CUPS

[x] GNUTLS    SSL/TLS support via GnuTLS
[x] LIBPAPER  Paper size selection support via libpaper
[x] NLS       Native Language Support

Configuration

CUPS

Information on the server name and the administrator to contact in case of problems.

# Server
ServerName              printers.example.com
ServerAdmin             admin@example.com

Records in the log errors and warnings, the size of the log file will not be limited. The print history will be retained but not the corresponding files.

# Logs 
LogLevel                warn
MaxLogSize              0 
PreserveJobHistory      Yes 
PreserveJobFiles        No 

Network

Specifies the interface on which the CUPS server is listening, and the maximum number of simultaneous connections.

Listen                  192.168.1.5:631
Listen                  /var/run/cups.sock
MaxClients              50 

Shared printers are announced on the local network over DNS-SD (Zeroconf, Bonjour). This is the whole of it:

# Browsing
Browsing                Yes
BrowseLocalProtocols    dnssd

Browsing defaults to No, so it has to be set for anything to be advertised at all; BrowseLocalProtocols defaults to dnssd where the daemon was built with Zeroconf support and none where it was not, so naming it is a statement of intent rather than a change.

Printing

Transformation filters associated with document printing are executed with a lower priority, but will not have limits imposed on memory or cpu. The number of copies to print is restricted to 30.

FilterLimit             0
FilterNice              10
MaxCopies               30

Specifies the authentication type to use for IPP users, and the system group to be used for administrative operations.

# Security
DefaultAuthType         Basic
SystemGroup             wheel

Digest and BasicDigest were removed in CUPS 2.x, and lppasswd — which existed only to maintain the digest password file — is no longer in the package at all, so the hint that used to sit commented above this block went with it. Basic sends the password in clear, but DefaultEncryption defaults to Required for authenticated requests, so it travels inside TLS unless that default is lowered.

Restricted access to the different server paths, server is accessible to all, except the administration part for which the user must be on the local network and identified as belonging to the system.

# Restrict access to the server...
<Location />
  Order allow,deny
  Allow all
</Location>

# Restrict access to the admin pages...
<Location /admin>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
  Allow from @LOCAL
</Location>

Sets the policy for managing printing operations and printers based on user type. In particular, the administrator can manage printers and kill any print request.

<Policy default>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit CUPS-Get-Document>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit CUPS-Authenticate-Job>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

Commands

Configuring Printers

Associates the printer description file (PostScript Printer Description):

lpadmin -p garfield -P HP_LaserJet_4050_Series.ppd

List the options and their default values for the specified printer:

lpoptions -d garfield -l