4 >Printing Support in Samba
2.2.x
</TITLE
7 CONTENT=
"Modular DocBook HTML Stylesheet Version 1.57"></HEAD
23 >Printing Support in Samba
2.2.x
</A
35 >Beginning with the
2.2.0 release, Samba supports
36 the native Windows NT printing mechanisms implemented via
37 MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of
38 Samba only supported LanMan printing calls.
</P
40 >The additional functionality provided by the new
41 SPOOLSS support includes:
</P
47 >Support for downloading printer driver
48 files to Windows
95/
98/NT/
2000 clients upon demand.
53 >Uploading of printer drivers via the
54 Windows NT Add Printer Wizard (APW) or the
55 Imprints tool set (refer to
<A
56 HREF=
"http://imprints.sourceforge.net"
58 >http://imprints.sourceforge.net
</A
64 >Support for the native MS-RPC printing
65 calls such as StartDocPrinter, EnumJobs(), etc... (See
66 the MSDN documentation at
<A
67 HREF=
"http://msdn.microsoft.com/"
69 >http://msdn.microsoft.com/
</A
71 for more information on the Win32 printing API)
76 >Support for NT Access Control Lists (ACL)
81 >Improved support for printer queue manipulation
82 through the use of an internal databases for spooled job
87 >There has been some initial confusion about what all this means
88 and whether or not it is a requirement for printer drivers to be
89 installed on a Samba host in order to support printing from Windows
90 clients. A bug existed in Samba
2.2.0 which made Windows NT/
2000 clients
91 require that the Samba server possess a valid driver for the printer.
92 This is fixed in Samba
2.2.1 and once again, Windows NT/
2000 clients
93 can use the local APW for installing drivers to be used with a Samba
94 served printer. This is the same behavior exhibited by Windows
9x clients.
95 As a side note, Samba does not use these drivers in any way to process
96 spooled files. They are utilized entirely by the clients.
</P
98 >The following MS KB article, may be of some help if you are dealing with
99 Windows
2000 clients:
<I
101 >How to Add Printers with No User
102 Interaction in Windows
2000</I
106 HREF=
"http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP"
108 >http://support.microsoft.com/support/kb/articles/Q189/
1/
05.ASP
</A
131 >[print$] vs. [printer$]
</B
138 >Previous versions of Samba recommended using a share named [printer$].
139 This name was taken from the printer$ service created by Windows
9x
140 clients when a printer was shared. Windows
9x printer servers always have
141 a printer$ service which provides read-only access via no
142 password in order to support printer driver downloads.
</P
144 >However, the initial implementation allowed for a
148 >printer driver location
</I
151 to be used on a per share basis to specify the location of
152 the driver files associated with that printer. Another
159 a means of defining the printer driver name to be sent to
162 >These parameters, including
<TT
168 > parameter, are being depreciated and should not
169 be used in new installations. For more information on this change,
170 you should refer to the
<A
172 >Migration section
</A
185 >Creating [print$]
</A
188 >In order to support the uploading of printer driver
189 files, you must first configure a file share named [print$].
190 The name of this share is hard coded in Samba's internals so
191 the name is very important (print$ is the service used by
192 Windows NT print servers to provide support for printer driver
195 >You should modify the server's smb.conf file to create the
196 following file share (of course, some of the parameter values,
197 such as 'path' are arbitrary and should be replaced with
198 appropriate values for your site):
</P
201 CLASS=
"PROGRAMLISTING"
203 path = /usr/local/samba/printers
207 ; since this share is configured as read only, then we need
208 ; a 'write list'. Check the file system permissions to make
209 ; sure this account can copy files to the share. If this
210 ; is setup to a non-root account, then it should also exist
211 ; as a 'printer admin'
212 write list = ntadmin
</PRE
216 HREF=
"smb.conf.5.html#WRITELIST"
224 > is used to allow administrative
225 level user accounts to have write access in order to update files
226 on the share. See the
<A
227 HREF=
"smb./conf.5.html"
231 > for more information on configuring file shares.
</P
233 >The requirement for
<A
234 HREF=
"smb.conf.5.html#GUESTOK"
241 > depends upon how your
242 site is configured. If users will be guaranteed to have
243 an account on the Samba host, then this is a non-issue.
</P
251 >The non-issue is that if all your Windows NT users are guaranteed to be
252 authenticated by the Samba server (such as a domain member server and the NT
253 user has already been validated by the Domain Controller in
254 order to logon to the Windows NT console), then guest access
255 is not necessary. Of course, in a workgroup environment where
256 you just want to be able to print without worrying about
257 silly accounts and security, then configure the share for
258 guest access. You'll probably want to add
<A
259 HREF=
"smb.conf.5.html#MAPTOGUEST"
263 >map to guest = Bad User
</B
265 > in the [global] section as well. Make sure
266 you understand what this parameter does before using it
271 >In order for a Windows NT print server to support
272 the downloading of driver files by multiple client architectures,
273 it must create subdirectories within the [print$] service
274 which correspond to each of the supported client architectures.
275 Samba follows this model as well.
</P
277 >Next create the directory tree below the [print$] share
278 for each architecture you wish to support.
</P
281 CLASS=
"PROGRAMLISTING"
283 |-W32X86 ;
"Windows NT x86"
284 |-WIN40 ;
"Windows 95/98"
285 |-W32ALPHA ;
"Windows NT Alpha_AXP"
286 |-W32MIPS ;
"Windows NT R4000"
287 |-W32PPC ;
"Windows NT PowerPC"</PRE
301 >ATTENTION! REQUIRED PERMISSIONS
</B
308 >In order to currently add a new driver to you Samba host,
309 one of two conditions must hold true:
</P
315 >The account used to connect to the Samba host
316 must have a uid of
0 (i.e. a root account)
</P
320 >The account used to connect to the Samba host
321 must be a member of the
<A
322 HREF=
"smb.conf.5.html#PRINTERADMIN"
335 >Of course, the connected account must still possess access
336 to add files to the subdirectories beneath [print$]. Remember
337 that all file shares are set to 'read only' by default.
</P
343 >Once you have created the required [print$] service and
344 associated subdirectories, simply log onto the Samba server using
351 from a Windows NT
4.0 client. Navigate to the
"Printers" folder
352 on the Samba server. You should see an initial listing of printers
353 that matches the printer shares defined on your Samba host.
</P
361 >Setting Drivers for Existing Printers
</A
364 >The initial listing of printers in the Samba host's
365 Printers folder will have no real printer driver assigned
366 to them. By default, in Samba
2.2.0 this driver name was set to
369 >NO PRINTER DRIVER AVAILABLE FOR THIS PRINTER
</I
371 Later versions changed this to a NULL string to allow the use
372 tof the local Add Printer Wizard on NT/
2000 clients.
373 Attempting to view the printer properties for a printer
374 which has this default driver assigned will result in
375 the error message:
</P
379 >Device settings cannot be displayed. The driver
380 for the specified printer is not installed, only spooler
381 properties will be displayed. Do you want to install the
385 >Click
"No" in the error dialog and you will be presented with
386 the printer properties window. The way assign a driver to a
387 printer is to either
</P
393 >Use the
"New Driver..." button to install
394 a new printer driver, or
</P
398 >Select a driver from the popup list of
399 installed drivers. Initially this list will be empty.
</P
403 >If you wish to install printer drivers for client
404 operating systems other than
"Windows NT x86", you will need
405 to use the
"Sharing" tab of the printer properties dialog.
</P
407 >Assuming you have connected with a root account, you
408 will also be able modify other printer properties such as
409 ACLs and device settings using this dialog box.
</P
411 >A few closing comments for this section, it is possible
412 on a Windows NT print server to have printers
413 listed in the Printers folder which are not shared. Samba does
414 not make this distinction. By definition, the only printers of
415 which Samba is aware are those which are specified as shares in
421 >Another interesting side note is that Windows NT clients do
422 not use the SMB printer share, but rather can print directly
423 to any printer on another Windows NT host using MS-RPC. This
424 of course assumes that the printing client has the necessary
425 privileges on the remote host serving the printer. The default
426 permissions assigned by Windows NT to a printer gives the
"Print"
427 permissions to the
"Everyone" well-known group.
</P
435 >Support a large number of printers
</A
438 >One issue that has arisen during the development
439 phase of Samba
2.2 is the need to support driver downloads for
440 100's of printers. Using the Windows NT APW is somewhat
441 awkward to say the list. If more than one printer are using the
443 HREF=
"rpcclient.1.html"
450 > can be used to set the driver
451 associated with an installed driver. The following is example
452 of how this could be accomplished:
</P
455 CLASS=
"PROGRAMLISTING"
460 >rpcclient pogo -U root%secret -c
"enumdrivers"
461 Domain=[NARNIA] OS=[Unix] Server=[Samba
2.2.0-alpha3]
464 Printer Driver Info
1:
465 Driver Name: [HP LaserJet
4000 Series PS]
467 Printer Driver Info
1:
468 Driver Name: [HP LaserJet
2100 Series PS]
470 Printer Driver Info
1:
471 Driver Name: [HP LaserJet
4Si/
4SiMX PS]
476 >rpcclient pogo -U root%secret -c
"enumprinters"
477 Domain=[NARNIA] OS=[Unix] Server=[Samba
2.2.0-alpha3]
479 name:[\\POGO\hp-print]
480 description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
486 >rpcclient pogo -U root%secret \
490 > -c
"setdriver hp-print \"HP LaserJet
4000 Series PS\
""
491 Domain=[NARNIA] OS=[Unix] Server=[Samba
2.2.0-alpha3]
492 Successfully set hp-print to driver HP LaserJet
4000 Series PS.
</PRE
501 >Adding New Printers via the Windows NT APW
</A
504 >By default, Samba offers all printer shares defined in
<TT
508 in the
"Printers..." folder. Also existing in this folder is the Windows NT
509 Add Printer Wizard icon. The APW will be show only if
</P
515 >The connected user is able to successfully
516 execute an OpenPrinterEx(\\server) with administrative
517 priviledges (i.e. root or
<TT
528 HREF=
"smb.conf.5.html#SHOWADDPRINTERWIZARD"
534 add printer wizard = yes
</I
542 >In order to be able to use the APW to successfully add a printer to a Samba
544 HREF=
"smb.conf.5.html#ADDPRINTERCOMMAND"
553 > must have a defined value. The program
554 hook must successfully add the printer to the system (i.e.
558 > or appropriate files) and
564 >When using the APW from a client, if the named printer share does
568 > will execute the
<TT
574 > and reparse to the
<TT
578 to attempt to locate the new printer share. If the share is still not defined,
579 an error of
"Access Denied" is returned to the client. Note that the
583 >add printer program
</I
585 > is executed under the context
586 of the connected user, not necessarily a root account.
</P
588 >There is a complementing
<A
589 HREF=
"smb.conf.5.html#DELETEPRINTERCOMMAND"
598 > for removing entries from the
"Printers..."
607 >Samba and Printer Ports
</A
610 >Windows NT/
2000 print servers associate a port with each printer. These normally
611 take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the
612 concept of ports associated with a printer. By default, only one printer port,
613 named
"Samba Printer Port", exists on a system. Samba does not really a port in
614 order to print, rather it is a requirement of Windows clients.
</P
616 >Note that Samba does not support the concept of
"Printer Pooling" internally
617 either. This is when a logical printer is assigned to multiple ports as
618 a form of load balancing or fail over.
</P
620 >If you require that multiple ports be defined for some reason,
625 HREF=
"smb.conf.5.html#ENUMPORTSCOMMAND"
634 > which can be used to define an external program
635 that generates a listing of ports on a system.
</P
644 >The Imprints Toolset
</A
647 >The Imprints tool set provides a UNIX equivalent of the
648 Windows NT Add Printer Wizard. For complete information, please
649 refer to the Imprints web site at
<A
650 HREF=
"http://imprints.sourceforge.net/"
652 > http://imprints.sourceforge.net/
</A
653 > as well as the documentation
654 included with the imprints source distribution. This section will
655 only provide a brief introduction to the features of Imprints.
</P
662 >What is Imprints?
</A
665 >Imprints is a collection of tools for supporting the goals
672 >Providing a central repository information
673 regarding Windows NT and
95/
98 printer driver packages
</P
677 >Providing the tools necessary for creating
678 the Imprints printer driver packages.
</P
682 >Providing an installation client which
683 will obtain and install printer drivers on remote Samba
684 and Windows NT
4 print servers.
</P
694 >Creating Printer Driver Packages
</A
697 >The process of creating printer driver packages is beyond
698 the scope of this document (refer to Imprints.txt also included
699 with the Samba distribution for more information). In short,
700 an Imprints driver package is a gzipped tarball containing the
701 driver files, related INF files, and a control file needed by the
702 installation client.
</P
710 >The Imprints server
</A
713 >The Imprints server is really a database server that
714 may be queried via standard HTTP mechanisms. Each printer
715 entry in the database has an associated URL for the actual
716 downloading of the package. Each package is digitally signed
717 via GnuPG which can be used to verify that package downloaded
718 is actually the one referred in the Imprints database. It is
722 > recommended that this security check
731 >The Installation Client
</A
734 >More information regarding the Imprints installation client
735 is available in the
<TT
737 >Imprints-Client-HOWTO.ps
</TT
739 file included with the imprints source package.
</P
741 >The Imprints installation client comes in two forms.
</P
747 >a set of command line Perl scripts
</P
751 >a GTK+ based graphical interface to
752 the command line perl scripts
</P
756 >The installation client (in both forms) provides a means
757 of querying the Imprints database server for a matching
758 list of known printer model names as well as a means to
759 download and install the drivers on remote Samba and Windows
762 >The basic installation process is in four steps and
763 perl code is wrapped around
<B
773 CLASS=
"PROGRAMLISTING"
775 foreach (supported architecture for a given driver)
777 1. rpcclient: Get the appropriate upload directory
779 2. smbclient: Upload the driver files
780 3. rpcclient: Issues an AddPrinterDriver() MS-RPC
783 4. rpcclient: Issue an AddPrinterEx() MS-RPC to actually
784 create the printer
</PRE
787 >One of the problems encountered when implementing
788 the Imprints tool set was the name space issues between
789 various supported client architectures. For example, Windows
790 NT includes a driver named
"Apple LaserWriter II NTX v51.8"
791 and Windows
95 callsits version of this driver
"Apple
792 LaserWriter II NTX"</P
794 >The problem is how to know what client drivers have
795 been uploaded for a printer. As astute reader will remember
796 that the Windows NT Printer Properties dialog only includes
797 space for one printer driver name. A quick look in the
798 Windows NT
4.0 system registry at
</P
802 >HKLM\System\CurrentControlSet\Control\Print\Environment
806 >will reveal that Windows NT always uses the NT driver
807 name. This is ok as Windows NT always requires that at least
808 the Windows NT version of the printer driver is present.
809 However, Samba does not have the requirement internally.
810 Therefore, how can you use the NT driver name if is has not
811 already been installed?
</P
813 >The way of sidestepping this limitation is to require
814 that all Imprints printer driver packages include both the Intel
815 Windows NT and
95/
98 printer drivers and that NT driver is
828 >Migration to from Samba
2.0.x to
2.2.x
</A
831 >Given that printer driver management has changed (we hope improved) in
832 2.2 over prior releases, migration from an existing setup to
2.2 can
833 follow several paths.
</P
835 >Windows clients have a tendency to remember things for quite a while.
836 For example, if a Windows NT client has attached to a Samba
2.0 server,
837 it will remember the server as a LanMan printer server. Upgrading
838 the Samba host to
2.2 makes support for MSRPC printing possible, but
839 the NT client will still remember the previous setting.
</P
841 >In order to give an NT client printing
"amesia" (only necessary if you
842 want to use the newer MSRPC printing functionality in Samba), delete
843 the registry keys associated with the print server contained in
846 >[HKLM\SYSTEM\CurrentControlSet\Control\Print]
</TT
848 spooler service on the client should be stopped prior to doing this:
</P
862 >All the normal disclaimers about editing the registry go
864 > Be careful, and know what you are doing.
</P
866 >The spooler service should be restarted after you have finished
867 removing the appropriate registry entries by replacing the
871 > command above with
<B
876 >Windows
9x clients will continue to use LanMan printing calls
877 with a
2.2 Samba server so there is no need to perform any of these
878 modifications on non-NT clients.
</P
898 >The following smb.conf parameters are considered to be depreciated and will
899 be removed soon. Do not use them in new installations
</P
908 >printer driver file (G)
</I
918 >printer driver (S)
</I
928 >printer driver location (S)
</I
939 >Here are the possible scenarios for supporting migration:
</P
945 >If you do not desire the new Windows NT
946 print driver support, nothing needs to be done.
947 All existing parameters work the same.
</P
951 >If you want to take advantage of NT printer
952 driver support but do not want to migrate the
953 9x drivers to the new setup, the leave the existing
954 printers.def file. When smbd attempts to locate a
955 9x driver for the printer in the TDB and fails it
956 will drop down to using the printers.def (and all
957 associated parameters). The
<B
961 tool will also remain for backwards compatibility but will
962 be moved to the
"this tool is the old way of doing it"
967 >If you install a Windows
9x driver for a printer
968 on your Samba host (in the printing TDB), this information will
969 take precedence and the three old printing parameters
970 will be ignored (including print driver location).
</P
974 >If you want to migrate an existing
<TT
978 file into the new setup, the current only solution is to use the Windows
979 NT APW to install the NT drivers and the
9x drivers. This can be scripted
987 Imprints installation client at
<A
988 HREF=
"http://imprints.sourceforge.net/"
990 >http://imprints.sourceforge.net/
</A