CUPS全稱為Common Unix Printing System,是類Unix系統上的通用打印系統，支持本地、遠程打印。CUPS主要有以下組件或子系統組成：

print spooler/scheduler: convert LPD requests to IPP; provide a web-based interface for managing print jobs, configurations

filter system：convert the print data to specified formats

backend system：send data to print devices

示意圖如下：

CUPS Simple

配置文件

[root@cups]# pwd

/etc/cups

[root@cups]# tree

.

├── classes.conf

├── client.conf

├── cupsd.conf --> CUPS服務配置

├── cupsd.conf.default

├── interfaces

├── lpoptions

├── paps.convs

├── ppd

├── printers.conf --> 打印隊列配置

├── snmp.conf

├── ssl

└── subscriptions.conf

3 directories, 10 files

以上配置文件介紹、作用、指令，大都可以使用man file來查看；若還有不明確的，可以訪問CUPS服務的Online Help頁面，內容比較詳細。

認證示例

When you enable remote administration, the server will use Basic authentication for adminstration tasks. The current CUPS server supports Basic, Digest, Kerberos, and local certificate authentication:

Basic authentication essentially places the clear text of the username and password on the network. Since CUPS uses the system username and password account information, the authentication information could be used to gain access to possibly privileged accounts on the server.

Recommendation: Enable encryption to hide the username and password information - this is the default on MacOS X and systems with GNU TLS or OpenSSL installed.

Digest authentication uses an MD5 checksum of the username, password, and domain (“CUPS”), so the original username and password is not sent over the network. The current implementation does not authenticate the entire message and uses the client’s IP address for the nonce value, making it possible to launch “man in the middle” and replay attacks from the same client.

Recommendation: Enable encryption to hide the username and password information.

Local certificate authentication passes 128-bit “certificates” that identify an authenticated user. Certificates are created on-the-fly from random data and stored in files under /var/run/cups/certs. They have restricted read permissions: root + system-group(s) for the root certificate, and lp + lp for CGI certificates. Because certificates are only available on the local system, the CUPS server does not accept local authentication unless the client is connected to the loopback interface (127.0.0.1 or ::1) or domain socket.

Recommendation: Ensure that unauthorized users are not added to the system group(s).

這裡使用”Basic Authentication”介紹下使用系統賬戶訪問CUPS服務的方式。

創建用戶/用戶

[root@cups]# groupadd cupsadmin

[root@cups]# useradd -g cupsadmin -s /sbin/nologin cupsuser

[root@cups]# passwd cupsuser

更改/etc/cups/cupsd.conf配置

[root@cups]# vim /etc/cups/cupsd.conf

... ...

# Administrator user group...

# 2013-05-06 dylanninin@gmail.com customize SystemGroup to cupsadmin

SystemGroup cupsadmin

# Only listen for connections from the local machine.

#Listen localhost:631

# 2013-05-06 dylanninin@gmail.com listen on 631 port of all the interfaces

Listen 631

Listen /var/run/cups/cups.sock

# Show shared printers on the local network.

Browsing On

BrowseOrder allow,deny

BrowseAllow all

BrowseLocalProtocols CUPS dnssd

# Default authentication type, when authentication is required...

DefaultAuthType Basic

# Restrict access to the server...

# 2013-05-06 dylanninin@gmail.com access control

Order allow,deny

Allow all

Require valid-user

Require user @SYSTEM

# Restrict access to the admin pages...

# 2013-05-06 dylanninin@gmail.com access control

Order allow,deny

Allow all

Require valid-user

Require user @SYSTEM

# Restrict access to configuration files...

# 2013-05-06 dylanninin@gmail.com access control

AuthType Default

Require user @SYSTEM

Order allow,deny

Allow all

Require valid-user

Require user @SYSTEM

... ...

重啟CUPS服務

[root@cups]# service cups restart

Stopping cups: [ OK ]

Starting cups: [ OK ]

使用浏覽器打開https://yourhostname:631，輸入用戶名、密碼即可看到管理界面，截圖如下：