File services and printing services for networks

Transcription

1 The TISIP Foundation File services and printing services for networks Tor Halsan This material is written for the course «Linux Server Management» Resume: In this lesson, we are using a Linux computer as a file- and printing server in the network. This way, we can use a Linux computer as an alternative to Windows 2000/2003/2008 or Novell NetWare when it comes to file services and printing. Contents 2 File services and printing services for networks Introduction Passwords General Password-cracking Shadow passwords The printing environment Overall description Printing commands Print users CUPS The printer database Foomatic Summing up

2 2 File services and printing services for networks 2.1 Introduction Before we start working with the actual course material in this lesson, we have to make the following clear: 1. This lesson should be read in connection with the next lesson (samba). In the description of the this second lesson, we find the following: «We can use a Linux computer as an alternative to Windows 2003/2008 when it comes to file services and printing». This is not possible to its full extent before we have installed and configured the Samba service. 2. This lesson also has some connections to the course «Practical Linux». Several issues were presented in this course which is important background material. This is especially what is written about the file system, users, rights and groups (which was also briefly presented in the previous lesson). Students who haven t attended this course should acquire the required knowledge. Parts of the lesson can have a certain overlap with the Practical Linux course (this is hopefully the last lesson with a certain amount of overlap). Printing files on a printer works in many ways like displaying a file on a screen (with the commands cat, more or less). Nevertheless, there is an important difference in these methods. Users always have their own monitor, while with printing, many users share a printer. There has to exist some kind of a queue mechanism handling the problem that occurs when several files «fight» about getting to the printer. The Linux computer maintains a queue structure (usually one queue for each printer). Each file in the queue is called a job, and is given a unique ID number (job id). When you use a command to print a file, the printing environment makes a temporary copy of the file, assigns an ID and locates it in the printing queue. The work of maintaining and organizing this queue is done by a process called a printer spooler 1, or printer daemon 2. The process is called lpd, and is normally started in the background, at the start-up of the Linux computer. 2.2 Passwords General We have already presented users and groups several times in this course. We will now return to this, in a security perspective. 1 Spooling: a process of transferring data by placing it in a temporary working area where another program may access it for processing at a later point in time. The term spool is an acronym of Simultaneous Peripheral Off-line Output Listing. 2 Daemon: a computer program that runs in the background, rather than under the direct control of a user; they are usually initiated as background processes. Typically daemons have names that end with the letter "d": for example, sshd,

3 Passwords page 3 of 12 When you add users, you should give them as few rights and privileges as possible. Give only rights to what is absolutely necessary and no more. In the maintenance of user accounts, we can define the following security tasks: Look at which computers users log on from, and to what times. This can give you indications whether the account is used illegally or not. Remove user accounts not in use. A typical example is persons that have quit. We can hear a lot of examples of attacks that have happened via previous employees user accounts. The loyalty of the company decreases when not working there anymore. Watch user accounts continuously to see if accounts haven t been used for a while, and disable them if necessary. Remove accounts that have expired. Watch logs to see if there have been any cracking attempts. One of the best insurances of security is to have good password routines. On the other hand, passwords (or user accounts in general) are often the most usual way to attack a network. It is very important to motivate users to choose good passwords. Every word that could be found in dictionaries or proper names, are not suitable as passwords. They could be cracked in just a few minutes. Many users think that they don t have that much interesting information on their accounts that anyone would ever be interesting in cracking their account. This is a very dangerous thought. If someone cracks the password of one user (who hasn t got very much interesting information on his area), the cracker has one leg inside the system. He could do a lot of harm from this spot and from a protected identity. It would also be significantly much easier to get further in when controlling a user account. This could be compared to leaving the entrance door open when going on vacation, since you only keep some old shoes in the entrance hall. We will return to password and security in a later lesson Password-cracking In the 11th lesson, we will look further on practical methods for securing the password system as much as possible. By using the cracker s own methods, we can be ahead of those who try to crack the system. Networks with an active security policy will often try to crack their own users passwords. There are various tools for password cracks, examples could be: Crack this is the traditional cracker tool, written by Alec Muffet. Crack only exists in Unix/Linux version. Crack is one of the most effective cracker programs, is stable and considered secure. Qcrack a newer tool that is more advanced than the original crack. It is a heavier program, and thus slower than Crack. John the Ripper John will be presented as an example of such tools in lesson 11. This is of the more popular cracker tools for Linux. There are also Windows versions of the program. THC-Hydra A network logon cracker, very versatile. Claymore we include this in the end of this presentation. Claymore is made for the Windows platform, but can handle many different kinds of password files.

4 page 4 of 12 File services and printing services for networks Shadow passwords Traditional UNIX systems previously kept the password file readable for everyone. A password file contains the users, with encrypted passwords. This makes the password file (which usually is the starting point for a cracker) very accessible. To prevent this open display the use of shadow passwords has become default. This means that passwords are kept in a file, partly hidden for other users than root (the file is named shadow). We will look at an example of a line in the passwd file (this example is from regular passwords, not shadow): bimbo:$1$qxutcyaf$qvnx6/jgzehxctunrc240.:1001:1001::/home/bimbo:/bin/bash The fields in this file have been presented in the previous lesson. We will now focus on the second field (after the username). This is an encrypted version of the password. This password is encrypted by an algorithm 3 which also comes out with a fixed number of characters (not dependent of the original password size). The size of this encrypted password string varies to some extent from distribution to distribution. The encrypted password is not convertible which means that it is not possible to find the password from the encrypted version. The system verifies the password by encrypting the given password and compares it with the one in the password file. A cracker trying to find passwords uses brute force to try out as many passwords as possible (typically using large dictionaries). It usually hits some passwords after a while. Using shadow passwords is a good alternative to the old regular ones. With shadow passwords, the encryption is moved to another file /etc/shadow which only the administrator (root) has access to. A line showing a corresponding example as the one from the passwd file is shown below (first /etc/passwd, then /etc/shadow): bimbo:x:1001:1001::/home/bimbo:/bin/bash bimbo:$1$qxutcyaf$qvnx6/jgzehxctunrc240.:14259:0:99999:7::: We can see that the password encryption in the shadow file is the same as in the passwd file before the conversion. If we want to ensure that the rights are as expected, we can see that the response from the command ls -l on both passwd and shadow: -rw-r--r-- 1 root root :24 passwd -r root root :24 shadow We see that users don t have read access to the shadow file, only root has that. You can convert from regular passwords to shadow passwords with the command # pwconv and similar the other way around (from shadow passwords to regular passwords) with the command # pwunconv Linux computers in networks and/or with multiple users should always use shadow passwords. 3 This algorithm is called md5

5 The printing environment page 5 of The printing environment When we now move on to the printing environment, we are back to the main issue for this lesson. The paper free society has been discussed on so many kilometers of paper, that this fact itself should be enough to kill this myth. What seems rather clear is that computers all over the society and all offices do not lead to less usage of paper, but rather the opposite. It has never been as easy to produce new documents and make them available as now. This leads to a large need of printing services. Every network needs the opportunity to print files. This could be done in several ways: You can print from each workstation (local printing) You can set up a Linux computer that takes care of network printing (print server) You can print through Samba, and send prints from a Windows computer to a Linux computer that handles the copies Overall description The printing environment is usually set up at the installation of an ordinary Linux distribution. When looking at the printing environment, there are two ways to attack this issue: 1. Installation and configuration of printers and the printing environment. 2. The use of printers in an already installed printing environment. We will look at both tasks in this lesson. There are two ordinary systems for the Linux printing environment, lpd and the newer service CUPS. We will start with a presentation of lpd and finally look at installation and configuration of CUPS. Printers can be installed in many different ways. We have already said that a Linux computer could be set up to handle local printing or function as a print server. If you are working with a larger network, it would be preferable to install the printer directly on the network cable. You then need a printer with a network interface card. Another alternative is to connect the printer directly to the Linux computer you are printing from. It will then become a local printer. You then connect the printer to the parallel port or to the USB port (which is the most common in newer printers). A third alternative is to make a local printer available for other computers in the network by allowing that others use this printer (as mentioned above, this can be handled by Samba) Printing commands When you want to print a document in Linux, you often use the lp- and lpr command. These commands send the content of the file that you specify, and sends it to a print spooler. More detailed, this means that the service sends the file to a spooling area. The spooler handles several copies simultaneously and acts as an agent for the user that receives missions. The user can then regard the mission as done when the agent has taken it (and just wait for the results, just like using agent 007).

6 page 6 of 12 File services and printing services for networks lpd There is especially one service (or «daemon») in the Linux network that is central in the printing environment this is the lpd-daemon. Linux is traditionally pre-configured to run this daemon 4. lpd looks after new files in the spooling area continuously. If new files have arrived, they are sent to the correct printer. lpd can (by default) only send clean text copies to the printer. If more advanced copies are to be printed (like PCL and PostScript), they have to go through some filters. There are some possibilities for controlling and management of the printing environment with lpd. If you want to stop the printing environment on a computer, you can kill the lpd process. A final way to stop the printing environment is the following command: # kill -9 <process-id> This is a strong command since it interrupts the printing environment brutally (kill sends the signal sigkill, which tells the process to die immediately, it doesn t even save copies in the queue). LPRng A newer version of the printing daemon is LPRng (ng stands for next generation and tells us that this is the replacement for lpr). This is easier to administer, especially in larger environments. It also has an easier code language and a higher level of security. lpr Copies are sent to the spool area (and thereafter to lpd) by the command lpr. Software like browsers (Mozilla Firefox) or office suites (like OpenOffice) use this command for sending copies, but then via dialog boxes. It is possible to send several files in a row (lpr file1 file2 file3 sends all these three files to the print queue). It is also possible to add some options to lpr: Option Explanation #number Prints several copies -p Formats the document with the command pr, that performs some formatting like page breaks. -P printer Sends the copy to the printer printer. We can for example send the following job: $ lpr -P inkjet.printer -#4 offer.ps estimate.ps This command will send these two documents in four copies to the printer called inkjet.printer. 4 CUPS seems to to take over this role, so we will focus mainly on CUPS

7 The printing environment page 7 of 12 lpq You can check status for the printer with the command lpq [-l] [-P printer] [user-id] The first option prints the information about each single file that is in the queue. If you want particular details about a specific printer, you can use the other option. The last option gives information about all copies that belong to a specific user. lprm If you want to remove a copy from the queue, you can use the command lprm [-P printer] [job nr] [user-id] The first option removes all copies from a printer. The second option removes a specific job, the job number can be found by lpq. If you add a hyphen here, all copies in the queue will be removed. The last option removes all jobs that belong to a specific user Print users Services on the Linux system must often have a user associated to it. This user is given rights to different resources (for example files and folders). In order to get the printing environment to work, there must be a user, lp. There must also be a group with the same name CUPS The printing service lpd with the programs that belong there have been available approximately as long as UNIX has existed. For some years now, an alternative for the printing environment has matured. This is CUPS. CUPS is short for Common Unix Printer System. There is a lot of information available on With CUPS, printer management is very easy in many ways easier than in Windows. This is not something everybody has experienced with the old lpd environment. There is support for very many printers most of the printers in sale, and new support is developed as the new printers are developed. There is a list of available printers on CUPS web pages. CUPS uses the protocol IPP (Internet Printing Protocol) for administering of print jobs and queues. CUPS is licensed under the GNU license, which means free use and possibilities to modify it. CUPS installation CUPS installation is done like every other service in this course. You can either install from source code (with compilation), by a binary distribution (for example.deb), by using the package manager apt or the easiest way installation with the operating system. The printing environment is usually installed together with the operating system for desktop environments. If this has not been done, it could be wise to read this section. CUPS is the default printing environment in Debian. If you check for support for printing during installation of Debian, CUPS will be installed.

8 page 8 of 12 File services and printing services for networks Binary installation (via apt) This is by far the most easy way to install CUPS. On our Debian installation we simply type: # apt-get install cups cups-client Apt will take care of the rest. If you printer is a HP printer, it is a might be a good idea to install the package hplip as well. Some programs are dependent of the command lpr for printing. In order to provide this command with CUPS (thus replacing the old «non-cups» BSD Printer Spooler lpr, see also below) we install the package cups-bsd: # apt-get install cups-bsd Binary installation (of dowloaded.deb-file) Remove the lpr service if installed. On distribution using deb (for example Debian and Ubuntu), this is done as follows (you have to be logged in as root to be able to do this): # apt-get remove lpr --purge You are now ready to install CUPS. Find the deb packet for CUPS 5 Then write: # dpkg -i cups-<version-number>.deb There may be some dependencies. In that case, try apt-get install -f. Source code installation Installation from source code follows the same recipe as usual. We go to and find a place to download zipped source code. We store them on a suitable location on the Linux computer (for example /usr/local/src). Please note the the current version may be newer than used here: # cd /usr/local/src # tar zxvf cups source.tar.gz [...] # cd cups We find the installation procedure in INSTALL.txt: #./configure [...] # make [...] # make install It is possible to set up some options during the installation where you can specify where CUPS is to be installed. It is worth noticing that CUPS overwrites (and removes) other printing commands (for example lpr) if you run this printing environment. 5 Apple does not provide binary installation files officially, you have to search the Internet to find a packet.

9 The printing environment page 9 of 12 Start-up and configuration of CUPS CUPS is started like most other services: # /etc/init.d/cups start In stead of «start», you may control the dæmon with «reload», «restart», «status» or «stop». You are now ready to configure CUPS. This could be done in four different ways: 1. By commands 2. By graphical user interface in X-Windows 3. By a Windows program you download and install 4. By an ordinary browser This last method is default in the CUPS installation. I prefer this method (especially in a course), since it is equal to every distribution. You now simply start a browser, and write in the URL field. Figure 2.1 shows the screenshot we now get. Figure 2.1: CUPS web administration You can now configure CUPS from the browser. We will present installation and configuration of a local printer here.

10 page 10 of 12 File services and printing services for networks We first click «Add printer». I then enter the necessary information about the printer and click continue. What I write here has no practical implications for the printer, but is only for information to you or other users or administrators. The name should just be a short name without spaces, e.g. HPLJ5100N. After this, you have to choose device through a dropdown list. I my case, this was the App- Socket/HP JetDirect as I have a HP LaserJet 6 connected as in the example above. I then chose connection method and press «next». After this, I am asked to choose from a list of printer drivers for this printer. I choose the correct one. The last step is to give the credentials of root in order give the CUPS administration interface access rights to install the printer. Now the printer is set up, and we receive a message that Printer HPLJ5100N has been added successfully. We can now go back to the start image (figure 2.1) and click «Manage printers». I now find the printer in the list, and click on it. From here, I can print a test page or administer the printer (for example change paper size 7, resolution or other ordinary printer configurations). Printing from other computers In the introduction of this lesson, we should also mention that other computers (either Windows or Linux) may use a printer that is locally connected. If you wish to do this, the following has to be done: Go to the file cupsd.conf (this file is normally located in the folder /etc/cups). Modify the part of this file that states the listening address (CUPS is by default set up so that other printers are not allowed to print through it). Change: Listen localhost:631 to: Listen *:631 This allows the whole Internet to use your printer, you can restrict this further down in the file, or in the files /etc/hosts.allow and /etc/hosts.deny If you wish to give access to a Windows computer, you have to go to the control panel and choose printers. You now choose «Add printer» and specify that it is a network printer. Check «Internet printer», and type the address: of linux printer server>:631/ipp/<name of printer> The printer should now be installed. If you are adding a remote printer from another Linux computer, you use the same web tool as we have seen above, and add a printer via the Internet Printing Protocol. 6 The package hplip in Debian s repository provides a lot of drivers and tools for HP printers and scanners 7 Also verify that the file /etc/papersize is correct

11 Summing up page 11 of 12 Printing on printers connected directly to the network Most printers in networks are installed directly on the network cable, and have their own IP address. There are separate configuration programs used to set up these printer with the correct configuration (for example assigning them IP addresses), but we don t go to examples on this matter. To connect such a printer, you use the same procedure as if the printer was connected to another Linux computer. You go to CUPS web interface, and add a printer on the computers that you want to print from. Choose a printer that is connected via the HTTP protocol ( socket (socket://<ip>:9100) or the IPP (ipp://<ip>/ipp) protocol if there is support for that. Those interested in additional reading can look at the article «Overview of Linux Printing» from Linux Journal. (published in July 2003) The printer database Foomatic A good advice to everyone who are going to install printer under Linux is to take a look at the large printer database Foomatic. Go to and find your printer (it is very likely that your printer is there it is quite large, and well maintained). My laser printer is an HP LaserJet 5100N. If I go to the database for this printer, I find the following information (cut): Figure 2.2: OpenPrinting Database entry for HP LaserJet 5100 There is much more information further down, e.g. links to recommended drivers. Here, we can find detailed installation guides for CUPS, LPD, LPRng and many other printer kinds. 2.4 Summing up We have looked at how we configure a Linux computer to function as a server for the most basic services for Linux networks in this lesson file and print services. We have focused mostly on

12 page 12 of 12 File services and printing services for networks the print services, and looked at both local printers and network printers. We have presented both the traditional system for printing (lpd) and the newer system, CUPS. We have chosen to spend most of the space on CUPS since it gives us an easier way to handle printer drivers, which in the other case could be quite troublesome. CUPS drivers are available for most printers today. This makes it easier to set up the printing environment. Given this situation, we can say that the future of Linux printing belongs to CUPS. In the next lesson, we extend this further, and present how we use the Linux server in larger networks, together with Windows computers the Samba service.