[Samba] Access denied, unable to connect to printer

[Kurt Pfeifle]

Norman Walsh ndw at nwalsh.com wrote on Samba Digest

> Mon Apr 28 10:21:43 GMT 2003
> 
> 
> / "Kurt Pfeifle" <kpfeifle at danka.de> was heard to say
> | Unforch, 2.2.3a is very old, with many known weaknesses in the printing
> | code.
> 
> I should go off and build something more recent, eh? Fair 'nough.
> I see Debian binaries for 2.2.8, would that be significantly better?

I would assume so. Just cat all the changelogs from in between 2.2.3a and
2.2.8 and grep for "print"....   ;-)

> 
> |> The server is using Cups
> |
> | Which version of CUPS?
> 
> 1.1.15
> 
> | What is the exact message you are getting on XP? What is the exact
> | procedure you are using to connect to the printer?
> 
> I get "Access dened, unable to connnect"
> 
> First I double-click on a share drive to make sure I get prompted for
> username/password. After I've made sure I can connect to the server, I
> double click on the printer and it says "epson - Access dened, unable
> to connnect" in the status bar.

That's strange.

> | Is it XP Prof or XP Home? Service Packs?
> 
> Uhm, XP Home I would guess.

Hmmmm... that is a completely different animal from XP Prof and I have no
experience with it.

What does the "ver" command give you in a DOS box?

> I've been running the "recommended
> updates" when they arrive but I haven't installed any service packs
> explicitly.
> 
> | Are you intending to have the driver downloading from the server to the
> | XP client ?
> 
> No, I've already got the drivers on the XP box (by plugging the
> printer directly into it once and installing them).
> 
> | Or have you installed a driver locally and plan to print "raw" thru
> | CUPS?
> 
> Right.
> 
> |> I'm totally stumped. I set debuglevel=5 in smb.conf and watched the
> |> log files, but I can't see anything that looks like an error.
> |> Help?
> |> Here's my smb.conf:
> |> [global]
> |>         debuglevel = 5
> |> 	server string = Zeus
> |> 	encrypt passwords = true
> |> 	obey pam restrictions = Yes

Are you trying to authenticate via PAM?

AM authentication is always ignored in the case of "encrypt passwords = yes".

What is the setting for "security" on your Samba box?
If you haven't set it in smb.conf, "testparm" will show you the
compiled-in default taken in lieu of a specified "security = .."
line...

> |> 	passwd program = /usr/bin/passwd %u
> |> 	passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .
> |> 	syslog = 0
> |> 	log file = /var/log/samba/log.%m
> |> 	max log size = 1000
> |> 	printcap name = lpstat
> |
> | ??? see below...
> |
> |> 	domain master = True
> |> 	dns proxy = No
> |> 	wins support = Yes
> |> 	invalid users = root

I am not sure what this does to your printing attempts from XP....

> |> 	printing = cups
> |
> | If "printing = cups" you should also specify "printcap name = cups".
> | CUPS doesn't need a printcap for itself. But it can generate
> | one and keep it up to date for the convenience of those 3rd
> | party apps that need to see a printcap. Check in cupsd.conf
> | if CUPS writes a printcap ("Princap /etc/printcap" setting).
> 
> Ok. This is actually an older smb.conf that I was playing with. It
> worked once before, you see...but I've rebuilt the server from the
> ground up since then.
> 
> I'll fix the printcap name

This would only change a thing for other potential printers. Since you
specified an extra share for [epson] all the settings inside that [epson]
share should take prevalence. Other, not here specified parameters from
the [global] and the [printers] sections are inherited into [epson].
So these additionally inherited parameters might come to bear here
too:

invalid users = root    # (possibly overridden by "guest ok = yes")

> |> [epson]
> |> 	comment = Epson CX3200
> |> 	path = /var/spool/samba
> |> 	read only = No
> |> 	create mask = 0777
> |> 	guest ok = Yes
> |> 	printable = Yes
> |> 	print command = lpr -P %p -o raw %s -r
> |> 	lpq command = lpstat -o %p
> |> 	lprm command = cancel %p-%j
> |
> | All these commands will have no effect, if "printing = cups" is
> | specified and your smbd is linked against libcups.so (check with
> | "ldd `which smbd` | grep cups").
> 
> It is.
> 
> | If you *want* to use your own print commands (also for debugging
> | reasons), use "printing = sysv" and "printcap name = /etc/printcap"
> | [or whichever path is appropriate].
> 
> I'm happy to have cups do it.
> 
> | To troubleshoot the "Access denied", you might want to
> | look into the "smbstatus" command, which shows *as which
> | user* Samba is connecting clients to each share.

Did you check this out?

> | One final attempt to describe a more complete procedure:
> |
> | Can you connect with smbclient? Try (from a Linux client):
> |
> |     smbclient //[SambaIPaddress]/[printersharename] -U root%[password]
> |
> | You should see s.th. like this:
> |
> |     added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
> |     Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
> 
> Oddly, "ndw" (me) fails: NT_STATUS_LOGON_FAILURE. But dbw (my wife),
> guest, and nobody all succeed.

Have you added "ndw" to the list of valid Samba users? Try

   smbpasswd -a ndw

as root. Or use any other authentication scheme you might have configured.

[But it is still very strange, since the "guest ok = yes" should let you
access the share... Could it possibly be that WinXP Home isn't fit for
networking inside an NT-domain-like environment?

You *should* be able to get some more meaningful messages by staring at

   tail -f /var/log/samba/log.[name_of_XPclient]

while you try to connect...]

> | If this works, install the driver to use your parallel port on Windows XP.
> | Then try this from the "DOS window" in XP:
> |
> |     net use lpt1: \\[SambaIPaddress]\[printersharename] -U root%[password]

This should of course be

         net use lpt1: \\[SambaIPaddress]\[printersharename] -U Administrator%[password]

> 
> I can try this next time I have the laptop in front of me.
> 
> Thanks for the clues.
> 
>                                         Be seeing you,

OK -- we'll see...  ;-)

>                                           norm
> 

Cheers,
Kurt