Changeset 1186

Show
Ignore:
Timestamp:
11/15/03 15:26:45 (21 years ago)
Author:
jalet
Message:

General improvements to the documentation.
Email address changed in sample configuration file, because
I receive low quota messages almost every day...

Location:
pykota/trunk
Files:
5 modified

Legend:

Unmodified
Added
Removed
  • pykota/trunk/bin/cupspykota

    r1185 r1186  
    2424# 
    2525# $Log$ 
     26# Revision 1.8  2003/11/15 14:26:44  jalet 
     27# General improvements to the documentation. 
     28# Email address changed in sample configuration file, because 
     29# I receive low quota messages almost every day... 
     30# 
    2631# Revision 1.7  2003/11/14 22:05:12  jalet 
    2732# New CUPS backend fully functionnal. 
     
    158163    # It's there just in case this changes in the future. 
    159164    # But here we will IGNORE SIGTERM for now, and see 
    160     # if we shouldn't pass it to the original backend 
    161     # instead. 
     165    # in a future release if we shouldn't pass it to the  
     166    # original backend instead. 
    162167    signal.signal(signal.SIGPIPE, signal.SIG_IGN) 
    163168    signal.signal(signal.SIGTERM, signal.SIG_IGN) 
    164169     
    165170    # 
    166     # Get the last page counter and last username from the Quota Storage backend 
     171    # retrieve some informations on the current printer and user 
     172    # from the Quota Storage. 
    167173    printer = thebackend.storage.getPrinter(thebackend.printername) 
    168174    if not printer.Exists : 
  • pykota/trunk/conf/pykota.conf.sample

    r1152 r1186  
    5757# but may be really interesting only with OpenLDAP. 
    5858# 
    59 # ACTIVATING CACHE IS HEAVILY RECOMMANDED WITH THE LDAP BACKEND ! 
     59# ACTIVATING CACHE MAY CAUSE PRECISION PROBLEMS IN PRINT ACCOUNTING 
     60# IF AN USER PRINTS ON SEVERAL PRINTERS AT THE SAME TIME. 
     61# YOU MAY FIND IT INTERESTING ANYWAY, ESPECIALLY FOR LDAP. 
    6062# 
    6163storagecaching: No 
     
    120122logger: system 
    121123 
    122 # Enable debugging ? Put YES instead here, 
    123 # but only if something went wrong and you want 
    124 # to learn from where the problem comes from. 
     124# Enable debugging ? Put YES or NO there. 
     125# From now on, YES is the default in this sample 
     126# configuration file, so that debugging is activated 
     127# when configuring PyKota. After all works, just 
     128# put NO instead to save some disk space in your 
     129# logs. 
    125130# Actually only database queries are logged. 
    126131debug : No 
     
    175180# If these values are not set, the default admin root  
    176181# and the default adminmail root@localhost are used. 
    177 admin: Jerome Alet 
    178 adminmail: alet@librelogiciel.com 
     182admin: John Doe 
     183adminmail: root@localhost 
    179184 
    180185# 
  • pykota/trunk/FAQ

    r1175 r1186  
    2727    CUPS ?   
    2828   
    29     You have to define a new filtering chain for this, because most 
    30     probably your printer's PPD file already contain a *cupsFilter 
    31     line and only one is allowed. So it's impossible to plug PyKota 
    32     there. Search the mailing list archives to learn how to do. 
     29    From version 1.16alpha7, PyKota includes a CUPS backend which 
     30    allows you to use any type of printer and any driver. 
    3331     
    3432  * How can I diagnose the problem when something goes wrong ?   
     
    4846  * Some, not all, print jobs are never accounted for, why ? 
    4947   
    50     Probably because some jobs were printed in raw mode. 
    51     Job printed this way are never filtered, and so PyKota 
    52     doesn't see them. 
    53     If you print to a CUPS server through Samba, delete the 
    54     "-o raw" command line option in smb.conf's print command  
    55     entry, and restart Samba. Gimp also sets the "-o raw" 
    56     command line option some times. Be sure to disable 
    57     raw mode in CUPS configuration. Eventually recompile 
    58     CUPS without raw mode support at all. 
     48    From version 1.16alpha7, you can now use the cupspykota 
     49    CUPS backend, which ensures that all print jobs will be 
     50    accounted for. The use of the old pykota filter is deprecated 
     51    with CUPS. It remains the filter of choice for LPRng though. 
    5952     
    6053  * When printing from Windows, the jobs are never accounted for, 
     
    7467    very specific, it will probably be added to this document. 
    7568     
     69    You can also ask questions by IRC : 
     70     
     71        /server irc.freenode.net 
     72        /join #pykota 
     73         
     74     
  • pykota/trunk/README

    r1185 r1186  
    161161  - The 'querying' method consists in querying the printer (via SNMP 
    162162    or Netatalk or any other method of your choice) for its total pages  
    163     counter, just before the beginning of a job, and use this to modify  
    164     the *preceding* user's quota. So you're always late of one print job,  
    165     but this is generally ok, especially because a check is also done to  
    166     see if the current user is allowed or not to print.  
     163    counter. 
     164     
     165    With CUPS, this is done both at the beginning and at the end of a 
     166    print job. The counters difference is then immediately used to  
     167    decrease the user's account balance or increase his quota usage. 
     168     
     169    With LPRng, this is done just before the beginning of a job, and used  
     170    this to modify the *preceding* user's quota. So you're always late  
     171    of one print job, but this is generally ok, especially because a  
     172    check is also done to see if the current user is allowed or not to  
     173    print.  
    167174     
    168175  - The 'external' method consists in delegating the computation of the 
    169176    job's size in number of pages to any external command of your choice. 
    170177    The command can read the job's data from its standard input and MUST 
    171     output the job's size on its standard output. 
     178    output the job's size on its standard output. Changes to the user 
     179    account are reported immediately, both with CUPS and LPRng. 
    172180     
    173181  - The 'stupid' method consists in counting the 'showpage' PostSript   
    174182    statements in the job. THIS IS UNRELIABLE, but can serve as an 
    175183    example if you plan to write your own accounting method for 
    176     integration into PyKota. 
     184    integration into PyKota. It basically works like the 'external' 
     185    method, but does the computation internally. 
    177186   
    178187PyKota is known to work fine with HP Laserjet 2100 and 2200, and  
     
    189198============= 
    190199 
    191 WARNING : 
    192 ========= 
    193  
    194   If you run a PyKota version lower than 1.03, you definitely have to  
    195   upgrade you Quota Storage Database. Please read the documentation  
    196   included in the initscripts subdirectory first !  
    197    
     200NB : 
     201==== 
     202 
    198203  Users of MacOS-X may find the following tutorial useful : 
    199204 
     
    219224      if you plan to use OpenLDAP as the Quota Storage backend. 
    220225     
     226  You may also benefit from having the following tools installed to 
     227  deal with some printers : 
     228   
     229    - npadmin 
     230    - netcat 
     231    - ghostscript 
     232     
    221233  You need to have the following tools installed on the Quota Storage   
    222234  Server : 
     
    272284provided as well. 
    273285 
    274 Copy the conf/pykota.conf.sample and  conf/pykotadmin.conf.sample 
     286Copy the conf/pykota.conf.sample and  conf/pykotadmin.conf.sample  
    275287sample configuration files to /etc/pykota/pykota.conf and  
    276 /etc/pykota/pykotadmin.conf. The installation script tries to do this  
    277 for you if needed and you agreed to this action. 
    278 You need to adapt these files to your own needs. 
    279 Especially you have to create sections named after your own 
    280 printers, and change the administrator's email address. 
     288/etc/pykota/pykotadmin.conf. The installation script tries to do  
     289this for you if needed and you agreed to this action. You need to  
     290adapt these files to your own needs. Especially you have to create  
     291sections named after your own printers, and change the  
     292administrator's email address which by default is root@localhost. 
     293Read and try to understand these two very well commented files, 
     294so that you'll encounter less problems later. 
     295Also be sure to double check that commands to query printers 
     296for their internal page counter work from the command line 
     297before using them in PyKota's configuration. 
     298 
     299The rest of the installation depends on your printing system : 
    281300 
    282301  - CUPS Printing System : 
     
    309328        Configure your printer as usual.     
    310329         
     330        Now double check /etc/pykota/pykota.conf  
     331        This file should contain a section named after the 
     332        printer you've just added. 
     333         
    311334        That's all. 
    312335     
    313336    For existing printers : 
    314337     
    315         If you had already installed PyKota, then remove 
    316         the *cupsFilter lines in your PPD files for each 
    317         printer already managed printers. Each line to 
    318         remove is of the form : 
     338        If you had already installed a version of PyKota earlier  
     339        than 1.16alpha7, then remove the *cupsFilter lines in your  
     340        PPD files for each printer already managed printers. Each  
     341        line to remove is of the form : 
    319342         
    320343          *cupsFilter: "application/vnd.cups-postscript 0 /usr/bin/pykota" 
    321344         
    322345        Don't touch anything else, especially any other *cupsFilter line. 
    323         Then save each of these files and restart CUPS. 
     346        Then save each of these files. 
    324347         
    325348        Then, the easiest is to directly modify the DeviceURI lines  
     
    344367     
    345368    For each printer on which you want to use print accounting. 
     369     
     370    And then save the file and restart LPRng : 
     371     
     372        $ /etc/init.d/lprng restart 
     373         
     374Now you can begin to populate the PyKota's database with printers, 
     375users and groups : 
    346376   
    347377Add printers and users to the quota system and set their quota values :  
  • pykota/trunk/SECURITY

    r1106 r1186  
    3030---------------------------------- 
    3131 
    32   - In CUPS disable RAW printing, so that users can't bypass the accounting 
    33     filter. 
    34      
    35   - Ensure that only the user your printing system is run as can 
    36     execute the pykota filter. Depending on your system's configuration, 
    37     this may give something like : 
    38      
    39       $ chown lp.daemon /usr/bin/pykota 
    40       $ chmod 700 /usr/bin/pykota 
    41        
    42     If any user could run the pykota filter, then he theorically could  
    43     forbid any other user to print by incorrectly charging them for 
    44     pages they would never have printed. 
    45      
    46   - Ensure that only the print quota administrator (e.g. root) can  
    47     execute the edpykota and warnpykota commands. Depending on your  
    48     system's configuration, this may give something like : 
    49      
    50       $ chown root.root /usr/bin/edpykota /usr/bin/warnpykota 
    51       $ chmod 700 /usr/bin/edpykota /usr/bin/warnpykota 
    52        
    53     or    
    54      
    55       $ chown root.lpadmin /usr/bin/edpykota /usr/bin/warnpykota 
    56       $ chmod 750 /usr/bin/edpykota /usr/bin/warnpykota 
    57        
    58     If any user could run warnpykota, then he could fill the mailboxes 
    59     of all users who are above quota, by repeatedly running warnpykota. 
    60      
    61     If any user could run edpykota, then he could, in the better case, 
    62     set his account to noquota mode. In the worst case he could render 
    63     PyKota and/or your printing system completely inoperative. 
     32  - Most of the stuff which was there was deleted because PyKota's 
     33    configuration files permissions should take care of most 
     34    security problems. BUT of course, you have to set them correctly ! 
    6435     
    6536  - Ensure that no regular user can read PyKota administrator's  
     
    7546     
    7647    Letting any user read PyKota administrator's configuration file may  
    77     expose passwords or database information which would allow direct  
    78     connections to it if the user can write and execute his own scripts  
    79     or download and execute his own version of PyKota.  
     48    expose passwords or database information which would allow write 
     49    access to the database, and so may transform your print quota 
     50    management in a nightmare. 
    8051   
    8152    If you want to let users generate their own print quota reports,  
     
    11586    Otherwise they could modify their quota at will. 
    11687     
     88    You also have to define two binding DNs in your LDAP tree, 
     89    one of them should be able to have a read only access to 
     90    everything. The other one should be able to write, for  
     91    example your LDAP admin user is fine for this. 
     92    Now put the readonly user in /etc/pykota/pykota.conf 
     93    and the read-write one in /etc/pykota/pykotadmin.conf 
     94     
    11795====================================================================