Hardy Heron: Adding SMB printer fails

[socceroos]

Binary package hint: samba

When adding an SMB printer in Hardy Heron, with authentication required, it fails at the very last step saying:

There was an error during the CUPS operation: 'client-error-not-possible'.

I am absolutely positive that my login credentials are correct, when clicking the 'verify' button it returns 'success'.

I have Hardy Heron with all the latest updates as at 16th April 2008 2:52pm AEST.

The CUPS error log says this:

E [16/Apr/2008:14:33:51 +1000] CUPS-Add-Modify-Printer: Unauthorized
E [16/Apr/2008:14:36:19 +1000] cupsdAuthorize: Local authentication certificate not found!
E [16/Apr/2008:14:36:19 +1000] Resume-Printer: Unauthorized
E [16/Apr/2008:14:36:22 +1000] [Job 12] No ticket cache found for userid=0
E [16/Apr/2008:14:36:22 +1000] [Job 12] Can not get the ticket cache for root
E [16/Apr/2008:14:36:22 +1000] [Job 12] Session setup failed: NT_STATUS_LOGON_FAILURE
E [16/Apr/2008:14:36:22 +1000] [Job 12] Tree connect failed (NT_STATUS_ACCESS_DENIED)
E [16/Apr/2008:14:36:22 +1000] [Job 12] Unable to connect to CIFS host, will retry in 60 seconds...
E [16/Apr/2008:14:36:34 +1000] PID 26905 (/usr/lib/cups/filter/foomatic-rip) crashed on signal 9!
E [16/Apr/2008:14:36:34 +1000] PID 26906 (/usr/lib/cups/backend/smb) crashed on signal 9!
E [16/Apr/2008:14:36:34 +1000] [Job 12] No ticket cache found for userid=0
E [16/Apr/2008:14:36:34 +1000] [Job 12] Can not get the ticket cache for root
E [16/Apr/2008:14:36:34 +1000] [Job 12] Session setup failed: NT_STATUS_LOGON_FAILURE
E [16/Apr/2008:14:36:34 +1000] [Job 12] Tree connect failed (NT_STATUS_ACCESS_DENIED)
E [16/Apr/2008:14:36:34 +1000] [Job 12] Unable to connect to CIFS host, will retry in 60 seconds...
E [16/Apr/2008:14:36:41 +1000] [Job 13] No ticket cache found for userid=0
E [16/Apr/2008:14:36:41 +1000] [Job 13] Can not get the ticket cache for root
E [16/Apr/2008:14:36:41 +1000] [Job 13] Session setup failed: NT_STATUS_LOGON_FAILURE
E [16/Apr/2008:14:36:41 +1000] [Job 13] Tree connect failed (NT_STATUS_ACCESS_DENIED)
E [16/Apr/2008:14:36:41 +1000] [Job 13] Unable to connect to CIFS host, will retry in 60 seconds...
E [16/Apr/2008:14:38:53 +1000] [Job 14] No ticket cache found for userid=0
E [16/Apr/2008:14:38:53 +1000] [Job 14] Can not get the ticket cache for root
E [16/Apr/2008:14:38:53 +1000] [Job 14] Session setup failed: NT_STATUS_LOGON_FAILURE
E [16/Apr/2008:14:38:53 +1000] [Job 14] Tree connect failed (NT_STATUS_ACCESS_DENIED)
E [16/Apr/2008:14:38:53 +1000] [Job 14] Unable to connect to CIFS host, will retry in 60 seconds...
E [16/Apr/2008:14:39:23 +1000] [Job 15] No ticket cache found for userid=0
E [16/Apr/2008:14:39:23 +1000] [Job 15] Can not get the ticket cache for root
E [16/Apr/2008:14:39:23 +1000] [Job 15] Session setup failed: NT_STATUS_LOGON_FAILURE
E [16/Apr/2008:14:39:23 +1000] [Job 15] Tree connect failed (NT_STATUS_ACCESS_DENIED)
E [16/Apr/2008:14:39:23 +1000] [Job 15] Unable to connect to CIFS host, will retry in 60 seconds...

[Chuck Short (zulcss)]

Please have a look at this:

http://www.cups.org/articles.php?L291+TFAQ+P1+Q

Thanks
chuck

[socceroos (skduff)]

Thanks for the reply Chuck.

This article doesn't appear to address my problem. I say this because if I un-check the 'Requires Authentication' box when adding my SMB printer then it will add fine (but still won't print).

From what I can tell, this issue has cropped up before and, if I remember correctly, it had something to do with the smbspool program.

[socceroos (skduff)]

Also, from what the log files show above, the error appears to be related to an authentication issue:

E [16/Apr/2008:14:39:23 +1000] [Job 15] No ticket cache found for userid=0
E [16/Apr/2008:14:39:23 +1000] [Job 15] Can not get the ticket cache for root
E [16/Apr/2008:14:39:23 +1000] [Job 15] Session setup failed: NT_STATUS_LOGON_FAILURE
E [16/Apr/2008:14:39:23 +1000] [Job 15] Tree connect failed (NT_STATUS_ACCESS_DENIED)
E [16/Apr/2008:14:39:23 +1000] [Job 15] Unable to connect to CIFS host, will retry in 60 seconds...

[socceroos (skduff)]

I think I may have narrowed down the issue. I changed the cupsd.conf LogLevel to 'debug'.

When adding a printer via SMB with 'requires authentication' ticked and filled out I noticed that the logfile says:

CUPS-Add-Modify-Printer client-error-not-possible: Bad device-uri "smb://myusername:MyComplexpAss/1/2/3@/server/PRINTERSHARENAME"!

My Password has forward-slashes in it and so does the device URI. From what I can see, they're not being escaped properly which may be causing the 'Bad device-uri' error.

[socceroos (skduff)]

Can anyone else please confirm this? I've successfully added the printer IF my password does not contain any forward-slashes. So it would seem that it is indeed an escaping problem.

As such, should this be classified as a security issue too? If these characters aren't being escaped then you could potentially discover all sorts of injection attacks.

[Rob Escriva (me-robescriva)]

I can confirm this as can some others on my campus.

In my case it fails without any forward slashes in the password.

I don't believe it is an escaping problem as changing the URI for the printer to match what I see on Gutsy shows the same log message with the same URI.

I'm also getting "cupsdAuthorize: Local authentication certificate not found!" errors in my /var/log/cups/error_log.

For now I'm researching the issue. I've come across the following possibilities for the cause of the problem:
-AppArmor
-Firewall

Disabling apparmor and ufw does not appear to have any impact.

[Rob Escriva (me-robescriva)]

I've narrowed down the issue some more. It appears to be an issue with deciding which username to use for authenticating.

I did the following on Gutsy and Hardy:
-Installed wireshark
-Scanned for SMB protocol
-Looked at authentication tries
-Noted usernames.

Results:
-Gutsy authenticated once with the username I supplied within the dialog box.
-Hardy tries to authenticate several times under various usernames, none of which I have specified.
  -lp
  -<my local login>
  -anonymous

My /etc/cups/printers.conf is identical for each of the machines. I'm gonna look into this more after class today, as this issue is a sticking point for most of the people I know who run Ubuntu.

[Rob Escriva (me-robescriva)]

I believe I have fixed the issue. After playing around I realized that smbclient would complain that 'client plaintext auth' was disabled (my campus server needs plaintext for some reasom).

Adding the following to smb.conf and rebooting fixed my problem entirely:
client plaintext auth = yes
client lanman auth = yes

This may compromise security slightly (plaintext passwords are almost never a good idea). Please let me know if this fixes it for you. I'd be happy to keep investigating this if my fix does not work for you.

[Cristian Klein (cristiklein)]

I confirm this bug and the fact that the above fix solved it for me.

[Till Kamppeter (till-kamppeter)]

As a fix authentication with clear-text password transfer is suggested. This looks like a design flaw of the smb CUPS backend, which is a part of Samba. Therefore moving to Samba.

[Steve Langasek (vorlon)]

This is not a design flaw, it's a deliberate design decision; use of plaintext passwords on an untrusted network is insecure, and in Ubuntu 8.04 smbspool (and other samba clients) will no longer allow negotiation of plaintext connections unless the user takes explicit action to enable this.

To enable plaintext authentication, set 'client plaintext auth = yes' in the [global] section of /etc/samba/smb.conf.

[Cristian Klein (cristiklein)]

Couldn't there be a „plain-text authentication required” instead of „client-error-not-possible” message. That would definitely close the bug for me.