Procedure

1. Start the cups service:

   # systemctl start cups

2. Configure the cups service to be automatically started at boot time:

   # systemctl enable cups

3. Optionally, check the status of the cups service:

   $ systemctl status cups

1. Allow the CUPS server to listen to connections from the network by setting Port 631 in the /etc/cups/cupsd.conf file:

   #Listen localhost:631
   Port 631

   Warning

   Enabling the CUPS server to listen on port 631 opens this port for any address accessible by the server. Therefore, use this setting only in local networks that are unreachable from an external network. Red Hat doesn’t recommend configuring CUPS server on a publicly accessible server.

2. Allow your system to access the CUPS server by including the following directive in the /etc/cups/cupsd.conf file:

   <Location />
   Allow from <your_ip_address>
   Order allow,deny
   </Location>

   where <your_ip_address> is the real IP address of your system. You can also use regular expressions for subnets.

   Warning

   The CUPS configuration offers the Allow from all directive in the <Location> tags, but Red Hat recommends using this directive only in trusted networks. The setup Allow from all enables access for all users who can connect to the server through port 631. If you set the Port directive to 631, and the server is accessible from an outside network, anyone on the Internet can access the CUPS service on your system.

3. Restart the cups.service:

   # systemctl restart cups

4. Open your browser, and go to http://<IP_address_of_the_CUPS_server>:631/.

   

   All menus except for the Administration menu are now available.

   If you click on the Administration menu, you receive the Forbidden message:

   

   To acquire the access to the Administration menu, follow the instructions in Acquiring administration access to CUPS web UI.

Procedure

1. To be able to access the Administration menu in the CUPS web UI, include the following lines in the /etc/cups/cupsd.conf file:

   <Location /admin>
   Allow from <your_ip_address>
   Order allow,deny
   </Location>

   Note

   Replace <your_ip_address> with the real IP address of your system.

2. To be able to access configuration files in the CUPS web UI, include the following in the /etc/cups/cupsd.conf file:

   <Location /admin/conf>
   AuthType Default
   Require user @SYSTEM
   Allow from <your_ip_address>
   Order allow,deny
   </Location>

   Note

   Replace <your_ip_address> with the real IP address of your system.

3. To be able to access log files in the CUPS web UI, include the following in the /etc/cups/cupsd.conf file:

   <Location /admin/log>
   AuthType Default
   Require user @SYSTEM
   Allow from <your_ip_address>
   Order allow,deny
   </Location>

   Note

   Replace <your_ip_address> with the real IP address of your system.

4. To specify the use of encryption for authenticated requests in the CUPS web UI, include DefaultEncryption in the /etc/cups/cupsd.conf file:

   DefaultEncryption IfRequested

   With this setting, you will receive an authentication window to enter the username of a user allowed to add printers when you attempt to access the Administration menu. However, there are also other options on how to set DefaultEncryption. For more details, see the cupsd.conf man page.

5. Restart the cups service:

   # systemctl restart cups

   Warning

   If you do not restart the cups service, the changes in /etc/cups/cupsd.conf will not be applied. Consequently, you will not be able to obtain administration access to the CUPS web UI.

Procedure

1. Start the CUPS web UI as described in Starting CUPS web UI
2. In your browser, go to localhost:631 and select the Administration tab.

3. Under Printers click Add printer.

   

4. Authenticate by username and password:

   
   Important

   To be able to add a new printer by using the CUPS web UI, you must authenticate as a user who belongs to groups defined by SystemGroup directive in /etc/cups/cups-files.

   Default groups:

   • root
   • sys
   • wheel

5. If a local printer is connected, or CUPS finds a network printer available, select the printer. If neither local printer nor network printer is available, select one of the printer types from Other Network Printers, for example APP Socket/HP Jet direct, enter the IP address of the printer, and then click Continue.

   

6. If you have selected for example APP Socket/HP Jet direct as shown above, enter the IP address of the printer, and then click Continue.

   

7. You can add more details about the new printer, such as the name, description and location. To set a printer to be shared over the network, check the Share This Printer checkbox.

   

8. Select the printer manufacturer, and then click Continue.

   

   Alternatively, you can provide a postscript printer description (PPD) file to be used as a driver for the printer, by clicking the Browse…​ button at the bottom.

9. Select the model of the printer, and then click Add Printer.

   

10. After the printer has been added, the next window allows you to set the default print options.

    

Procedure

1. Click the Printers menu to see available printers that you can configure.

   

2. Choose one printer that you want to configure.

   

3. Perform your selected task by using one of the available menus:

   • Choose Maintenance from the first drop-down menu.

     

   • Choose Administration from the second drop-down menu.

     
   • You can also check completed print jobs or all active print jobs by clicking the Show Completed Jobs or Show All Jobs buttons.

Procedure

1. Go to Administration menu, and click Maintenance → Set Default Options.

   

2. Set the print options.

   

1. Set the following directive in the /etc/cups/cupsd.conf file to:

   Encryption Required

2. Restart the cups service:

   $ sudo systemctl restart cups

Procedure

1. To access the CUPS Web UI, open your browser and go to https://<server>:631

   where <server> is either the server IP address or the server host name.

   Note

   When CUPS connects to a system for the first time, the browser shows a warning about the self-signed certificate being a potential security risk.

2. To confirm that it is safe to proceed, click the Advanced…​ button.

   

3. Click Accept the Risk and Continue button.

   

Procedure

1. Copy the .crt and .key files into the /etc/cups/ssl directory of the system on which you want to use the CUPS Web UI.

2. Rename the copied files to <hostname>.crt and <hostname>.key.

   Replace <hostname> with the host name of the system to which you want to connect the CUPS Web UI.

3. Set the following permissions to the renamed files:

   • # chmod 644 /etc/cups/ssl/<hostname>.crt
   • # chmod 644 /etc/cups/ssl/<hostname>.key
   • # chown root:root /etc/cups/ssl/<hostname>.crt
   • # chown root:root /etc/cups/ssl/<hostname>.key

4. Restart the cups service:

   • # systemctl restart cupsd

Procedure

1. Install the samba-krb5-printing, samba-client, and krb5-workstation packages:

   # dnf install samba-krb5-printing samba-client krb5-workstation

2. Optional: Authenticate as a domain administrator and display the list of printers that are shared on the Windows print server:

   # smbclient -L win_print_srv.ad.example.com -U administrator@AD_KERBEROS_REALM --use-kerberos=required
   
   	Sharename       Type      Comment
   	---------       ----      -------
   	...
   	Example         Printer   Example
   	...

3. Optional: Display the list of CUPS models to identify the PPD name of your printer:

   lpinfo -m
   ...
   samsung.ppd Samsung M267x 287x Series PXL
   ...

   You require the name of the PPD file when you add the printer in the next step.

4. Add the printer to CUPS:

   # lpadmin -p "example_printer" -v smb://win_print_srv.ad.example.com/Example -m samsung.ppd -o auth-info-required=negotiate -E

   The command uses the following options:

   • -p printer_name sets the name of the printer in CUPS.
   • -v URI_to_Windows_printer sets the URI to the Windows printer. Use the following format: smb://host_name/printer_share_name.
   • -m PPD_file sets the PPD file the printer uses.
   • -o auth-info-required=negotiate configures CUPS to use Kerberos authentication when it forwards print jobs to the remote server.
   • -E enables the printer and CUPS accepts jobs for the printer.

Verification steps

1. Log into the Red Hat Enterprise Linux host as an AD domain user.

2. Authenticate as an AD domain user:

   # kinit domain_user_name@AD_KERBEROS_REALM

3. Print a file to the printer you added to the local CUPS print server:

   # lp -d example_printer file