Samba documentation.

A typical entry in the Samba configuration file smb.conf defining the PaperCut NG print command wrapper would be:

 print command=/home/papercut/providers/print/linux-i686/samba-print-provider
    -u "%u" -J "%J" -h "%h" -m "%m" -p "%p" -s "%s" 
    -a "[standard print command]" &

 (IMPORTANT: The above information should appear all on the one line. 
 Note the use of the & (ampersand) on the end of the line.)
                

where [standard print command] is the command that would normally be called for printing.

The %u, %p, etc., are Samba substitution variables. These are replaced with content such as the username, printer name, etc. and are used by PaperCut NG in the reporting and logging.

The printer will register itself with the PaperCut NG web interface after the first print is received.

PaperCut NG Samba Architecture

The PaperCut NG Samba print command wrapper is a native compiled executable. The PaperCut NG documentation refers to it as a Print Provider. It's responsible for analyzing the print job and then communicating this information to the Application Server component. Communication is via an XML-RPC based Web Services call. This means that the command does not even need to be on the same server as the system hosting the Application Server component.