- This topic is empty.
-
Posts
-
How do I use / minimise the admin privileges for an LDAP 127.0.0.1 user created just to authorise printing ?
i.e. I could let Staff have the password for this admin user JUST to let them authorise printing to local USB inkjets for students
the problem is once this name/password is ‘out’ – it could be used for any admin request
how do I secure it as much as possible (if at all) ? Is there anything I can do at script / terminal level re. authorisation ?
cheers
MacTroll wrote:
Create a new local printer admin group and swap this group with the “admin” group in /etc/authorization.
I’m ready to give this a shot … I understand what’s happening, I’m just not sure about creating a local group … is this with NetInfo ?
I’ll just explain a bit more …
I can find and edit the appropriate parts of the authorisation file
I just need to clarify the groups/user steps
For what I’m after – I just want a local account for each machine with a USB (non-shared) printer . That local account would then JUST be used to authorise printing via /etc/authorisation mods. I want to avoid allowing other users to be able to authorise printing if possible, and I don’t want the account that does authorise printing to authorise anything else …
I haven’t used NetInfo manager before (other than to enable root)
cheersSorry about this … just to clarify … NetInfo Manager to create printadmin local group ? How do I put a local user (i.e. ‘printer’) into printadmin group ?
then I can drop this group in the authorisation file changes when I create the new rule that says only printadmin group (local) users can authorise printing
OK – here’s the rundown
1) Wanted a local user name/password that could authorise printing ONLY (non-admin user) on machine with USB inkjet printer, to control print access / output. Set Require admin password for local printer in WGM prefs
2) Used Sharepoint GUI to set up printauthorise group
3) Created user in SysPrefs/Accounts called printaccess
4) Sharepoint – put printaccess user in printauthorise group
5) Modified/etc/authorise by checking system.printingmanager key for rights, duplicating authenticate-admin right and changing title and group to authenticate-printauthorise and printauthorise respectively
6) Set system.printingmanager key to use new rights (authenticate-printauthorise)
7) When users choose to print, they are asked for the password from a user in printauthorise group (printaccess), which is a user/password that will ONLY authorise printing (non-admin user) and nothing else
Done
Many thanks for Authorise article and above replies
😀
- You must be logged in to reply to this topic.