[Samba] Access denied when printing to Samba printers

[Kurt Pfeifle]

Ben Finney benfinney at thegoodguys.com.au

> Thu Aug 14 10:46:41 GMT 2003
> 
> 
> Howdy all,
> 
> I'm setting up a print server machine to serve hosts in an Active 
> Directory domain.  Debian GNU/Linux ("sarge", current testing branch), 
> Samba 3.0.0beta2-1.
> 
> Success so far:
>    - All steps in the current DIAGNOSIS document 
> <http://au1.samba.org/samba/devel/docs/html/diagnosis.html>
>    - Sharing printer drivers from the [print$] share (yay!)
>    - Connecting to the Samba server from a Win2000 host
>    - Connecting to individual printer shares from a Win2000 host
> 

What exactly do you mean by "Connectiong to individual printer
share", but failure "printing anything"??

> Failure:
>    - Printing anything to said printer shares.
> 
> The Win2000 client, when attempting to print a test page to the 
> printer, immediately responds with "Access denied" and an offer to 
> lead me through the printer troubleshooting help.
> 

Have you increased "debuglevel" to 3 or 5 and watched out for the
exact messages *Samba* is logging around that "Access denied" event?
You may find it usefull to also set "debug timestamp = no" for easier
readability of log.smbd....

> Selected portions of 'testparm -vs':
> 

And what's the output of a simple 'testparm'?

> =====
> Processing section "[printers]"
> Processing section "[print$]"
> Load smb config files from /etc/samba/smb.conf
> Loaded services file OK.
> 'winbind separator = +' might cause problems with group membership.
> # Global parameters
> [global]
>          workgroup = TGGLOCAL
>          realm =
>          netbios name = TGGSPS001
>          interfaces =
>          bind interfaces only = No
>          security = DOMAIN
>          auth methods =
>          encrypt passwords = Yes
>          update encrypted = No
>          client schannel = Auto
>          server schannel = Auto
>          allow trusted domains = Yes
>          map to guest = Never
>          null passwords = No
>          obey pam restrictions = Yes
>          password server = tggad001, tggad002, *
>          private dir = /var/lib/samba
>          passdb backend = tdbsam, guest
>          guest account = nobody
>          restrict anonymous = 0
>          lanman auth = Yes
>          ntlm auth = Yes
>          client NTLMv2 auth = No
>          client lanman auth = Yes
>          client plaintext auth = Yes
>          protocol = NT1
>          acl compatibility =
>          paranoid server security = Yes
>          load printers = Yes
>          printcap name = cups

Have you really CUPS as your Unix print subsystem?
In this case there should be an additional setting of

            printing = cups

in your smb.conf..... But your "selected portions of 'testparm -vs'"
doesn't show up *any* setting for the printing. (So samba might be
defaulting to "bsd"....)

>          disable spoolss = No
>          idmap only = No
>          idmap backend =
>          idmap uid = 10000-20000
>          idmap gid = 10000-20000
>          winbind separator = +
>          winbind cache time = 600
>          winbind enum users = Yes
>          winbind enum groups = Yes
>          winbind use default domain = No
>          printer admin = @lpadmin, TGGLOCAL+Domain Admins
> 
> 
> [printers]
>          comment = All printers
>          path = /var/local/spool/samba
>          create mask = 0700
>          guest ok = Yes
>          printable = Yes
>          print command = lp -c -d %p -o raw; rm %s
>          lpq command = lpstat -o %p
>          lprm command = cancel %p-%j

These commands will not be used if you have both, "printing = cups"
and "printcap = cups"....

>          browseable = No
> 
> [print$]
>          comment = Printer drivers
>          path = /var/lib/samba/printers
>          write list = root, @lpadmin, TGGLOCAL+Domain Admins
>          guest ok = Yes
> 
> =====
> 
> The frustrating part is that this was working briefly a week ago, but 
> is not currently and I can't determine why.  This is small comfort of 
> course; but it does show that it's at least possible to get this 
> working :-)
> 

So *what* did you change during that time, to the best of your
memory? Settings, updates, hardware, clients, ....?


Cheers,
Kurt