[Samba] Access denied when printing to Samba printers
kpfeifle at danka.de
Thu Aug 14 05:18:47 GMT 2003
Ben Finney benfinney at thegoodguys.com.au
> Thu Aug 14 10:46:41 GMT 2003
> Howdy all,
> I'm setting up a print server machine to serve hosts in an Active
> Directory domain. Debian GNU/Linux ("sarge", current testing branch),
> Samba 3.0.0beta2-1.
> Success so far:
> - All steps in the current DIAGNOSIS document
> - Sharing printer drivers from the [print$] share (yay!)
> - Connecting to the Samba server from a Win2000 host
> - Connecting to individual printer shares from a Win2000 host
What exactly do you mean by "Connectiong to individual printer
share", but failure "printing anything"??
> - Printing anything to said printer shares.
> The Win2000 client, when attempting to print a test page to the
> printer, immediately responds with "Access denied" and an offer to
> lead me through the printer troubleshooting help.
Have you increased "debuglevel" to 3 or 5 and watched out for the
exact messages *Samba* is logging around that "Access denied" event?
You may find it usefull to also set "debug timestamp = no" for easier
readability of log.smbd....
> Selected portions of 'testparm -vs':
And what's the output of a simple 'testparm'?
> Processing section "[printers]"
> Processing section "[print$]"
> Load smb config files from /etc/samba/smb.conf
> Loaded services file OK.
> 'winbind separator = +' might cause problems with group membership.
> # Global parameters
> workgroup = TGGLOCAL
> realm =
> netbios name = TGGSPS001
> interfaces =
> bind interfaces only = No
> security = DOMAIN
> auth methods =
> encrypt passwords = Yes
> update encrypted = No
> client schannel = Auto
> server schannel = Auto
> allow trusted domains = Yes
> map to guest = Never
> null passwords = No
> obey pam restrictions = Yes
> password server = tggad001, tggad002, *
> private dir = /var/lib/samba
> passdb backend = tdbsam, guest
> guest account = nobody
> restrict anonymous = 0
> lanman auth = Yes
> ntlm auth = Yes
> client NTLMv2 auth = No
> client lanman auth = Yes
> client plaintext auth = Yes
> protocol = NT1
> acl compatibility =
> paranoid server security = Yes
> load printers = Yes
> printcap name = cups
Have you really CUPS as your Unix print subsystem?
In this case there should be an additional setting of
printing = cups
in your smb.conf..... But your "selected portions of 'testparm -vs'"
doesn't show up *any* setting for the printing. (So samba might be
defaulting to "bsd"....)
> disable spoolss = No
> idmap only = No
> idmap backend =
> idmap uid = 10000-20000
> idmap gid = 10000-20000
> winbind separator = +
> winbind cache time = 600
> winbind enum users = Yes
> winbind enum groups = Yes
> winbind use default domain = No
> printer admin = @lpadmin, TGGLOCAL+Domain Admins
> comment = All printers
> path = /var/local/spool/samba
> create mask = 0700
> guest ok = Yes
> printable = Yes
> print command = lp -c -d %p -o raw; rm %s
> lpq command = lpstat -o %p
> lprm command = cancel %p-%j
These commands will not be used if you have both, "printing = cups"
and "printcap = cups"....
> browseable = No
> comment = Printer drivers
> path = /var/lib/samba/printers
> write list = root, @lpadmin, TGGLOCAL+Domain Admins
> guest ok = Yes
> The frustrating part is that this was working briefly a week ago, but
> is not currently and I can't determine why. This is small comfort of
> course; but it does show that it's at least possible to get this
> working :-)
So *what* did you change during that time, to the best of your
memory? Settings, updates, hardware, clients, ....?
More information about the samba