Printing to XP local printers from Samba

We've used the Samba system for years, and it's been an outstanding performer. Support is great, and it has a very wide following. We love Samba.

The one sticking point that's long been troublesome for us is permissions, and trying to get Samba to get along with the many varied Windows permissions systems has caused no end of grief. The bulk of this is our own ignorance of the big picture, but that doesn't make it not frustrating.

A customer with Samba 2.2.7a on SCO Open Server 5.0.5 prints to many PC-local workstations, but it hasn't worked for XP. It wasn't that hard to figure out, but we figure we'll document it here for the rest of the world that has to figure this out.

Our /usr/local/samba/lib/smb.conf file contains

[global]
        guest account = nouser
        comment = my samba machine
        encrypt passwords = yes
        workgroup = UNIXWIZ
        security = share
        create mask = 0777

        log file = /usr/local/samba/log/log.%m

We think that most of these entries are not actually used for doing UNIX-to-PC printing, but this is our configuration nevertheless. SCO Unix uses nouser for the guest account, but other systems may use nobody or other low-privilege users. Select to taste.

XP Professional Setup

The short answer is that one way - but probably not the only way - to enable XP printing from Samba is by enabling the guest account. This must not be done if the machine in question can be reached from the internet - it's very dangerous - but inside an office environment you'll have to assess the risk of this. We have not looked into how XP Home Edition fits into this mix in any way.

Go to the control panel and open the "User Accounts" tab. From here select the Advanced tab and click the Advanced button:

Clock on the Users folder and see if the Guest account is disabled on the right side. If so, as shown here,

double-click on the Guest entry to bring up properties for this user:

Uncheck the Account is disabled checkbox and click OK until all the windows are closed.

Printing from Samba

Our customary printing is from the System V lp spooler's interface script, but ultimately it comes down the use of the smbclient command one way or the other.

A small shell script that routes a file to a remote printer looks like this:

{
    echo "print -"

    cat filename

} | smbclient //WIZ/HPJET -P -N -U guest

The smbclient is doing the real work, and it routes the job to the printer HPJET on computer WIZ.

The -P parameter informs Samba that we're connecting to a printer resource, -N suppresses any password prompt, and -U guest gives us the user name to connect as. The guest account typically does not require a password.

The initial print - is given as the first input to smbclient, and it is required to -- we think -- enable direct passthrough printing of the data that follows. This presumed that the data stream is already formatted correctly for the output device and won't need to be reinterpreted by the local printer driver.

Security Issues

Opening up a guest account is a really bad idea in many circumstances, especially if there is no protection from untrusted users in the area. For those circumstances, it may be required to add a "printer" user to each XP workstation, assign a password and very limited local-machine privileges, and modify the smbclient command to include this password.

We've tried this on a test network and haven't ever been able to make it work. This is troubling, and we expect that when our needs demand it we'll take that extra step to figure it out.

It may be possible to simly add a password to the guest account, but we don't know if that will break other things.

networker emptor

Navigate: More Tech Tips