TweetFollow Us on Twitter

MacEnterprise: Printing with Leopard in the Enterprise

Volume Number: 24 (2008)
Issue Number: 06
Column Tag: MacEnterprise

MacEnterprise: Printing with Leopard in the Enterprise

Changes for Mac Administrators

By Greg Neagle, MacEnterprise.org

Introduction

Mac OS X 10.5 "Leopard" continues the trend of enhancements and modifications to printing on the Mac. Changes in the CUPS configuration and in the printing utilities in Leopard have the potential to simplify or complicate your environment. With a few simple changes, you can customize printing behavior in Leopard to more closely match its behavior in Tiger, and ease the transition for your users and support staff.

More Security, More Support

Printing in Leopard largely behaves as it did in Tiger. One particular change, however, might be of interest to Mac administrators: for the first time since Mac OS X was introduced, a user must be an administrator to add and remove printers.

Presumably, Apple made this change to improve security – Leopard has many changes to increase the security of Apple's OS. For most home users, where at least one user's account is an admin account, this change really doesn't affect the user experience much. But in an enterprise environment, this change can be more problematic.

In many enterprise settings, most users do not have administrative privileges. They cannot install or remove software, and cannot make many configuration changes. This provides a more stable and secure platform for enterprise users and administrators, and makes support of these machines easier. Restricting the addition of printers to admins has the potential to increase support costs, since any time a user needs to print to a new or different printer they have to contact support.

For some organizations, making the addition of printers an administrator-only function might be a good thing, especially if you tightly control printer usage. But if in your organization, the pre-Leopard behavior is a better fit, there is a way to allow non-admin users to add printers and reduce the burden on support.

CUPS configuration

To allow non-admins to add printers, we'll need to edit the cupsd configuration file, located at /private/etc/cups/cupsd.conf. You'll need to use sudo, and your favorite text editor. Look for this section:

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer¬
CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default> AuthType Default Require user @SYSTEM Order deny,allow </Limit>

Remove or comment out this section and replace it with:

# Allow non-admin users to add printers
 <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer ¬
CUPS-Add-Modify-Class CUPS-Delete-Class ¬
CUPS-Set-Default> Require valid-user Order allow, deny Allow all </Limit>

Now look for this section, which should be directly below the section you just modified:

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer ¬
Disable-Printer Pause-Printer-After-Current-Job ¬
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer¬
Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer ¬
Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Default Require user @AUTHKEY(system.print.admin) @admin @lpadmin Order deny,allow </Limit> \

Change it to:

# Allow non-admin users to pause and resume printers
  <Limit Pause-Printer Resume-Printer¬
Enable-Printer Disable-Printer Pause-Printer-After-Current-Job¬
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer¬
Restart-Printer Shutdown-Printer ¬
Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> Require valid-user Order allow, deny Allow all </Limit>

These changes allow any authenticated user perform the CUPS actions defined – the key actions we are interested in are adding printers and the ability to pause or resume printers. In many cases, the changes to the section to allow pause/resume may not be needed, because by default, any user who is a member of the lpadmin group can perform these functions, and all local users are automatically added to the lpadmin group when they are created. You might need this change in an environment with network accounts, where network users are not members of the lpadmin group.

Now test the changes. Login as a non-admin user and open a document. Choose Print from the File menu. The standard Print dialog will open. In the Printer pop-up menu, select Add Printer... You should be able to add a printer without being prompted for an admin password. Note that using the Print and Fax preferences pane in System Preferences still requires an admin password, so tell your users to add printers using the method described above (from the Print menu), or make the additional change described below to provide another way to add printers. Additionally, as the Print menu does not offer an option to delete printers, there is no user-friendly way to remove printers without allowing access in the preference pane.

If you want to revert your changes, you can simply copy /etc/cups/cupsd.conf.default to /etc/cups/cupsd.conf to restore the CUPS configuration to Apple's default settings.

Replacing Printer Setup Utility

Prior to Leopard, there were at least three ways to add a printer: using the Print and Fax preference pane, using the Printer Setup Utility in /Applications/Utilites, and by choosing Add Printer... from the Print dialog in any application (which then opens the Printer Browser in the Printer Setup Utility).

In Leopard, Apple has simplified matters somewhat by removing the Printer Setup Utility. This may confuse your users who you've upgraded from Tiger. If they are not admin users, the Print and Fax preference pane will be of no use to them, either. You can of course tell them to use the Add Printer... item in the Print dialog. But you may want to increase the chances they'll figure things out for themselves by partially restoring the missing Printer Setup Utility.

We'll do this by creating a symlink in /Applications/Utilities named "Printer Setup Utility.app" that links to the AddPrinter application in /System/Library/CoreServices:

sudo ln -s /System/Library/CoreServices/AddPrinter.app \
/Applications/Utilities/Printer\ Setup\ Utility.app

Now when you users go looking for a tool in the Utilities folder to help them add a printer, they'll find one.


AddPrinter.app

This isn't a perfect solution. AddPrinter doesn't act like a standard application, since it wasn't designed to be one. It doesn't have a menu bar, it doesn't appear in the Dock, and it doesn't automatically come to the front when opened. This may confuse your users. You may want to decide whether or not making it available in this way will lessen your support burden or increase it.

Conclusion

If Leopard's printing changes have caused support issues in your environment, you now have a few tools to use to help your users help themselves!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

The MacEnterprise project is a community of IT professionals sharing information and solutions to support Macs in an enterprise. We collaborate on the deployment, management, and integration of Mac OS X client and server computers into multi-platform computing environments.

 
AAPL
$94.24
Apple Inc.
+0.30
MSFT
$44.91
Microsoft Corpora
+0.08
GOOG
$597.95
Google Inc.
+8.48

MacTech Search:
Community Search:

Software Updates via MacUpdate

A Better Finder Rename 9.37 - File, phot...
A Better Finder Rename is the most complete renaming solution available on the market today. That's why, since 1996, tens of thousands of hobbyists, professionals and businesses depend on A Better... Read more
MacBook Air EFI Firmware Update 2.9 - Fo...
MacBook Air EFI Firmware Update is recommended for MacBook Air (Mid 2011) models. This update addresses an issue where systems may take longer to wake from sleep than expected and fixes a rare issue... Read more
FileZilla 3.9.0.1 - Fast and reliable FT...
FileZilla (ported from Windows) is a fast and reliable FTP client and server with lots of useful features and an intuitive interface.Version 3.9.0.1: MSW: Fix installation issue with locked DLLs... Read more
OS X Yosemite 10.10 DP4 - Developer Prev...
Note: This is a Developer Preview. You must be a registered Apple Mac Developer to download this update. OS X Yosemite is Apple's newest operating system for Mac. An elegant design that feels... Read more
FinderPop 2.5.6 - Classic Mac utility, n...
FinderPop is a Universal preference pane that extends OS X's contextual menus using a FinderPop Items folder much as the Apple Menu Items folder used to do for the Apple menu. It has other features... Read more
SpiderOak 5.1.7 - Secure cloud backup, s...
SpiderOak is a multi-platform secure online backup, storage, access, and sharing solution engineered for the consumer and small businesses. You must first sign up to use SpiderOak. Running natively... Read more
Espionage 3.6 - Simple, state of the art...
Espionage offers state-of-the-art encryption and plausible deniability for your confidential data. Sometimes, encrypting your data isn't enough to protect it. That's why Espionage 3 goes beyond data... Read more
calibre 1.45.0 - Complete e-library mana...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital... Read more
iFFmpeg 4.3.1 - Convert multimedia files...
iFFmpeg is a graphical front-end for FFmpeg, a command-line tool used to convert multimedia files between formats. The command line instructions can be very hard to master/understand, so iFFmpeg does... Read more
Chromium 36.0.1985.125 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. FreeSMUG-Free OpenSource Mac User Group build is... Read more

Latest Forum Discussions

See All

MTN Review
MTN Review By Jessica Fisher on July 22nd, 2014 Our Rating: :: ADORABLE, SERENE, AND AMUSINGUniversal App - Designed for iPhone and iPad MTN is an adorable, talking pet mountain that is less game and more zen garden.   | Read more »
Fly High with Ninja UP! Now Available o...
Fly High with Ninja UP! Now Available on the App Store Posted by Jessica Fisher on July 22nd, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Bio Inc. Review
Bio Inc. Review By Nadia Oxford on July 22nd, 2014 Our Rating: :: SICKENING - IN A COMPELLING WAYUniversal App - Designed for iPhone and iPad Bio Inc is about orchestrating the medical destruction of a single person. If that doesn’... | Read more »
HELMUT Review
HELMUT Review By Andrew Fisher on July 21st, 2014 Our Rating: :: TRUNDLE SIMULATOR 2014Universal App - Designed for iPhone and iPad HELMUT is a fun, fleeting time-sink that offers a momentary distraction and nothing else.   | Read more »
Walkr Review
Walkr Review By Jennifer Allen on July 21st, 2014 Our Rating: :: ORIGINAL WALKINGiPhone App - Designed for the iPhone, compatible with the iPad Walking is a bit more exciting thanks to this planet building/discovering sim reliant... | Read more »
Zombie Commando Review
Zombie Commando Review By Jennifer Allen on July 21st, 2014 Our Rating: :: MINDLESS SLAUGHTERUniversal App - Designed for iPhone and iPad Briefly fun but ultimately forgettable, Zombie Commando will scratch an itch then be... | Read more »
Swords & Poker Adventures Review
Swords & Poker Adventures Review By Jennifer Allen on July 21st, 2014 Our Rating: :: SOULLESS POKER PLAYUniversal App - Designed for iPhone and iPad Swords & Poker Adventures is a mishmash of Poker and RPGing, but it lacks... | Read more »
Warhammer 40,000: The Horus Heresy: Drop...
Warhammer 40,000: The Horus Heresy: Drop Assault Coming Soon to iOS Posted by Jennifer Allen on July 21st, 2014 [ permalink ] Coming soon to iOS will be an all-new Warhammer 40,000 tactical strategy game by the name of The Horus Heresy: Drop As | Read more »
A Life Worth Dying For Review
A Life Worth Dying For Review By Jordan Minor on July 21st, 2014 Our Rating: :: A BEAUTIFUL MINDUniversal App - Designed for iPhone and iPad A Life Worth Dying For is a fascinating portrait of a serious subject.   | Read more »
Zombie Puzzle Panic Review
Zombie Puzzle Panic Review By Jordan Minor on July 21st, 2014 Our Rating: :: THE MATCHING DEADUniversal App - Designed for iPhone and iPad Zombie Puzzle Panic puts some pretty neat undead twists on Match-3 puzzling.   | Read more »

Price Scanner via MacPrices.net

Twelve South HiRise For MacBook – Height-Adju...
If you use your MacBook as a workhorse desktop substitute, as many of us do, a laptop stand combined with an external keyboard and pointing device are pretty much obligatory if you want to avoid... Read more
Why The Mac Was Not Included In The Apple/IBM...
TUAW’s Yoni Heisler cites Fredrick Paul of Network World whoi blogged last week that the Mac’s conspicuous absence from Apple and IBM’s landmark partnership agreement represents a huge squandered... Read more
Save $100 on 13-inch Retina MacBook Pros, plu...
Adorama has 13″ Retina MacBook Pros on sale for $100 off MSRP. Shipping is free, and Adorama charges sales tax in NY & NJ only: - 13″ 2.4GHz/128GB MacBook Pro with Retina Display: $1199 - 13″ 2.... Read more
Blurr it 2.3 for iOS – Quickly Blurs Selected...
Hyderabad, India based TouchLabs has announced a new update of Blurr it 2.3, their photography app for iOS users. Blurr it allows you to blur part of the image to hide potentially sensitive or... Read more
MacBook Airs on sale for $100 off MSRP, start...
Best Buy has the new 2014 MacBook Airs on sale for up to $100 off MSRP on their online store. Choose free home shipping or free local store pickup (if available). Prices valid for online orders only... Read more
Amazon Announces Kindle Unlimited: Unlimited...
Amazon.com has introduced Kindle Unlimited — a new subscription service which allows customers to freely read as much as they want from over 600,000 Kindle books, and listen as much as they want to... Read more
New Linksys Wireless Range Extenders Boost Wi...
Linksys has announced its new lineup of Linksys Wi-Fi Range Extenders. Consumers often experience a weak wireless signal in some parts of their house or apartment caused by blocking elements such as... Read more
MacBook Airs available starting at $719
The Apple Store has Apple Certified Refurbished 2013 & 2012 MacBook Airs in stock today starting at $719. An Apple one-year warranty is included with each MacBook, and shipping is free: 2013... Read more
Get the best deals on iPad minis with Apple r...
The Apple Store has Certified Refurbished 2nd generation iPad minis with Retina Displays available for up to $130 off the cost of new models, starting at $339. Apple’s one-year warranty is included... Read more
Best Buy’s College Student Deals: $100 off Ma...
Take an additional $100 off all MacBooks and iMacs, $50 off iPad Airs and iPad minis, at Best Buy Online with their College Students Deals Savings, valid through July 25th. Anyone with a valid .EDU... Read more

Jobs Board

*Apple* Computer Technician - Fairfield Coun...
Company DescriptionWe are an Apple Authorized Sales and Service Provider. We have been selling and servicing Apple computers in the Fairfield County area for over 20 Read more
*Apple* Computer Technician - Fairfield Coun...
Company DescriptionWe are an Apple Authorized Sales and Service Provider. We have been selling and servicing Apple computers in the Fairfield County area for over 20 Read more
Mac Expert - *Apple* Online Store Mexico -...
…MUST be fluent in English and Spanish to be considered for this position At Apple , we believe that hard work, a fun environment, creativity and innovation fuel the Read more
*Apple* Computer Technician - Fairfield Coun...
Company DescriptionWe are an Apple Authorized Sales and Service Provider. We have been selling and servicing Apple computers in the Fairfield County area for over 20 Read more
Mac Expert - *Apple* Online Store - Apple (...
**Job Summary** At Apple , we believe that hard work, a fun environment, creativity and innovation fuel the ultimate customer experience. We believe each customer Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.