5

According to the cupsd.conf documentation, one should be able to "require authentication for remote access, but allow local access without authentication." There doesn't appear to be any other documentation on this subject.

I tried putting the following in my cupsd.conf:

<Location />
  # Restrict access to the server...
  Allow from 192.168.1.0/24
  Require valid-user
  Satisfy any
  Order allow,deny
</Location>

It doesn't work for me.

Has anyone gotten this to work? Is there an example cupsd.conf available with this configuration?

1 Answer 1

4

Add the following lines to you snippet:

Allow from localhost
Allow from 127.0.0.1
Deny from all

and change the Order line to

Order deny,allow

so it reads:

<Location />
   # Restrict access to the server 'root' location...
   Allow from 192.168.1.0/24
   Allow from localhost
   Allow from 127.0.0.1
   Deny from all
   Require valid-user
   Satisfy any
   Order deny,allow
 </Location>

Should this not be sufficient, add the same settings for the <Location /printers> and the </Location /admin>:

<Location /printers>
   # Restrict access to the server's shared printers...
   Allow from 192.168.1.0/24
   Allow from localhost
   Allow from 127.0.0.1
   deny from all
   Require valid-user
   Satisfy any
   Order deny,allow
 </Location>
4
  • @Jeff Strunk: thanks for the correction; this version is correct now (I remember vaguely, that I lost internet connections towards my editing session. Maybe before my last 'save' completed...). Dec 13, 2011 at 18:55
  • Although not asked in the question, it would be nice if SSL would be required for remote access but not for local access. Is it easy to modify for that? May 7, 2012 at 8:54
  • For me it fails when I do Allow from 192.168.1.1/24, but passes with allow from 192.168.1.0/24. Error was ` Bad netmask value 192.168.1.1/24 on line 32.` Sep 2, 2017 at 5:15
  • 1
    @TomaszGandor: Not only for YOU, but it should fail for EVERYBODY. The reason for this error message is that 192.168.1.1/24 INDEED is a bad netmask value, and that it ought to be 192.168.0.1/24 (as it worked for you). My bad, my mistake, I should have known better! Thanks for noticing and for writing your comment. I'll correct my answer in a minute. Sep 2, 2017 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.