-
Notifications
You must be signed in to change notification settings - Fork 181
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Change cupsd.conf to force authentication when accessing administration #518
Conversation
948af0b
to
b1b90de
Compare
18d108a
to
806d72a
Compare
@michaelrsweet Could we merge this one too please |
@AtariDreams I'm not the only developer for the CUPS project, and in particular @zdohnal is the release manager for the CUPS 2.4.x series... As he also works for a Linux distribution, I'd like him to review this PR and make sure it doesn't cause problems. |
Sure thing. |
89623f1
to
6eb8c2f
Compare
637adda
to
7daf3b8
Compare
With the current default configuration, anyone can request to Find New Printers without being authenticated and with no way to be authenticated. Without authentication cups does not detects printers on the network. The person might not realize that it's because authentication is missing. It seems natural to always offer to authenticate when accessing the administration page. Co-Authored-By: Dominic Mayers <dominic.mayers@meditationstudies.org>
@zdohnal Thoughts? |
@michaelrsweet Does this mean you can merge this PR or? |
Hi all, I'm still cleaning up things in Fedora/RHEL after my sickness, but I briefly looked into this PR. In general any change in configuration file is bigger or smaller problem for migrations (either between single CUPS version updates or between OS version's migrations), especially ones which depend on being in a specific scope in the config. Because the proposed change is of this kind, I would prefer the same behavior as IIUC this authentication prompt is brought by So my plan is:
or (if the migration can't be done by a script during upgrade and it would require an external migration solution like LEAPP)
Once I'm done with my script research, I'll clear the review request and let you know how we can proceed. |
Plus I've tried to check whether other clients (like cupsenable etc.) will be affected by the change, since they send requests to /admin/ resource path, but it doesn't seem to change for them - the tools require the authentication even now. |
Ok, I've come with the following:
which will get you location /admin scope in case it is not longer than 20 lines (I accounted some possible specific Allow/Deny lines, so it should cover most of use case). So Ack to the PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM once migration script is applied.
A little bit better command, where colleague helped me and taught me new things about
I hope it is useful for someone. |
With the current default configuration, someone can request to Find New Printers without being authenticated and with no way to be authenticated. Without authentication cups does not detects printers on the network. The person might not realize that it's because authentication is missing. It seems natural to always offer to authenticate when accessing the administration page.
Co-Authored-By: Dominic Mayers dominic.mayers@meditationstudies.org