LP-GW(8)

NAME
lp-gw - line printer protocol proxy

SYNOPSIS
lp-gw [-daemon <port>] [-fastdaemon <port>] [-as <tag>]

DESCRIPTION
The Firewall Toolkit lp proxy is an application level proxy that provides configurable access control, authentication and logging mechanisms. The lp proxy, which runs on the firewall, passes print jobs and control requests through the firewall (at the application level), using rules you supply. You can configure the proxies to allow connections based on:

•   source IP address

•   source host name

•   print queue name

•   source port (protocol conformance)

•   lpd command (say, print or remove)

•   user name

All packets, and therefore all application requests go to the firewall. On the firewall, the lp proxy software relays information from one side of the firewall to the other. The proxy prevents the applications on outside networks from talking directly with the applications on your inside network, and vice versa. No IP packets pass from one side of the firewall to the other. All data are passed at the application level.

To use the proxy in non-transparent mode, you should configure client - server queue mapping and use firewall's IP address or hostname as print server definition with client queue name.

The line printer proxy (lp-gw) generally runs as a daemon (invoked from system startup script, p.e. /etc/rc.local) and listens for requests on the specified port (tcp/515, as indicated in /etc/services ,is reasonable default). Whenever the system receives an lpd request on this port, the lp proxy checks its configuration information (in the netperm-table) and determines whether the initiating host has permission to use spooler. If the host does not have permission, the proxy logs the connection attempt and displays an error message.

The proxy may also be invoked from tcp/ip "superserver" (inetd or xinetd). -daemon parameter should be omitted in this case.

If the host has permission, the proxy authenticates the user (if required), logs the transaction and passes the request to the destination host.

OPTIONS

  Command Line Options
The line printer proxy recognizes the following command line options (whether started from the command line or from within /etc/rc.local):

-daemon port
    Indicates that the line printer proxy runs as a daemon, and the port (name or number) on which the line printer proxy listens. When -daemon option is used, configuration is being read from netperm-table for every new connection accepted by proxy.

    port Specifies either a numeric id or symbolic name from the /etc/services file.

-fastdaemon port
    Indicates that the line printer proxy runs as a daemon, and the port (name or number) on which the line printer proxy listens. When -fastdaemon option is used, configuration is being read from netperm-table once the daemon starts or if SIGHUP is received.

-as tag
    Changes default application tag for netperm-table from "lp-gw" to any given string.

  Configuration Options
The line printer proxy reads configuration rules from the /usr/local/etc/netperm-table. It reads all rules using the lp-gw and * (wildcard) keywords. The line printer proxy reads the netperm-table from top to bottom. If there are multiple rules in the table that could apply for a particular attribute, the line printer proxy uses the first one that it finds. See netperm-table(5) for a more complete explanation of netperm-table syntax and precedence.

The line printer proxy recognizes the following attributes:

hosts
    host-pattern [host-pattern...] [options]

rules specify host and access permissions. Typically, a hosts rule will be in the form of:

lp-gw: deny-hosts unknown

lp-gw: hosts 192.33.112.* 192.94.214.* -queue laserjet4

There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters permit the selective enabling or disabling of logging information, etc. Sub-options are:

    -transparent specifies that the proxy runs in transparent mode; see OS-specific details on how to setup transparent redirection. Proxy destination host is not extracted from username part but taken from connection properties instead. This makes proxy "transparent", so no special client setup is required.

    -plug-to server-address specifies that proxy is "hardwired" to a given server.

    -log operation
    -log { operation [operation..] }
    specifies that a log entry to the system log should be made whenever the listed operations are performed through the proxy. Known operations are

    •   null

    •   restart

    •   print

    •   qstate_s

    •   qstate_l

    •   remove

    •   * (any of the above)

    -queue queue
    -queue { queue [queue..] }
    specifies a list of allowed client queues. If no list is specified, all destinations are considered valid. The -queue list is processed in order as it appears on the options line. -queue entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

    -queue { !declaser * }

    will permit access to any queue except "declaser".

    -deny operation
    -deny { operation [operation..] }
    specifies that a specific operation(s) is denied. The list is similar to `-log' command.

    -user username
    -user { username [username..] } specifies a list of users allowed to communicate to remote print server. By default, all users are permitted.

    -authuser username specifies user name for extended authorization

    -extnd specifies that the proxy should request per-operation permissions from authsrv.

    -lprng enforces strict lpd rfc1179 conformance for originating port number (usually for lprNG clients).

    -anyport disables originator port checks completely (useful for NATed clients and Windows spoolers)

    -force-user force client user identification to one specified by -authuser

    -client-dscp dscp-tag-name
    -client-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for client to proxy connection.

    -server-dscp dscp-tag-name
    -server-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for proxy to server connection.

printer queue [ -printer server-queue ] [ -host server ]

Defines cleint to server queue mapping.

    queue
        Specifies visible queue name on firewall. If `*', map any allowed queues to given server

    server-queue
        Specifies server queue name to map.

    server
        specifies lpd server name or address.

directory directory
    Specifies the directory that the line printer proxy makes its root directory before providing service.

groupid group
    Specifies the name of the group the line printer proxy uses when running.

    group
        Specifies either a name or numeric id from the /etc/group file.

timeout seconds
    Specifies the number of seconds the line printer proxy is idle (with no network activity) before disconnecting

userid user
    Specifies the user ID the proxy uses when running.

    user
        Specifies either a name or numeric id from the /etc/passwd file. This option is equivalent to the -user command in previous versions.

EXAMPLES
The following example defines simple lpd access policy.

    # permit workstations at LAN to access printer in DMZ
    lp-gw: permit-hosts 10.0.0.* -queue officelj
    lp-gw: printer officelj -printer laserjet -host pserv1

FILES

/etc/rc.local
    Command script that controls automatic reboot, and includes startup information for the printer proxy.

/usr/local/etc/netperm-table
    The network permissions file contains configuration information for the Firewall Toolkit, including the line printer proxy.

BUGS
Printer queue operation names are different from Gauntlet.

Only LPD protocol is supported, no CUPS or "raw" printing.

Report bugs to arkenoi@gmail.com or fwtk-users@buoy.com mailing list. Include a complete example, explaining what you expected to happen and what actually happened. Be sure to indicate the type of system (operating system, hardware, etc.) you are using, as well as the version of the line printer proxy.

AUTHOR
ArkanoiD.

SEE ALSO
netperm-table(5), rc(8), authsrv(8), netacl(8)