TweetFollow Us on Twitter

MacEnterprise: Printing with Leopard in the Enterprise

Volume Number: 24 (2008)
Issue Number: 06
Column Tag: MacEnterprise

MacEnterprise: Printing with Leopard in the Enterprise

Changes for Mac Administrators

By Greg Neagle, MacEnterprise.org

Introduction

Mac OS X 10.5 "Leopard" continues the trend of enhancements and modifications to printing on the Mac. Changes in the CUPS configuration and in the printing utilities in Leopard have the potential to simplify or complicate your environment. With a few simple changes, you can customize printing behavior in Leopard to more closely match its behavior in Tiger, and ease the transition for your users and support staff.

More Security, More Support

Printing in Leopard largely behaves as it did in Tiger. One particular change, however, might be of interest to Mac administrators: for the first time since Mac OS X was introduced, a user must be an administrator to add and remove printers.

Presumably, Apple made this change to improve security – Leopard has many changes to increase the security of Apple's OS. For most home users, where at least one user's account is an admin account, this change really doesn't affect the user experience much. But in an enterprise environment, this change can be more problematic.

In many enterprise settings, most users do not have administrative privileges. They cannot install or remove software, and cannot make many configuration changes. This provides a more stable and secure platform for enterprise users and administrators, and makes support of these machines easier. Restricting the addition of printers to admins has the potential to increase support costs, since any time a user needs to print to a new or different printer they have to contact support.

For some organizations, making the addition of printers an administrator-only function might be a good thing, especially if you tightly control printer usage. But if in your organization, the pre-Leopard behavior is a better fit, there is a way to allow non-admin users to add printers and reduce the burden on support.

CUPS configuration

To allow non-admins to add printers, we'll need to edit the cupsd configuration file, located at /private/etc/cups/cupsd.conf. You'll need to use sudo, and your favorite text editor. Look for this section:

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer¬
CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default> AuthType Default Require user @SYSTEM Order deny,allow </Limit>

Remove or comment out this section and replace it with:

# Allow non-admin users to add printers
 <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer ¬
CUPS-Add-Modify-Class CUPS-Delete-Class ¬
CUPS-Set-Default> Require valid-user Order allow, deny Allow all </Limit>

Now look for this section, which should be directly below the section you just modified:

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer ¬
Disable-Printer Pause-Printer-After-Current-Job ¬
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer¬
Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer ¬
Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Default Require user @AUTHKEY(system.print.admin) @admin @lpadmin Order deny,allow </Limit> \

Change it to:

# Allow non-admin users to pause and resume printers
  <Limit Pause-Printer Resume-Printer¬
Enable-Printer Disable-Printer Pause-Printer-After-Current-Job¬
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer¬
Restart-Printer Shutdown-Printer ¬
Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> Require valid-user Order allow, deny Allow all </Limit>

These changes allow any authenticated user perform the CUPS actions defined – the key actions we are interested in are adding printers and the ability to pause or resume printers. In many cases, the changes to the section to allow pause/resume may not be needed, because by default, any user who is a member of the lpadmin group can perform these functions, and all local users are automatically added to the lpadmin group when they are created. You might need this change in an environment with network accounts, where network users are not members of the lpadmin group.

Now test the changes. Login as a non-admin user and open a document. Choose Print from the File menu. The standard Print dialog will open. In the Printer pop-up menu, select Add Printer... You should be able to add a printer without being prompted for an admin password. Note that using the Print and Fax preferences pane in System Preferences still requires an admin password, so tell your users to add printers using the method described above (from the Print menu), or make the additional change described below to provide another way to add printers. Additionally, as the Print menu does not offer an option to delete printers, there is no user-friendly way to remove printers without allowing access in the preference pane.

If you want to revert your changes, you can simply copy /etc/cups/cupsd.conf.default to /etc/cups/cupsd.conf to restore the CUPS configuration to Apple's default settings.

Replacing Printer Setup Utility

Prior to Leopard, there were at least three ways to add a printer: using the Print and Fax preference pane, using the Printer Setup Utility in /Applications/Utilites, and by choosing Add Printer... from the Print dialog in any application (which then opens the Printer Browser in the Printer Setup Utility).

In Leopard, Apple has simplified matters somewhat by removing the Printer Setup Utility. This may confuse your users who you've upgraded from Tiger. If they are not admin users, the Print and Fax preference pane will be of no use to them, either. You can of course tell them to use the Add Printer... item in the Print dialog. But you may want to increase the chances they'll figure things out for themselves by partially restoring the missing Printer Setup Utility.

We'll do this by creating a symlink in /Applications/Utilities named "Printer Setup Utility.app" that links to the AddPrinter application in /System/Library/CoreServices:

sudo ln -s /System/Library/CoreServices/AddPrinter.app \
/Applications/Utilities/Printer\ Setup\ Utility.app

Now when you users go looking for a tool in the Utilities folder to help them add a printer, they'll find one.


AddPrinter.app

This isn't a perfect solution. AddPrinter doesn't act like a standard application, since it wasn't designed to be one. It doesn't have a menu bar, it doesn't appear in the Dock, and it doesn't automatically come to the front when opened. This may confuse your users. You may want to decide whether or not making it available in this way will lessen your support burden or increase it.

Conclusion

If Leopard's printing changes have caused support issues in your environment, you now have a few tools to use to help your users help themselves!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

The MacEnterprise project is a community of IT professionals sharing information and solutions to support Macs in an enterprise. We collaborate on the deployment, management, and integration of Mac OS X client and server computers into multi-platform computing environments.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Latest Forum Discussions

See All

Top Mobile Game Discounts
Every day, we pick out a curated list of the best mobile discounts on the App Store and post them here. This list won't be comprehensive, but it every game on it is recommended. Feel free to check out the coverage we did on them in the links... | Read more »
Price of Glory unleashes its 1.4 Alpha u...
As much as we all probably dislike Maths as a subject, we do have to hand it to geometry for giving us the good old Hexgrid, home of some of the best strategy games. One such example, Price of Glory, has dropped its 1.4 Alpha update, stocked full... | Read more »
The SLC 2025 kicks off this month to cro...
Ever since the Solo Leveling: Arise Championship 2025 was announced, I have been looking forward to it. The promotional clip they released a month or two back showed crowds going absolutely nuts for the previous competitions, so imagine the... | Read more »
Dive into some early Magicpunk fun as Cr...
Excellent news for fans of steampunk and magic; the Precursor Test for Magicpunk MMORPG Crystal of Atlan opens today. This rather fancy way of saying beta test will remain open until March 5th and is available for PC - boo - and Android devices -... | Read more »
Prepare to get your mind melted as Evang...
If you are a fan of sci-fi shooters and incredibly weird, mind-bending anime series, then you are in for a treat, as Goddess of Victory: Nikke is gearing up for its second collaboration with Evangelion. We were also treated to an upcoming... | Read more »
Square Enix gives with one hand and slap...
We have something of a mixed bag coming over from Square Enix HQ today. Two of their mobile games are revelling in life with new events keeping them alive, whilst another has been thrown onto the ever-growing discard pile Square is building. I... | Read more »
Let the world burn as you have some fest...
It is time to leave the world burning once again as you take a much-needed break from that whole “hero” lark and enjoy some celebrations in Genshin Impact. Version 5.4, Moonlight Amidst Dreams, will see you in Inazuma to attend the Mikawa Flower... | Read more »
Full Moon Over the Abyssal Sea lands on...
Aether Gazer has announced its latest major update, and it is one of the loveliest event names I have ever heard. Full Moon Over the Abyssal Sea is an amazing name, and it comes loaded with two side stories, a new S-grade Modifier, and some fancy... | Read more »
Open your own eatery for all the forest...
Very important question; when you read the title Zoo Restaurant, do you also immediately think of running a restaurant in which you cook Zoo animals as the course? I will just assume yes. Anyway, come June 23rd we will all be able to start up our... | Read more »
Crystal of Atlan opens registration for...
Nuverse was prominently featured in the last month for all the wrong reasons with the USA TikTok debacle, but now it is putting all that behind it and preparing for the Crystal of Atlan beta test. Taking place between February 18th and March 5th,... | Read more »

Price Scanner via MacPrices.net

AT&T is offering a 65% discount on the ne...
AT&T is offering the new iPhone 16e for up to 65% off their monthly finance fee with 36-months of service. No trade-in is required. Discount is applied via monthly bill credits over the 36 month... Read more
Use this code to get a free iPhone 13 at Visi...
For a limited time, use code SWEETDEAL to get a free 128GB iPhone 13 Visible, Verizon’s low-cost wireless cell service, Visible. Deal is valid when you purchase the Visible+ annual plan. Free... Read more
M4 Mac minis on sale for $50-$80 off MSRP at...
B&H Photo has M4 Mac minis in stock and on sale right now for $50 to $80 off Apple’s MSRP, each including free 1-2 day shipping to most US addresses: – M4 Mac mini (16GB/256GB): $549, $50 off... Read more
Buy an iPhone 16 at Boost Mobile and get one...
Boost Mobile, an MVNO using AT&T and T-Mobile’s networks, is offering one year of free Unlimited service with the purchase of any iPhone 16. Purchase the iPhone at standard MSRP, and then choose... Read more
Get an iPhone 15 for only $299 at Boost Mobil...
Boost Mobile, an MVNO using AT&T and T-Mobile’s networks, is offering the 128GB iPhone 15 for $299.99 including service with their Unlimited Premium plan (50GB of premium data, $60/month), or $20... Read more
Unreal Mobile is offering $100 off any new iP...
Unreal Mobile, an MVNO using AT&T and T-Mobile’s networks, is offering a $100 discount on any new iPhone with service. This includes new iPhone 16 models as well as iPhone 15, 14, 13, and SE... Read more
Apple drops prices on clearance iPhone 14 mod...
With today’s introduction of the new iPhone 16e, Apple has discontinued the iPhone 14, 14 Pro, and SE. In response, Apple has dropped prices on unlocked, Certified Refurbished, iPhone 14 models to a... Read more
B&H has 16-inch M4 Max MacBook Pros on sa...
B&H Photo is offering a $360-$410 discount on new 16-inch MacBook Pros with M4 Max CPUs right now. B&H offers free 1-2 day shipping to most US addresses: – 16″ M4 Max MacBook Pro (36GB/1TB/... Read more
Amazon is offering a $100 discount on the M4...
Amazon has the M4 Pro Mac mini discounted $100 off MSRP right now. Shipping is free. Their price is the lowest currently available for this popular mini: – Mac mini M4 Pro (24GB/512GB): $1299, $100... Read more
B&H continues to offer $150-$220 discount...
B&H Photo has 14-inch M4 MacBook Pros on sale for $150-$220 off MSRP. B&H offers free 1-2 day shipping to most US addresses: – 14″ M4 MacBook Pro (16GB/512GB): $1449, $150 off MSRP – 14″ M4... Read more

Jobs Board

All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.