CUPS SMB printing doesn't work 11.4

I can’t get printing to my windows server to work w/ 11.4.
I’ve set it up w/out any issue for years w/ v 10.something, 11, 11.2, etc…

First of all, the logs tell me:
Unable to execute /usr/lib/cups/backend/smb: insecure file permissions

That’s actually a link to another file, and I fixed the error by removing the read rights on it. But now I still can’t print.

Now I get
Printer stopped due to backend errors; please consult the error_log file for details

I’ve removed everything having to do w/ samba and cups and printing and re-installed it all… and then I get the same original insecure permissions errors.
So, are other people having trouble? Fresh install and can’t print to windows.

There’s a Samba bug in 11.4. A fix is on the way. In the menatime goto Yast → AppArmor and disable app armor. Then goto Yast – System → runlevels and enable the nmb and smb daemons.

Then reboot
Then set up the printer again.
[of course, you might be suffering some other problem, but take this bug out of contention first.]

Unfortunately I’ve already done that… (had to get other SMB stuff working to get my computer joined to my domain, so disabled app armor for that). Hopefully it’s still somehow related… I had file security issues while setting up SMB too… but don’t remember if that was before or after disabling app armor. That’s (file sharing/domain membership) at least working now.

That’s got me beat. Hopefully someone else will suggest something.

On Wed March 23 2011 03:06 pm, swerdna wrote:

>
> That’s got me beat. Hopefully someone else will suggest something.
>
>
wicked1;

I upgraded a OpenSuSE 11.2 server to 11.4 ( both x86_64)and Samba to 3.5.8.

The cups smb backend was in /usr/lib64/cups/backend and I needed to create a
link in /usr/lib/cups/backend to /usr/bin/smbspool


ln -s /usr/bin/smbspool /usr/lib/cups/backend/smb

The permissions on smbspool are:


venXXX@fermat:/usr/bin> ls -l smbspool
-rwxr-xr-x 1 root root 3512992 Mar 18 11:52 smbspool

I’m not sure this has much to do with your problem, but I thought it might be
worth mentioning. Also, again I don’t think it’s required, but did you run
cupsaddsmb ?


P. V.
“We’re all in this together, I’m pulling for you.” Red Green

On Tue March 22 2011 11:36 pm, swerdna wrote:

>
> There’s a Samba bug in 11.4. A fix is on the way. In the menatime goto
> Yast → AppArmor and disable app armor. Then goto Yast – System →
> runlevels and enable the nmb and smb daemons.
>
> Then reboot
> Then set up the printer again.
> [of course, you might be suffering some other problem, but take this
> bug out of contention first.]
>
>
swerdna;

It seemed to me that AppArmor was more closely tied to the kernel with 11.4
than in previous releases. After disabling AppArmor “System Services
(Runlevel)” would still indicate that some of the daemons were still running,
even though they were set to to not start. I also set AppArmor to just
complain rather than enforce as added insurance against interference.

P. V.
“We’re all in this together, I’m pulling for you.” Red Green

Another way would be to use YaST to configure the AppArmor smbd and nmbd profiles accordingly. You can use this reference to do this :
Chapter 22. Building and Managing Profiles with YaST

Best regards,
Greg

I’ve upgraded to Tumbleweed now but still the Samba bug persists. Following your advice I’ve also switched AppArmor back on and set smbd to “complain”. Thanks.

On Thu March 24 2011 12:06 am, glistwan wrote:

>
> Another way would be to use YaST to configure the AppArmor smbd and nmbd
> profiles accordingly. You can use this reference to do this :
> ‘Chapter 22. Building and Managing Profiles with YaST’
> (http://tinyurl.com/69mbb6r)
>
> Best regards,
> Greg
>
>
Greg;

Of course you can properly edit the profiles. AppArmor has been a pain in
the south side, when headed north, since it came out. IMHO those who need
enhanced security should be using SELinux. I’m sure AppArmor was meant as a
replacement but it looks to me like a solution looking for a problem.

P. V.
“We’re all in this together, I’m pulling for you.” Red Green

It’s not both of them, only smbd is at fault :wink:

Sorry for the missinformation :slight_smile: I’m not a samba guru. All I know is that the profile wizard updated both for me.

@venzkep
I started using AppArmor in 11.3 and never had problems with it. IMHO additional security won’t hurt anyone.

Best regards,
Greg

Hey thanks swerdna, that solved my problem as was gonna post as smbd would not start under swat yet the smb service was running, but all cool, now and can print via the network.

See this bug

685093

Please show us the output ofsamba-krb-printing

ls -l /usr/lib/cups/backend/smb

If the sym link points to /usr/bin/get_printing_ticket please remove the
samba-krb-printing package. Afterwards check if /usr/lib/cups/backend/smb
points to /usr/bin/smbspool

Removing samba-krb-printing fixed my issue, the printing log was full of permission errors and such.
However I had originally tried to fix the errors by changing permissions and changing the runlevels of smb as per other posts.
But still could not print, i haven’t had a chance to check if just removing samba-krb-printing on its own fixes the issues. Which it probably may.

I checked with my colleague who was testing my build and removing samba-krb-printing fixed the issue without altering runlevels or permissions.

Worked for me too! I was getting exactly the same error, just removing “samba-krb-printing” did the job:

rpm -e samba-krb-printing

I’d suggest that someone entirely removes this package and its dependencies from the OpenSuse online software repositories until this bug is fixed!

Had same issue in openSUSE 12.1 and resolved by removing samba-krb-print

While adding new printer there is optional check box “Add Active Directory support”. I was not sure if I need it so checked. This installed samba-krb-print. Test page didn’t print with an error “insecure permissions”. I almost screwed my linux machine and then also screwed windows server, I thought there is something wrong with printer…

Now I know what was wrong - it’s stupid samba-krb-print. Removed it - and everything works fine (still using AD account to connect to printer)

Did see you mention what your smb.conf is listing for printers

I don’t have any smb.conf, I’m printing from openSUSE to windows shared printer