Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Unable to make modifications via CUPS

Hello everyone,

I attempted to make any kind of change in CUPS (server settings, adding a printer, etc.) and when it prompts me for my username and password it refuses to accept it. I confirmed that there were no permissions issues and that the username and password worked elsewhere on my system as administrator, but I cannot get it to work in CUPS. I also changed my username to the shortened UNIX-friendly version and it still does not work.

I was accessing CUPS via Safari. Any help on how to get the password recognized would be appreciated. Please let me know if any additional info is needed.

MBP (Late 2007 model), Mac OS X (10.5.2)

Posted on Jan 24, 2011 3:07 PM

Reply
12 replies

Jan 24, 2011 7:19 PM in response to istojic

Here is the info from CUPS' error_log, beginning with me restarting CUPS using Print Therapy and ending with several login attempts, with both root and with usernames from the passwd.md5 hash. Going back in time (several years) through the log file, I notice that today is the first time the error about the local authentication certificate not being found pops up.

Again, any help is greatly appreciated.

I [24/Jan/2011:20:43:40 -0600] Scheduler shutting down normally.
E [24/Jan/2011:20:43:40 -0600] cupsdDeleteAllCerts: Unable to remove /private/var/run/cups/certs/0!
I [24/Jan/2011:20:43:40 -0600] Saving job cache file "/private/var/spool/cups/cache/job.cache"...
I [24/Jan/2011:20:43:42 -0600] Listening to :::631 (IPv6)
I [24/Jan/2011:20:43:42 -0600] Listening to 0.0.0.0:631 (IPv4)
I [24/Jan/2011:20:43:42 -0600] Listening to /private/var/run/cupsd (Domain)
I [24/Jan/2011:20:43:42 -0600] Remote access is enabled.
I [24/Jan/2011:20:43:42 -0600] Loaded configuration file "/private/etc/cups/cupsd.conf"
I [24/Jan/2011:20:43:42 -0600] Using default TempDir of /private/var/spool/cups/tmp...
I [24/Jan/2011:20:43:42 -0600] Configured for up to 100 clients.
I [24/Jan/2011:20:43:42 -0600] Allowing up to 100 client connections per host.
I [24/Jan/2011:20:43:42 -0600] Using policy "default" as the default!
I [24/Jan/2011:20:43:42 -0600] Full reload is required.
I [24/Jan/2011:20:43:42 -0600] Loaded MIME database from '/private/etc/cups': 52 types, 49 filters...
I [24/Jan/2011:20:43:42 -0600] Loading job cache file "/private/var/spool/cups/cache/job.cache"...
I [24/Jan/2011:20:43:42 -0600] Full reload complete.
I [24/Jan/2011:20:43:42 -0600] Cleaning out old temporary files in "/private/var/spool/cups/tmp"...
I [24/Jan/2011:20:43:42 -0600] Listening to :::631 on fd 11...
I [24/Jan/2011:20:43:42 -0600] Listening to 0.0.0.0:631 on fd 12...
I [24/Jan/2011:20:43:42 -0600] Listening to /private/var/run/cupsd on fd 10...
I [24/Jan/2011:20:43:42 -0600] Listening to ::1:631 on fd 4...
I [24/Jan/2011:20:43:42 -0600] Listening to 127.0.0.1:631 on fd 9...
I [24/Jan/2011:20:43:42 -0600] Resuming new connection processing...
I [24/Jan/2011:20:43:42 -0600] Listening to :::631 (IPv6)
I [24/Jan/2011:20:43:42 -0600] Listening to 0.0.0.0:631 (IPv4)
I [24/Jan/2011:20:43:42 -0600] Listening to /private/var/run/cupsd (Domain)
I [24/Jan/2011:20:43:42 -0600] Remote access is enabled.
I [24/Jan/2011:20:43:42 -0600] Loaded configuration file "/private/etc/cups/cupsd.conf"
E [24/Jan/2011:20:43:42 -0600] TMPDIR (/var/folders/J2/J2xdV7irHLux3EugO3wpSE +TI/-Tmp-/) has the wrong permissions!
I [24/Jan/2011:20:43:42 -0600] Using default TempDir of /private/var/spool/cups/tmp...
I [24/Jan/2011:20:43:42 -0600] Configured for up to 100 clients.
I [24/Jan/2011:20:43:42 -0600] Allowing up to 100 client connections per host.
I [24/Jan/2011:20:43:42 -0600] Using policy "default" as the default!
I [24/Jan/2011:20:43:42 -0600] Full reload is required.
I [24/Jan/2011:20:43:42 -0600] Loaded MIME database from '/private/etc/cups': 52 types, 49 filters...
I [24/Jan/2011:20:43:42 -0600] Loading job cache file "/private/var/spool/cups/cache/job.cache"...
I [24/Jan/2011:20:43:42 -0600] Full reload complete.
I [24/Jan/2011:20:43:42 -0600] Cleaning out old temporary files in "/private/var/spool/cups/tmp"...
E [24/Jan/2011:20:43:42 -0600] Unable to bind socket for address :::631 - Address already in use.
E [24/Jan/2011:20:43:42 -0600] Unable to bind socket for address 0.0.0.0:631 - Address already in use.
I [24/Jan/2011:20:43:42 -0600] Listening to /private/var/run/cupsd on fd 4...
I [24/Jan/2011:20:43:42 -0600] Resuming new connection processing...
E [24/Jan/2011:20:43:42 -0600] Unable to bind broadcast socket - Address already in use.
I [24/Jan/2011:20:44:40 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37494)
I [24/Jan/2011:20:45:00 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37495)
I [24/Jan/2011:20:45:00 -0600] Started "/usr/libexec/cups/daemon/cups-deviced" (pid=37496)
I [24/Jan/2011:20:46:33 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37519)
I [24/Jan/2011:20:46:43 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37520)
I [24/Jan/2011:20:46:43 -0600] Started "/usr/libexec/cups/daemon/cups-driverd" (pid=37521)
I [24/Jan/2011:20:46:54 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37523)
I [24/Jan/2011:20:46:54 -0600] Started "/usr/libexec/cups/daemon/cups-driverd" (pid=37524)
I [24/Jan/2011:20:47:04 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37526)
E [24/Jan/2011:20:47:04 -0600] CUPS-Add-Modify-Printer: Unauthorized
I [24/Jan/2011:20:47:18 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37527)
E [24/Jan/2011:20:47:18 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:47:18 -0600] cupsdAuthorize: Local authentication certificate not found!
E [24/Jan/2011:20:47:18 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:47:18 -0600] cupsdAuthorize: Local authentication certificate not found!
E [24/Jan/2011:20:47:18 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:47:18 -0600] cupsdAuthorize: Local authentication certificate not found!
E [24/Jan/2011:20:47:18 -0600] CUPS-Add-Modify-Printer: Unauthorized
I [24/Jan/2011:20:47:54 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37537)
E [24/Jan/2011:20:47:54 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:47:54 -0600] cupsdAuthorize: Local authentication certificate not found!
E [24/Jan/2011:20:47:54 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:47:54 -0600] cupsdAuthorize: Local authentication certificate not found!
E [24/Jan/2011:20:47:54 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:47:54 -0600] cupsdAuthorize: Local authentication certificate not found!
E [24/Jan/2011:20:47:54 -0600] CUPS-Add-Modify-Printer: Unauthorized
E [24/Jan/2011:20:48:10 -0600] cupsdAuthorize: Unknown MD5 username "root"!
I [24/Jan/2011:20:48:10 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37538)
E [24/Jan/2011:20:48:10 -0600] CUPS-Add-Modify-Printer: Unauthorized
I [24/Jan/2011:21:03:10 -0600] Started "/usr/libexec/cups/cgi-bin/admin.cgi" (pid=37650)

Jan 24, 2011 7:48 PM in response to istojic

You didn't answer if you're accessing CUPS management via http://127.0.0.1:631/? If so, while I was beta-testing Tiger, I continually ran into that problem with new updates. So I put this together so I wouldn't have to remember the steps:

From the CUPS Software Administrators Manual http://127.0.0.1:631/sam.html#13_2

CUPS Doesn't Recognize My Username or Password when I enter this URL into my browser: http://127.0.0.1:631/

CUPS will ask you for a UNIX username and password when you perform printer administration tasks remotely or via a web browser. The default configuration requires that you use the root username and the corresponding password to authenticate the request.

CUPS does not allow you to authenticate an administration request with an account that has no password for security reasons. If you do not have a password on your root account then you won't be able to add printers remotely or via the web interface!

To disable password authentication you need to edit the /etc/cups/cupsd.conf file

**************
*NOTE: Disabling password checks allows any local user to change your printer and class configuration, but remote administration from another machine isn't allowed.*

Personally, on a home machine, I disable it, since enabling the root user could prove hazardous to your system's health—I never have enabled the root user account and strongly caution anyone else against do it. Here are the steps used to disable the CUPS password checks.

*****************
Launch the Terminal.app and open the cupsd.conf file by copying & pasting this command into the window that pops up, and hit the return key:

*sudo nano /etc/cups/cupsd.conf*

enter your admin password at the Password: prompt, carefully, since the characters aren't displayed, and hit the return key

click: CONTROL+W and type in:

<Limit GET PUT>

hit return key

this takes you to the section headed by +<Limit GET PUT>+

Type a # in front of these two lines under the GET PUT heading (use the arrow keys to move about the file):

AuthType Basic
AuthClass System

so that they read:

#AuthType Basic
#AuthClass System

click: CONTROL+O -hit return key

click: CONTROL+X -that takes you out of nano and back to the Terminal

To ensure that you made the proper changes, type in the following, and hit return key

*sudo cat /etc/cups/cupsd.conf*

and you should see this grouping near the page's bottom:

<Limit GET PUT>
#AuthType Basic
#AuthClass System
</Limit>

If so, then you successfully modified the cupsd.conf file. Now, you have restart the CUPS server, either by shutting down or by typing in this command, and hit return key:

*sudo killall -HUP cupsd*

Quit the Terminal app.

Launch Safari, type in this URL, and hit the return key:

* http://127.0.0.1:631/*

This gives you access to everything dealing with CUPS and printers, including links to extensive documentation, without bringing up the password dialog box.

Jan 25, 2011 6:54 AM in response to baltwo

My apologies baltwo, I'll be more specific this time. Accessing via http://127.0.01:631/ brings up a different home page, and after entering the printer info in Add Printer it just takes me back to the home page. Accessing via http://localhost:631 is the method I was using because it continues on asking for additional info until the user prompt.

My cupsd.conf is different that what you suggested (no Limit GET PUT section), but I commented out all of the authentication lines. It still prompted for the user name and password, but this time it accepted it and I was able to add the printer. Thanks for the awesome help!

I wonder why it still brings up the password dialog box. Perhaps the DefaultAuthType should be set to something else, but I didn't see an option like None in the documentation. The actual text of my new cupsd.conf is below:
***************

ogLevel info
SystemGroup admin
SystemGroupAuthKey system.print.admin
# Allow remote access
Port 631
Listen /private/var/run/cupsd
# Enable printer sharing and shared printers.
Browsing On
BrowseOrder allow,deny
BrowseAllow all
BrowseAddress @LOCAL
#DefaultAuthType BasicDigest
<Location />
Allow localhost
# Allow shared printing...
Order allow,deny
Allow @LOCAL
</Location>
<Location /admin>

Allow localhost
# Restrict access to the admin pages...
Order allow,deny
</Location>
<Location /admin/conf>
# AuthType BasicDigest
Require user @SYSTEM
Allow localhost
# Restrict access to the configuration files...
Order allow,deny
</Location>
<Policy default>
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set$
Require user @OWNER @SYSTEM
Order deny,allow
</Limit>
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS$
# AuthType BasicDigest
Require user @SYSTEM
Order deny,allow
</Limit>
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Prin$
# AuthType BasicDigest
Require user @AUTHKEY(system.print.admin) @admin @lpadmin
Order deny,allow
</Limit>
<Limit Cancel-Job CUPS-Authenticate-Job>
Require user @OWNER @AUTHKEY(system.print.admin) @admin @lpadmin
Order deny,allow
</Limit>
<Limit All>
Order deny,allow
</Limit>
</Policy>
**************

Jan 25, 2011 12:09 PM in response to baltwo

baltwo wrote:
I don't know. The steps I posted were what I dredged up from my Tiger days; however, I'm not running that any longer and both Leopard and Snow Leopard don't ask for the username/password combo. Hopefully, you can get on with managing the printers w/o further issue. Good luck.


I am running Leopard (10.5.8) as well, but am prompted for username/password. I did a printing system reset in the past, so perhaps that caused it. Thanks again for the assistance!

Jan 25, 2011 7:59 PM in response to greg sahli

greg sahli wrote:
localhost:631 and 127.0.0.1:631 are the exact same thing - if you still see/get differences, then there is something wrong with your OS X installation. Glad you were able to add a printer, but I believe you will continue to have problems...


That was likely something I did myself trying to get my Apache/PHP config the way I needed it. My hosts file has the two defined as the same thing, so not sure why 127 would be botched, but it's probably a topic for another thread anyway. Although can either of you verify that 10.5.8 Leopard's CUPS doesn't ask for a password by default, please?

Alas, I'm already onto my 2nd printer problem but this one is a bit difficult to categorize. Thanks again for everything!

Unable to make modifications via CUPS

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.