Can’t print to PDF using cups-pdf; used to work, now “failed to set file mode” printing as non-root

cupsghostscriptpdfprinting

Here's something really odd: something that used to work fine in Debian, and then broke, even without a dist-upgrade.

I used to be able to use the CUPS PDF virtual printer to print anything to a PDF file. Now, it doesn't work: nothing shows up in ~/PDF when I print as an ordinary user. If I log into the CUPS administration interface and use that to print a test page to the printer, though, it works; the PDF shows up nicely in ~root/PDF. But I want to be able to print to PDF as a non-root user…

/var/log/cups/cups-pdf_log has this to say:

Fri Feb  7 18:31:57 2014  [STATUS] ***Experimental Option: DecodeHexStrings
Fri Feb  7 18:31:57 2014  [ERROR] failed to set file mode for PDF file (non fatal) (/michael/home/PDF/PDF_-_CUPS_1_5.pdf)
Fri Feb  7 18:31:57 2014  [STATUS] PDF creation successfully finished (michael)

OK, so there's failed to set file mode for PDF file. Googling for that, however, doesn't help much. I did find one web page that suggested changing the Out directory in /etc/cups/cups-pdf.conf, so I did (Out /tmp/${USER}.cups-pdf) and restarted CUPS, and when I try to print to PDF it picks up that change because it created such a directory, but then complained about the same error in the new location.

Despite seemingly being at the latest version (CUPS 1.5.3-5+deb7u1, CUPS-PDF 2.6.1-6, Debian Wheezy), I decided to reinstall CUPS just in case it had broken somehow.

sudo apt-get --reinstall -u install cups cups-pdf cups-bsd cups-client cups-common cups-driver-gutenprint cups-filters cups-pk-helper cups-ppdc

However, I am still getting the same error.

Setting LogType 7 in /etc/cups/cups-pdf.conf produces this:

Fri Feb  7 19:01:29 2014  [DEBUG] switching to new gid (lpadmin)
Fri Feb  7 19:01:29 2014  [DEBUG] initialization finished (v2.6.1)
Fri Feb  7 19:01:29 2014  [DEBUG] user identified (michael)
Fri Feb  7 19:01:29 2014  [DEBUG] output directory name generated (/tmp/michael.cups-pdf)
Fri Feb  7 19:01:29 2014  [DEBUG] user information prepared
Fri Feb  7 19:01:29 2014  [DEBUG] spoolfile name created (/var/spool/cups-pdf/SPOOL/cups2pdf-18015)
Fri Feb  7 19:01:29 2014  [DEBUG] source stream ready
Fri Feb  7 19:01:29 2014  [DEBUG] destination stream ready (/var/spool/cups-pdf/SPOOL/cups2pdf-18015)
Fri Feb  7 19:01:29 2014  [DEBUG] owner set for spoolfile (/var/spool/cups-pdf/SPOOL/cups2pdf-18015)
Fri Feb  7 19:01:29 2014  [DEBUG] using traditional fgets
Fri Feb  7 19:01:30 2014  [DEBUG] found beginning of postscript code (%!PS-Adobe-3.0)
Fri Feb  7 19:01:30 2014  [DEBUG] now extracting postscript code
Fri Feb  7 19:01:30 2014  [DEBUG] found title in ps code ((What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange))
Fri Feb  7 19:01:30 2014  [DEBUG] found end of postscript code (%%EOF)
Fri Feb  7 19:01:30 2014  [DEBUG] all data written to spoolfile (/var/spool/cups-pdf/SPOOL/cups2pdf-18015)
Fri Feb  7 19:01:30 2014  [DEBUG] trying to use PS title ((What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange))
Fri Feb  7 19:01:30 2014  [DEBUG] removing trailing newlines from title ((What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange))
Fri Feb  7 19:01:30 2014  [STATUS] ***Experimental Option: DecodeHexStrings
Fri Feb  7 19:01:30 2014  [DEBUG] checking for hex strings ((What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange))
Fri Feb  7 19:01:30 2014  [DEBUG] not a hex string, has no start marker ((What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange))
Fri Feb  7 19:01:30 2014  [DEBUG] removing enclosing parentheses () from full title ((What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange))
Fri Feb  7 19:01:30 2014  [DEBUG] calling alternate_replace_string
Fri Feb  7 19:01:30 2014  [DEBUG] removing alternate special characters from title (What does the CUPS PDF printer need to be able to set file mode? - Unix & Linux Stack Exchange)
Fri Feb  7 19:01:30 2014  [DEBUG] truncating title (What_does_the_CUPS_PDF_printer_need_to_be_able_to_set_file_mode_)
Fri Feb  7 19:01:30 2014  [DEBUG] title successfully retrieved (What_does_the_CUPS_PDF_printer_need_to_be_able_to_set_file_mode_)
Fri Feb  7 19:01:30 2014  [DEBUG] input data read from stdin
Fri Feb  7 19:01:30 2014  [DEBUG] output filename created (/tmp/michael.cups-pdf/What_does_the_CUPS_PDF_printer_need_to_be_able_to_set_file_mode_.pdf)
Fri Feb  7 19:01:30 2014  [DEBUG] ghostscript commandline built (/usr/bin/gs -q -dCompatibilityLevel=1.4 -dNOPAUSE -dBATCH -dSAFER -sDEVICE=pdfwrite -sOutputFile="/tmp/michael.cups-pdf/What_does_the_CUPS_PDF_printer_need_to_be_able_to_set_file_mode_.pdf" -dAutoRotatePages=/PageByPage -dAutoFilterColorImages=false -dColorImageFilter=/FlateEncode -dPDFSETTINGS=/prepress -c .setpdfwrite -f /var/spool/cups-pdf/SPOOL/cups2pdf-18015)
Fri Feb  7 19:01:30 2014  [DEBUG] output file unlinked (/tmp/michael.cups-pdf/What_does_the_CUPS_PDF_printer_need_to_be_able_to_set_file_mode_.pdf)
Fri Feb  7 19:01:30 2014  [DEBUG] TMPDIR set for GhostScript (/var/tmp)
Fri Feb  7 19:01:30 2014  [DEBUG] waiting for child to exit
Fri Feb  7 19:01:30 2014  [DEBUG] entering child process
Fri Feb  7 19:01:30 2014  [DEBUG] GID set for current user
Fri Feb  7 19:01:30 2014  [DEBUG] supplementary groups set for current user
Fri Feb  7 19:01:30 2014  [DEBUG] UID set for current user (michael)
Fri Feb  7 19:01:30 2014  [DEBUG] ghostscript has finished (256)
Fri Feb  7 19:01:30 2014  [ERROR] failed to set file mode for PDF file (non fatal) (/tmp/michael.cups-pdf/What_does_the_CUPS_PDF_printer_need_to_be_able_to_set_file_mode_.pdf)
Fri Feb  7 19:01:30 2014  [DEBUG] ERRNO: 2
Fri Feb  7 19:01:30 2014  [DEBUG] no postprocessing
Fri Feb  7 19:01:30 2014  [DEBUG] spoolfile unlinked (/var/spool/cups-pdf/SPOOL/cups2pdf-18015)
Fri Feb  7 19:01:30 2014  [DEBUG] all memory has been freed
Fri Feb  7 19:01:30 2014  [STATUS] PDF creation successfully finished (michael)

I do notice that it looks like Ghostscript is exiting with status 256 ([DEBUG] ghostscript has finished (256)), but I can't find anything that tells me why exactly it would exit with that error code.

My user account is not a member of the lp or lpadmin groups, but that hasn't changed.

Printing to the physical printer on my desk works fine; I did that just recently, long after printing to PDF started acting up like this.

What might be my problem?

Best Answer

Having Referred to the following post: https://ubuntuforums.org/showthread.php?t=1975881

After many research, in the end I found my problem was the permission of the folder /var/tmp/, it was 755 (drwxr-xr-x, root, root).

After changing it to 777 (drwxrwxrwx), cups-pdf works again ..

Because in the /etc/cups/cups-pdf.conf, it is indicating either /var/tmp or /tmp must be user-writable!

1.

So your first problem seems to be this:

Currently not working:

Cannot add the Windows printer driver to CUPS using the "printmanagement.msc" MMC (I get a "access denied" error). So Samba's Point'n'Print will not work.

Note, that the Windows clients do not retrieve their printer drivers from CUPS, and CUPS itself cannot communicate with the Windows clients directly.

Only Samba can do that, so Windows clients will retrieve their printer drivers from Samba. Samba poses as a Windows print server for the clients, and Samba will also provide a special share (listed [print$] in smb.conf) for clients to auto-install the drivers from. (You should try to use the UNC path of \\myserver\print$ or \\myworkstation\print$ in Windows explorer and see the drivers from any host which shares a printer.)

Windows users need a special privilege in to administer printers and configuring/uploading drivers. This privilege was named SePrintOperatorPrivilege by Microsoft.

Samba implements the SMB set of Windows networking protocols and procedures so Windows clients can use its services.

Hence, only users which have this privilege granted can upload and preconfigure printer drivers to a Samba server, just like it would be the case for a Windows print server.

Typically, you would want to grant the privilege to the Domain Admins group, plus, maybe another Domain Group you may have called Our Printer Admins. I now assume your domain name is MYDOMAIN.

To grant the named user groups that right, execute the following commands:

  net rpc rights grant "MYDOMAIN\Domain Admins" \
     SePrintOperatorPrivilege -U "MYDOMAIN\administrator"

  net rpc rights grant "MYDOMAIN\Our Printer Admins" \
     SePrintOperatorPrivilege -U "MYDOMAIN\administrator"

  net rpc rights grant "MYDOMAIN\User54321" \
     SePrintOperatorPrivilege -U "MYDOMAIN\administrator"

In each case you'll be prompted to supply the domain admin password:

  Enter MYDOMAIN\administrator's password:

If you know this password and everything works, you'll see this confirmation:

  Successfully granted rights.

Of course, you could grant this privilege to one or more individual domain users (example above: MYDOMAIN\User54321) too. But this is not recommended. Better grant the privilege to a group instead of individual accounts. This enables you to add and revoke the privilege by updating the group membership.

To list all users and groups having the SePrintOperatorPrivilege privilege granted, enter:

  net rpc rights list privileges SePrintOperatorPrivilege\
     -U "MYDOMAIN\administrator"

You should see the following output:

  SePrintOperatorPrivilege:
     BUILTIN\Administrators
     MYDOMAIN\Domain Admins
     MYDOMAIN\Our Printer Admins
     MYDOMAIN\User54321

You've now created the pre-condition that users listed above can upload and install printer drivers to your Samba server.

(Update: Just had a closer look at the smb.conf you quoted above... Replace MYDOMAIN\ with MYWORKGRP\ for the commands I gave, or skip it altogether and just use a user name or a group name known to Samba. You could possibly also temporarily try guest ok = yes inside the [print$] stanza. Don't forget to set it back to no once your drivers are in place...)

2.

Your second problem seems to be:

It seems CUPS default options interfere with the workstation's ones: I set duplex printing off by default on CUPS but want it to work if the user tick the checkbox on it's printing settings.

Where should I go to make CUPS use user's settings?

CUPS by default does not "filter" print jobs it gets handed over by Samba. It processes them as "raw" jobs and just passes them to the real print hardware device.

So if the driver is correctly installed on the Windows print clients, whatever job options they click, should be honored by the printer, regardless of default settings which may be configured into CUPS for CUPS-local printing...

You cannot "make" CUPS use user's settings -- CUPS will just pass them through.

Windows – Using cups to print to windows domain with password in a separate file

If you create the printer, either through the web ui or via lpadmin with a URL with the special characters % encoded like this:

lpadmin -p fake -v smb://bob:pass%20word@rice/BLAH -P /tmp/foo.ppd

then the password will be stored in the /etc/cups/printers.conf file (which is readable only by root) and will not be displayed in the web UI.

Be careful though as if you accidentally enter a malformed URL then the cups web-ui won't be able to figure out which bit is the password and it will be displayed.

Best Answer

Related Solutions

Windows – Store Windows print driver on Samba for a CUPS print server

1.

2.

Windows – Using cups to print to windows domain with password in a separate file

Related Question