Guys,
Cups has always been great, it either works or it doesn't. When it doesn't,
it has been difficult to find good documentation to fix it. On Arch, I have
run across an issue that seems simple, but I don't understand it enough to
update the Arch wiki yet, so I'm looking for a bit of help.
Symptoms:
Cups web interface (on network server - not localhost) can be accessed fine,
user is a member of 'lp' with lppasswd set giving user admin rights in the
cups password digest (md5).
SystemGroup lp sys root wheel
ServerName, ServerAdmin, ServerAlias, Port, Listen and 'Location /', 'Location
/admin' and 'Location /admin/conf' all properly set. /etc/hosts is correct.
In the web interface clicking on "admin" then "Add Printer" returns the error:
"426 Upgrade Required" meaning cups tried to switch to ssl for the Add Printer
feature and something has failed leaving the cups process hung.
'/etc/rc.d/cups stop' has no effect, 'pidof cupsd' and then 'kill <pid>' has
no effect. The only way to kill the hung process is 'kill -9 <pid>'
The cups web interface can "Edit Configuration File', 'View Access Log', 'View
Error Log', etc. all work just fine with no hang, but if you try and 'Add
Printer' the cups process hangs.
The httpd-ssl.conf is correct as are the /etc/httpd/certs. All other pages on
the site can be accessed via https, but cups hangs for some reason.
Googling, easily turns up a workaround for cupsd.conf:
DefaultEncryption Never
Which prevents cups from ever switching to ssl for configuration via the web
interface but doesn't explain why it is needed. I would like to understand why
this workaround is needed and add this information to the
https://wiki.archlinux.org/index.php/Cups page, but I don't understand why
cups is hanging.
From the error log you have the entry:
Unable to set ACLs on root certificate "/var/run/cups/certs/0" - Operation not
supported. That looks related to me.
Threads like:
https://bbs.archlinux.org/viewtopic.php?pid=756693
https://bbs.archlinux.org/viewtopic.php?id=85454
don't give any solutions - just more guessed at work-arounds.
Obviously, I'm not the only one bitten by this one:
https://bugs.archlinux.org/task/22895
but no solution or explanation there either.
Also, in all the arch bbs threads everybody says you have to use 'lp' as the
SystemGroup -- why? Why not 'sys' or 'wheel' if you are already a member and
you have proper entries in the cups password digest? It's just a group right?
If it has to be used, then why isn't it the default?
If any cups expert can steer me straight on the SystemGroup requirement and
why 'DefaultEncryption Never' is needed, I'm more than happy to write it up in
the wiki. Anybody got an explanation or link I didn't find on these issues?
--
David C. Rankin, J.D.,P.E.
