Bug 4337 - rpcclient setdriver WERR_ACCESS_DENIED without 'printer admin'
Summary: rpcclient setdriver WERR_ACCESS_DENIED without 'printer admin'
Status: RESOLVED FIXED
Alias: None
Product: Samba 3.0
Classification: Unclassified
Component: Printing (show other bugs)
Version: 3.0.23d
Hardware: x86 FreeBSD
: P3 major
Target Milestone: none
Assignee: Guenther Deschner
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-01-12 09:09 UTC by Fabian Wenk
Modified: 2012-01-09 11:00 UTC (History)
2 users (show)

See Also:


Attachments
Debug Level 10 Output demonstrating the bug occuring (54.57 KB, application/octet-stream)
2009-03-10 12:43 UTC, Mark Gannon
no flags Details
Debug Level 10 Output showing success after changing the printer admin parameter (48.17 KB, application/octet-stream)
2009-03-10 12:43 UTC, Mark Gannon
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Fabian Wenk 2007-01-12 09:09:58 UTC
After the upgrade from Samba 3.0.22 to 3.0.23d rpcclient setdriver (as the only part from our modified cupsaddsmb, which allows to submit the password) did not work anymore. Also all admin options in the printer properties dialog from a Windows client are greyed out. The user/group which needs access to admin the printers have the SePrintOperatorPrivilege permissions granted.

The only error message was from the rpcclient command:

# rpcclient printer -N -U'cupssmb%abcdefgh' -c 'setdriver hpr_e86 hpr_e86'
result was WERR_ACCESS_DENIED
#

After adding "printer admin" options to the [printers] section it was working again (even from the Windows Client):

# rpcclient printer -N -U'cupssmb%abcdefgh' -c 'setdriver hpr_e86 hpr_e86'
Succesfully set hpr_e86 to driver hpr_e86.
# 

With this workaround the message "WARNING: The "printer admin" option is deprecated" is logged.


Some details about our setup:
- running the PDC on a other server also with Samba 3.0.23d
[global]
   enable privileges = yes
   smb passwd file = /var/lib/samba/winpdc/smbpasswd
   security = user

- relevant configuration on the print server
[global]
   load printers = yes
   show add printer wizard = yes
   printcap name = cups
   printing = cups
   security = domain
   password server = WINPDC
[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   public = yes   
   guest ok = yes 
   writable = no  
   printable = yes
   printer admin = +ntdomprt

- on both (PDC and printer) servers the same unix users and groups are available through NIS
Comment 1 Timur Bakeyev 2007-06-03 06:15:17 UTC
(In reply to comment #0)
> After the upgrade from Samba 3.0.22 to 3.0.23d rpcclient setdriver (as the only
> part from our modified cupsaddsmb, which allows to submit the password) did not
> work anymore. Also all admin options in the printer properties dialog from a
> Windows client are greyed out. The user/group which needs access to admin the
> printers have the SePrintOperatorPrivilege permissions granted.

As a wild guess - coold it be the result of the problems with primary group in recent Sambas? Try new 3.0.25a version, which aims to address this problem.

With regards,
Timur
Comment 2 Fabian Wenk 2007-08-30 09:28:39 UTC
Sorry for the long delay.

Yes, it could be about the primary group problems.

But as I do not have this kind of setup available at the moment, I can not test it myself. I had forwarded this report to my former co-workers, but as far as I know they did not yet update to any of the 3.0.25x versions of Samba.
Comment 3 Mark Gannon 2009-03-10 12:41:49 UTC
I currently am experiencing this bug using Lenny from a Debian Live CD.  I've created debug level 10 reports both with the failure and the subsequent success (after setting the printer admin parameter in smb.conf).  In the attached debugs, I the samba system is polyspool (192.168.2.145) and the client system using rpcclient is scooby (192.168.2.2).
Comment 4 Mark Gannon 2009-03-10 12:43:07 UTC
Created attachment 3988 [details]
Debug Level 10 Output demonstrating the bug occuring
Comment 5 Mark Gannon 2009-03-10 12:43:56 UTC
Created attachment 3989 [details]
Debug Level 10 Output showing success after changing the printer admin parameter
Comment 6 Andreas Schneider 2012-01-09 11:00:34 UTC
This is probably fixed with a newer Samba version. If you still see the error. Please open a new bug with 'debug level = 10' logfiles of the new Samba version 3.5 or 3.6. Thanks!