Samba not listing Cups Printers on pristine bookworm

[wrosner]

I can't get Samba to list my Cups printers on a fresh bookworm.
I have done this repeatedly many years ago, but see that stuff may have changed.

Although I set browseable = yes for [printers], testparm reports browseable = No
Even if I try to acces "hidden" printers by their Netbios address, I get an error in my WIN7 test laptop.

Following
https://www.samba.org/~ab/output/htmldo ... nting.html
I try root@alg:/etc/samba$ ldd `which smbd` | grep cups
Does this mean that libcups was "forgotten" to be built into bookworm's Samba?
Or just that things have changed?

Code: Select all

[globals] 
     ...........
# ========= cups stuff
# https://oprtr.org/cups-printserver-fur-alte-drucker-einrichten/
        load printers = yes
        printing = cups
        printcap name = cups
        map to guest = bad user
        guest account = nobody
        browseable = yes


[printers]
        comment = All Printers
        path = /var/spool/samba
        browseable = Yes 
        # public = Yes
        # guest ok = Yes
        writeable = no
        printable = yes

However, testparm -v output:

Code: Select all

[global]
        bind interfaces only = Yes
        interfaces = enp1s0.274
        log file = /var/log/samba/log.%m
        logging = file
        map to guest = Bad User
        max log size = 1000
        ntlm auth = ntlmv1-permitted
        panic action = /usr/share/samba/panic-action %d
        printcap name = cups
        security = USER
        server min protocol = CORE
        server role = standalone server
        workgroup = ROSNER
        idmap config * : backend = tdb

[printers]
        browseable = No
        comment = All Printers
        path = /var/spool/samba
        printable = Yes

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/printers


[SCANS]
        comment = canon Maxify MB5100 SCANS
        create mask = 0770
        force group = scan2smb
        guest ok = Yes
        path = /media/nfs/cleo/scans
        read only = No

Debian version 12.9 (fresh install)
Samba 2:4.17.12+dfsg-0+deb12u1
cups 2.4.2-3+deb12u8

-----------------------------------------

Full story - may be hidden quirks/side effects?
Or may be my setup and expectations are a bit weird?
anyway ....

I'm going to segment my network into different vlans.
My idea was to build a samba/cups gateway (call it ALG aka application layer gate) on OSI layer 7, some kind of proxy, to hide the real data "VAULT" from direct access from lesser trusted segments of my network.
For that purpose I've seet up a multi homed (single NIC, multiple vlan subnets) ALG box.

I managed to deliver scans from a Canon Maxify (hence the deprecated protocols) to the SCAN share on ALG and show them on WIN test clients.
This share is on a nfs, combined from multiple bind mounts, residing on, on my "real" VAULT samba server, so that other user data beyond scans are not exposed to protocols from the last millenium.
Tested, works - possible hidden side effects?

Cups on my ALG is forwarding 3 printers via IPP to VAULT. It's tested to work with cups testpages, linux clients, WIN IPP configuration and androids.
I tried "IPP everywhere" with this mDNS stuff, but can't get WIN7 (haven't bothered WIN10 / WIN11 users yet to test) to find IPP printers on *.local.

So for easy setup of WIN boxes, I tried to fall back to "good old" cups over samba.
Did I just miss some silly detail?
Does the new OpenPrinting cups break old reliabilities?
Or does my multi-subnet-proxy setup incur some weird side effects?

[wrosner]

addon:

following this advice
https://wiki.debian.org/CUPSNewArchitec ... _Mechanism
I disabled cups-browsed:

Code: Select all

$ systemctl disable cups-browsed.service

Having cups-browsed enabled, on android clients,

Code: Select all

 printers keep popping up and disapperaing

every couple of seconds,
accompanied with weird error logs aboute creating and deleting printers at that time scale.

Code: Select all

lpstat -l -e
Brother_HL_3040CN_Farblaser_ueber_cleo_alg network none ipps://Brother%20HL-3040CN%20Farblaser%20ueber%20cleo%20%40%20alg._ipps._tcp.local/cups
Canon_MB5100_via_cleo_cups_alg network none ipps://Canon%20MB5100%20via%20cleo-cups%20%40%20alg._ipps._tcp.local/cups
cleo-CUPS-PDF permanent ipp://localhost/printers/cleo-CUPS-PDF ipp://cleo3.rosner.lokal/printers/CUPS-PDF
cleo-MB5100 permanent ipp://localhost/printers/cleo-MB5100 ipp://cleo3.rosner.lokal/printers/MB5100LAN
LaserHQ permanent ipp://localhost/printers/LaserHQ ipp://cleo3.rosner.lokal/printers/laserhq
PDF_samba_share_alg network none ipps://PDF%20-%3E%20samba%20share%20%40%20alg._ipps._tcp.local/cups

Both in cups and in samba logs I remember messages regarding dbus not responding.
Is dbus a desktop thing that is not working properly on a headless setup?
Is it necessary for Samba - CUPS communication?

[arzgi]

Did you get the printer working before trying to share via samba?

[wrosner]

yes, the printers work when I print by IPP or IPP everywhere (Android)

[FreewheelinFrank]

yes, the printers work when I print by IPP or IPP everywhere (Android)

Why not print with IPP everywhere in Bookworm?

https://wiki.debian.org/CUPSDriverlessPrinting

Am I missing something?

[wrosner]

Why not print with IPP everywhere in Bookworm?

Of course, that was my first idea, instead of inserting another layer by Samba again.
And as I reported, it works fine for Android clients.

Howerver, I could not find instructions to run IPP everywhere on WIN$7
and it reads as it were skd of planned for WIN11

https://wiki.debian.org/CUPSDriverlessPrinting

This page does not even mention Windows

Window is not ont the pwg list, either
https://www.pwg.org/ipp/evefaq.html

I could manage to configure an IPP (fixed address, no "everywhere") printer on my WIN7
with "HP Color Laserjet 2500 PS" drivers misused as generic postscript
and following this instruction regarding IPP:
https://blog.blechkopp.net/linux/cups-d ... hten-5075/
But registry editing is not what I'd advice to casual users, and I have no clue how this translates to newer WIN versions.


So, until the monopoly players sort their act, my idea was to continue with "good old" SAMBA.

I mean, SAMBA & Cups is such an established configuration, I can' believe that its simply dropped in debian without any notice.

[wrosner]

To isolate the problem, I started from scratch again, resetting smb.conf to pristine.
Changed

Code: Select all

[printers]
   comment = All Printers
;   browseable = no
   browseable = yes

but testparm still reports

Code: Select all

[printers]
        browseable = No

So I'd conclude that something is not working as intended.
Time to report a bug?

[FreewheelinFrank]

Why not print with IPP everywhere in Bookworm?

Of course, that was my first idea, instead of inserting another layer by Samba again.
And as I reported, it works fine for Android clients.

Howerver, I could not find instructions to run IPP everywhere on WIN$7
and it reads as it were skd of planned for WIN11

https://wiki.debian.org/CUPSDriverlessPrinting

This page does not even mention Windows

Window is not ont the pwg list, either
https://www.pwg.org/ipp/evefaq.html

I could manage to configure an IPP (fixed address, no "everywhere") printer on my WIN7
with "HP Color Laserjet 2500 PS" drivers misused as generic postscript
and following this instruction regarding IPP:
https://blog.blechkopp.net/linux/cups-d ... hten-5075/
But registry editing is not what I'd advice to casual users, and I have no clue how this translates to newer WIN versions.


So, until the monopoly players sort their act, my idea was to continue with "good old" SAMBA.

I mean, SAMBA & Cups is such an established configuration, I can' believe that its simply dropped in debian without any notice.

As Windows 7 is unsupported, it may use Samba protocols that are insecure and not allowed in Debian Bookworm. Just a thought.

In Windows, driverless printing seems to be called Mopria (which apparently is also what Android uses).

https://openprinting.github.io/printers/

Mopria is supported in Windows 10, but 7 does support IPP printing. If you can't get Samba to work, an option would be to add the printer as driverless in Bookworm, and then share it - Windows 7 could then use that printer without a driver with an IPP connection, I believe.

[wrosner]

In Windows, driverless printing seems to be called Mopria (which apparently is also what Android uses).

As far as I could extract from quite recent M$ tech docs, Mopria is skd of future plan for 11.
And it reads like another layer on top of IPP everywhere, where consultants can sell opening closed doors.

May be I'm wrong and just dare to grab my wife's WIN10 as test unit...

Mopria (which apparently is also what Android uses).

I doubt that Android is using the addional Mopria thing.
Just Cups (pulls in avahi by default), and printers are listed in my (age old) Samsung Galaxy S7.
Native support. No extra app, config or whatever.

[wrosner]

Samba protocols that are insecure and not allowed in Debian Bookworm. Just a thought.

It's not windows, it's the Canon Maxify printer that forced me to change to legacy (SMB1 and may be even earlier) protcols.
As far as I remeber, WIN7 at least supports SMB2.
But since the problem prevails in a fresh install (with default protocol setting) as well, I don't think that's the problem.

Just another thought:

Following
https://www.samba.org/~ab/output/htmldo ... #id2660193
says if samba is built with cups support, libcups is listed in

Code: Select all

ldd `which smbd` 

I cannot find it there, although libcups2 (>= 1.7.0) is listed as dependency in current samba package description.

So either things have changed from Samba3 to Samba4, oder debian has dropped the integration, or something is broken.

[wrosner]

OK things may have changed a little bit, and all those instructions lingering on the web may have become partly obsolete.
Looks like this the "official" samba4 printing howto:
https://wiki.samba.org/index.php/Settin ... t_in_Samba

Following these instruction, I can confirm that cups support is built into samba:

root@alg:/etc/samba$ smbd -b | grep "HAVE_CUPS"
HAVE_CUPS_CUPS_H
HAVE_CUPS_LANGUAGE_H
HAVE_CUPS

Obviously, the browsing capability was dropped.
I can add the printer using the "Add printer/Add a network ... printer" dialog, and enter the (to be knwon) name of the share there.
So this is basically the same setup procedure than with IPP: entering a known cryptic printer address, taking care of typos.

In terms of user friendliness, one of the main reasons for Samba&Cups is gone?

[wrosner]

OK, I think this is the answer on my title question, in the end:

https://wiki.samba.org/index.php/FAQ#Wh ... _server(s)?
(emphasis added)

If you are using SMB2 or SMB3, there is no network browsing,
it has been replaced by Network Discovery which uses WSD/LLMNR, which are not yet supported by Samba [1].
SMB1 is disabled by default on the latest Windows versions for security reasons.
It is still possible to access the Samba resources directly via \\name or \\ip.address.

If SMB1 is enabled on Windows, check that NetBIOS over TCP/IP is also enabled, and that nmbd is started on the server.

As I don't want to reenable SMB1 on the clients, Samba browsing is gone for now