Setting up and administering print queues within the CUPS printing system. Aimed at a Debian 11 (bullseye) installation, but much of the material should apply to Debian 10 (buster), Debian 9 (stretch) and Debian 8 (jessie) too.
- Print Queues and Printers
- The device-uri
- The device-uri for a Networked Printer
- Configuring the Choice of Backend
- Printer Drivers
- Non-free Printer Drivers and Firmware
- Avoiding Non-free Printer Drivers and Firmware
- The PPD File
- Creating a Print Queue with lpadmin
- Creating a Print Queue with the CUPS Web Interface
- Creating a Print Queue with HPLIP
- Creating a Print Queue with system-config-printer
- Double Filtering
- Auto-discovery of Remote, Shared Queues and Printers
- Temporary Queue Creation by CUPS
- Printing and GTK Applications
- Printing Without a Local CUPS Server
- Configuration Files for the Scheduler, cupsd
- See Also
The major changes in Debian 10 (buster) compared with the two previous stable distributions have to do with driverless printing. It is offered on Debian 9, but CUPS, cups-filters and cups-browsed have augmented their software to include more filters and options to take advantage of modern-day printing technology. For CUPS it is worth mentioning the introduction of temporary queue formation and Apple Raster as a supported PDL. For cups-filters there is now a rastertopclm filter and cups-browsed has more support for setting up driverless printing automatically.
The single most important change in Debian 11 (bullseye) concerns the extension of driverless printing to include modern printers that support IPP-over-USB. Connecting a modern MFD to a USB port should see a print queue established automatically. An alternative to auto-setup is to install a queue manually. The situation regarding whether all modern USB-only printer devices understand IPP-over-USB is unclear. However, many modern MFDs have been observed to interwork with this protocol.
Print Queues and Printers
A document destined for a printer or print server is frequently called a print job. On its way there it is first put into a queue before being processed. The queue has certain properties which determine how the print job is dealt with and may be queried with lpoptions and lpstat for a list of these properties and the queue status repectively.
The properties specified when the queue is created are not immutable. Quite a few of them can be altered by a user via lp or an application when the print job is submitted to the queue. A user can also set default printing options in ~/.cups/lpoptions. An administrator who hoped to confine users to duplex (two-sided) printing, for example, would have to look outside the CUPS framework for a solution to add to the system.
Several queues can point to the same physical device, the printer, but it is very common for print queue and printer to be used interchangably. No harm need come from this, but it pays to give careful attention to whether a CUPS print server or a printer is being contacted. This account treats general principles and manual setup of a queue first; automatic setup and a glimpse of a modern development follow later.
Ultimately, a print job has to go somewhere; most users expect the job to go to a printer. However, the job is only going to get to the printer or print queue (after being taken out of the CUPS queue) if the device-uri (or, for short, URI) is one recognised by CUPS and the printer or print queue. lpinfo allows you to see which device-uris and drivers (backends) are associated with a print server or a printer:
Backends in /usr/lib/cups/backends are now used in discovery mode in an endeavour to locate printers. Here is the output of one such command when an legacy HP PSC 1300 is attached to a Debian 10 (buster) machine via USB and two printers are available over the network (a legacy HP LaserJet 2200 and an modern HP ENVY 4500). Execute /usr/sbin/lpinfo -l -v for more detail.
This output was produced from a machine with a buster installation. On a bulleye machine the final line would have a different format.
network lpd network ipp network http network socket network beh network https network ipps direct usb://hp/psc%201300%20series?serial=HU3AFBQ28Y9F&interface=1 direct hp:/usb/psc_1300_series?serial=HU3AFBQ28Y9F direct hpfax network dnssd://LaserJet-300%20%40%20desktop._ipp._tcp.local/cups?uuid=325fb239-90e7-3a46-7835-1e12939a1ba5 network dnssd://ENVY4500._ipp._tcp.local/?uuid=1c852a4d-b800-1f08-abcd-308d99fafac2 network socket://192.168.7.235:9100 network ipp://ENVY4500.local:631/ipp/print
The USB connected printer has been located by two backends: usb and hp. The first backend comes from CUPS and the second from HPLIP. Either device-uri can be used for printing. However, if automatic scanner discovery on an MFD is wanted, the hp backend should be used to set up the queue.
Additionally, the ENVY 4500 has been found from its DNS-SD broadcasts by the dnssd and ipp backends. Either device-uri may be used. Both are equally as good for a driverless printing solution. The snmp backend has also located this printer at 192.168.7.235:9100 and presents a non-driverless socket URI to use.
The dnssd://.. entries are either Bonjour-broadcasted print queues from a CUPS server on a remote machine or Bonjour-enabled printers; DNS-SD has located them with the help of Avahi. In general, queues created with a dnssd://... device-uri and pointing to a server, such the LaserJet-300 entry, should be set up on the client as raw queues so that the filtering takes place entirely on the remote server.
Which dnssd://... entries are queues and which are printers?
/usr/lib/cups/backend/dnssd > dnssd.log grep "local/cups" dnssd.log (These are print queues). grep "local/?uuid" dnssd.log (These are printers). grep "Unknown" dnssd.log (These are raw print queues).
If it is known that a queue on the remote machine is itself a raw one or the device-uri points to a printer, you may have to consider whether setting up a local raw queue achieves what you want (see CUPSTea4CUPS for situations in which you would want a local raw queue).
Having a correct URI is critcal for printing to a printer or print queue.
The device-uri for a Networked Printer
CUPS can use at least one of the AppSocket, Internet Printing (IPP) and Line Printer Daemon (LPD) protocols for connecting to printers and print servers over a network connection. For a view of which services a device supports there is the nmap command:
The output will vary from printer to printer. For an HP Envy 4500 it is
PORT STATE SERVICE 80/tcp open http 443/tcp open https 631/tcp open ipp 8080/tcp open http-proxy 9100/tcp open jetdirect 9220/tcp open unknown
The choice of protocol will be driven by your needs and what is offered by the printer or print server.
AppSocket is non-complex, usually well-implemented, low overhead and reliably gets the data from point A to point B, but doesn't do much else for the printing proces.
IPP provides bidirectional communication for feedback and control, secure authentication services, access control and printer discovery and status. Its use is mandatory on AirPrint and IPP Everywhere printers. In other words, printing to devices connected via the network and over USB cannot take place without the IPP protocol.
LPD is a popular protocol older than IPP and with a feature set less extensive than it. Secure access, detailed error status reports and the ability to query a printer are lacking, for example.
Also known as the JetDirect or RAW protocol, this is the most basic protocol that can be supported by a printer. The URI scheme is
The standard port number is 9100 and this will be used by default if omitted from the device-uri. Print servers with three outputs would require three port numbers; for example, 9100, 9101 and 9102.
It is questionable whether AppSocket is a protocol. There is no specified standard for it; no queue management; no aborting of jobs; no querying of printer supplies; no encryption. All it does is shovel the data for a print-ready file over the network and then close the connection. Because the only overhead is TCP/IP the data transfer is generally fast. Also, it has been in widespread use for a long time so the printer implementations of AppSocket are good. Running netcat to send printer-ready data to a printer is no different in principle from using AppSocket.
Printing normally takes place over port 631 with the URI scheme being either of these:
ipp://<ip_address_or_hostname>:[port_number]/resource (buster) 1pp://<DNS-SD_name>._ipp._tcp.local/ (bullseye)
Unfortunately, the resource path has never been standardised and it may require some experimentation to determine what a printer or server will accept, especially if the device is not on the local network or it does not do, as most modern printers do, Bonjour broadcasting. Apparently, newer printers often use /ipp/print in the resource path but for older products (as well as newer ones) it could be something entirely different, like ipp/port1, ipp, ipp/printer or ipp/laserjet. Maybe the printer's front panel will help. Or
could give suitable output if there is explicit information from the Port Monitor MIB (Management Information Base) database of the printer. In the absence of an MIB the probing is for AppSocket, then LPD and the first that works is reported. Because AppSocket is supported by most network printers it would likely be the protocol given for use in a URI. So not so useful for getting an IPP URI.
avahi-browse -art | less
ippfind (Shows IPP printers and print queues). ippfind -T 5 (Possibly more reliable). ippfind ! --txt printer-type (Show IPP printers only).
An alternative command (which relies on ippfind) is
A CUPS server can always be reached with
In theory, the handshaking and status monitoring done by the IPP protocol should ensure reliable printing but, in practice, there are older printers that do not implement some aspects of IPP very well. However, these days, a more optimistic view of the situation can be taken.
This is the original network protocol. It has a URI scheme of
and a default port of 515. Even though AppSocket and IPP are seen as better alternatives, it is regarded as a reliable protocol for sending a job to a printer. CUPS itself has some limited functionality for LPD-based clients. Modern printers may not provide this protocol.
Configuring the Choice of Backend
The cups package provides a debconf method for selecting backends that are used for printer discovery and connection to the device. It basically gives a convenient way of copying the backends that come with CUPS between /usr/lib/cups/backend-available/ and /usr/lib/cups/backend/. Run
Note that not every backend on the system is managed with this command because they are not all in the cups package. For example, the parallel and beh backends are in the cups-filters package.
Be careful about which backends are removed from the debconf list. Deleting the dnssd backend would still allow remote Bonjour broadcasted queue discovery via cups-browsed but Bonjour broadcasted printers would not seen by CUPS. An AppSocket-enabled printer would be discoverable with the snmp backend but, if the socket backend was deleted, trying to set up a queue using a socket://... URI would give the error Bad device-uri scheme "socket".
Vendor drivers are in the printer-driver-* packages plus various other packages. The print server task in Debian Installer gives you a full complement of these drivers. You may decline this task at install time but after first boot can do either
apt install task-print-server
apt install cups
If a driver/PPD for your printer is not in any of the installed packages you have various choices open to you:
Consult OpenPrinting for ideas on available drivers.
- Hunt down an appropriate package with
apt search <search_term>
Go to the printer manufacturer's website
Users who possess a modern printer are urged to consider a driverless printing solution (buster onwards), perhaps by setting up a suitable print queue or by following the advice here. The days of CUPS continuing driver support in the form it is now are numbered.
Non-free Printer Drivers and Firmware
Driver software distributed with quite a few printers does not meet the criterion of being DFSG-free, so users who need to use such a driver with a printer will have to rely completely on what the printer manufacturer has to offer to get their printer working. Also, even though most HP printers operate with DFSG-free software, some HP devices used with hplip require a proprietary host-based driver plugin or a firmware file to allow full access to printer or scanner features or enhanced performance. The firmware is uploaded to the printer when it is powered-on attached to the computer. The host-based plugin software is used when printing or scanning.
It may be necessary to go to the manufacturer's website if the printer is a new model and drivers for it are not yet in a Debian package (or never will be) and driverless printing is not an option. However, it would be highly unlikely that a modern, AirPrint-enabled printer would not be a good fit for driverless printing on Debian 10 (buster) and later, and therefore a user is advised to follow this route for a quick, efficient and almost effortless modern printer setup.
Solutions for Linux is a good place to start for assessing what support your printer has from Brother. Generally, you will need .deb files for the cupswrapper and the lpr driver. Follow the instructions to install them; alternatively, there is linux-brprinter-installer to do that for you.
There is a Canon wiki page dealing with printers requiring URF-II, CAPT and cnijfilter drivers. A Canon Advanced Printing Technology (CAPT) printing package and a cnijfilter package can be installed in a similar way to Method 1 at the previous link. Namely: extract files from the package with tar zvxf..... and install Debian packages with apt install ./....
Some useful phrases for locating Canon packages on the web are:
- cnijfilter debian 5.70
- ufr printer driver for linux
- capt printer driver for linux
Alternatively, search for a package from a Canon website
A goodly number of Epson printer drivers fall into the category of DFSG-free. These are gathered together in printer-driver-escpr. Free and non-free drivers may be located and downloaded from this Epson website. Some Epson drivers have the advice that
In order to install these drivers, you need to install LSB package (version 3.2 or later) beforehand.
The tip in this bug report is worth taking note of.
Linux support for a Samsung printer can be searched for from this HP website. Many, but not all, Samsung printer models use the Unified Linux Driver (ULD). ULD contains PPDs for Linux supported printers, a printer driver to use with the PPDs and a library to use with the driver. It comes in a .tar.gz package and only supports the i386 and amd64 platforms. No source code is provided. ULD is also employed to support some HP devices.
Extract the files in the tarball and install them by entering the directory created and running install-printer.sh
tar zvxf uld_v1.00.xx_xx.xx.tar.gz cd uld ./install-printer.sh
Samsung does not provide ULD as a .deb but the The Samsung Unified Linux Driver Repository does. It also has a good deal of information on the installation of ULD and its interaction with a Debian system. SULDR is not affiliated with Samsung.
A relatively small number of HP devices requires a plugin to be installed on the computer for them to operate at all or to function at their full potential for one or more of the device's printing, scanning or faxing modes. For a handful of HP printers the plugin package contains firmware that has to be uploaded to a printer. Without a firmware requirement the plugin software can still be needed to interact with the printer. Effectively, the print job is processed by the plugin to produce a file in a language the printer understands. In technical literature the printer would be described as host-based. See whether the plugin is needed and use HP's home page search facility to see a printer's details and find out what any firmware is required for. hp-plugin -i is a command to use to install the plugin.
Plugin software can be installed (as root) without the hplip package and its dependencies being on the system.
apt install hplip-data
Download the appropriate plugin file to a chosen directory.
sh hplip-<version>-plugin.run --tar vxf
python installPlugin.py or python3 installPlugin.py
apt purge hplip-data
HP + ULD
There are HP devices that are not supported by the HPLIP software but require the Samsung Unified Linux Driver (ULD) software for printing or scanning. Some such devices have PPDs and drivers in uld-hp_V1.00.39.12_00.15.tar.gz and uld-hp.tar.gz. The names of these packages and their contents have been known to change, so it may very well be best to search for them using a printer model. The devices catered for by the packages above are
* HP Color Laser 15x Series * HP Color Laser MFP 17x Series * HP LaserJet MFP M433 * HP LaserJet MFP M436 * HP LaserJet MFP M72625 72630 * HP Laser10x Series * HP Laser MFP 13x Series
A concise guide to installing the ULDLINUX package and setting up a USB-connected print queue with an appropriate PPD has been provided by Robert Nurnberg in Message #16. Adapting the guide for a wireless connection should not be difficult.
foo2zjs (firmware and colour profiles)
getweb | less getweb p1008
give a list of what is available and download the firmware file for an HP LaserJet P1008. Hannah is a graphical firmware downloader that uses getweb. Re-plug the connection to the printer to upload the firmware to it.
Avoiding Non-free Printer Drivers and Firmware
A non-free filter generally gets used at the last stage of the filtering process after cups-filters has done its job. The process ends with something that is sometimes termed host-based (and which is often proprietary) rather than letting the printer itself take care of the final conversion. It makes sense to the printer manufacturer to do this (probably on legal, technical or economic grounds) but it disrupts the free software ecosystem within which CUPS and cups-filters operate.
+----------------------+ +-----------------+ File in -> |CUPS and cups-filters | -> | Non-free driver | -> Printer +----------------------+ +-----------------+
The final stage of this process could be dispensed with if what was sent to the printer was something it could understand.
+------------------------+ +-----------------------+ | Something the printer | File in -> | CUPS and cups-filters | -> | understands sent by | -> Printer +-----------------------+ | CUPS and cups filters. | +------------------------+
Recent developments in printer technology see printers understanding MIME types image/pwg-raster and image/urf. These file types are also referred to as PWG and Apple raster data formats respectively.
+--------------+ +-----------------------+ | Apple raster | File in -> | CUPS and cups-filters | -> | or | -> Printer +-----------------------+ | PWG raster | +--------------+
From CUPS 2.2.2 and cups-filters 1.13.0 onwards it is possible to send a job in Apple and PWG raster to a printer that understands either data format. This is dealt with in more detail on the driverless printing page.
With a modern printer the use of non-free software or non-free plugins is completely avoidable.
The PPD File
PostScript Printer Description (PPD) files were originally used by printers that operated with PostScript as a Page Description Language (PDL) for printing. They have been adapted to cope with other standard printer languages such as HP's Printer Command Language (PCL) and special (often proprietary) languages. Driver packages include PPDs in their contents.
A searchable list of PPDs on your system is obtained with
/usr/sbin/lpinfo -m | less
If there is only one for your printer, the choice is made for you! If there is more than one, go for the PPD that is marked Recommended. If none are recommended, use common sense or seek help from the openprinting database. Some Generic PPDs are listed with lpinfo -m and one could be a solution when every driver package is installed and your printer model is not in the list. You can also resort to the printer manufacturer's website or a CD that came with the printer.
It is convenient (and probably sensible) to put a PPD obtained from elsewhere in /usr/share/ppd/custom. It will then be displayed in the outputs of lpinfo -m, the web interface and system-config-printer.
Creating a Print Queue with lpadmin
This is the basic method to set up a queue. It is used behind the scenes with system-config-printer (s-c-p), HPLIP, cups-browsed and the CUPS web interface. There are four essentials to provide when setting up a working, accepting print queue with lpadmin.
The queue name (-p): The printing system treats the name in a case-insensitive manner; LaserJet-300 is the same queue as laserjet-300. Chose any valid name that makes sense to you.
The device-uri (-v): The destination for a print job; usually a printer but may be a queue on a CUPS server.
The printer model (-m): Determines how the print job is handled by the filtering system to produce data that can be successfully printed by the printer. Options are to specify a PPD or have a PPD generated from the printer response to being queried (see everywhere and driverless) or raw.
- Whether the queue is enabled (-E): Must be specified explicitly.
With this information the queue is set up with
lpadmin -p <queue_name> -v <device-uri> -m <PPD_or_everywhere_or_driverless_or_raw> -E
lpadmin -p <queue_name> -v <device-uri> -E -m raw
lpoptions is the command to use to see default options for the queue (obtained from the PPD):
lpoptions -p <queue_name> -l
The previous lpadmin command is about as simple as it gets for setting up a queue quickly, but it can be tweaked just as simply by giving the command some queue-specific options to add with -o. For example, to have duplex printing as a default for a driverless queue:
lpadmin -p <queue_name> -v <device-uri> -o sides-default=two-sided-long-edge -m everywhere -E
Setting up a queue with lpadmin or the web interface requires either root privileges or for the user to be a member of the lpadmin group. If you installed CUPS using the printserver task in the Debian installer, the first user is put in the lpadmin group.
Check for user membership of the lpadmin group with the command
If lpadmin doesn't appear in the previous command output execute this command if you wish (change username with your user name):
usermod -a -G lpadmin <username>
Creating a Print Queue with the CUPS Web Interface
http://localhost:631 is the location of the interface and from there you can administer print queues, including their installation. Administrative tasks are able to be completed by giving the username root and root's password or providing the username and password of an lpadmin group member.
The Add Printer button could produce a first page showing something like this on a bullseye OS:
Local Printers: [ ] CUPS-PDF (Virtual PDF Printer) [ ] CUPS-BRF (Virtual Braille BRF Printer) [ ] EPSON Stylus Photo RX420 (EPSON Stylus Photo RX420) [ ] hp psc 1300 series (HP psc 1300 series) [ ] HP psc 1300 series USB HU3AFBQ28Y9F (HP psc 1300 series) [ ] HP ENVY 4500 series USB CN56G332DT060D HPLIP (HP ENVY 4500 series) [ ] HP Fax (HPLIP) Discovered Network Printers: [ ] LaserJet-300 @ desktop (HP LaserJet 2200) [*] ENVY 4500 series (fully driverless) (HP ENVY 4500 series) Other Network Printers: [ ] Internet Printing Protocol (ipps) [ ] Backend Error Handler [ ] Internet Printing Protocol (http) [ ] LPD/LPR Host or Printer [ ] AppSocket/HP JetDirect [ ] Internet Printing Protocol (ipp) [ ] Internet Printing Protocol (https)
As before, backends have been run in discovery mode to find printers and print queues. The above display is a transcript taken from the image forming the basis of a previous account of the CUPS web interface. Note carefully that the modern ENVY 4500 is USB connected and using the IPP-over-USB protocol, so all the comments in that account concerning this protocol apply here too.
Under Local Printers are the discovered printers that are directly connected to the computer being used. Printer in this context refers to a real machine or a virtual printer such as cups-pdf. The psc 1300 and EPSON Stylus are legacy printers and will require drivers. Note that the psc 1300 has been discovered by the usb and hp backends. The hp:/usb/... connection should be chosen if it is desired to make scanning from an MFD automatically available to a SANE frontend.
The USB entry for the ENVY 4500 cannot be used to set up a working print queue when bullseye is the OS. Under Discovered Network Printers look to use model/driver entries on the third page that comtain driverless or IPP Everywhere.
Discovered Network Printers are networked printers on the same subnet as the computer. Or they could be print queues (these entries display an @ in a name) that the dnssd backend has found on the same subnet.
Other Network Printers gives you the opportunity to provide the device uri and PPD for a printer or queue that falls into neither of the previous two categories. The information to be provided is asked for on the second and third pages.
Having made a selection from Local Printers: or Discovered Network Printers: you should find a queue name based on the printer make and model has been filled in for you on the next page. Change it by all means if you wish. Once it is done it cannot be modified later because a new name would imply setting up a different, new queue.
Share printers connected to this system on the Administration page is the basic facility to allow (or not allow) DNS-SD broadcasting of any queue. Ticking Share This Printer on the second page designates your queue as one to add to this facility.
Moving on to the third page you should find that the Everywhere Model or a PPD has been selected for you, unless
- The printer or queue doesn't fit the everywhere model.
- The printer or queue provides no make and model information to CUPS.
- There is no PPD for the printer or queue on the system.
Other Network Printers is being used.
The final page has the default printer-specific options from the PPD and a few non-specific printer options. These defaults should suit the needs of many users.
Creating a Print Queue with HPLIP
HPLIP is a one-stop solution for printing, scanning and faxing with appropriate HP devices and designed to work with CUPS. Only the printing aspect is dealt with here. USB scanning is the subject of another wiki page and network scanning is linked from it. HPLIP uses its own printer backend, hp:/..., and URI scheme for printer discovery and sending a print-ready job to the printer. For a graphical user interface (GUI) to HPLIP there is a hplip-gui, which contains very similar utilities to the ones in the hplip package. This page lists the HP devices that are supported by HPLIP.
Be aware that the hplip package can be dispensed with for printing on a modern HP printer because it is most probably well suited to driverless printing. Only libsane-hpaio might be needed for scanning: apt install --no-install-recommends libsane-hpaio.
- URI scheme: USB printer.
- URI scheme: networked printer.
hp:/net/<printer_model>?ip=<IP_address> hp:/net/<printer_model>?hostname=<DNS_hostname> hp:/net/<printer_model>?zc=<bonjour_hostname>
- URI scheme: parallel port printer.
Each printer model supported by the installed verion of HPLIP is listed in /usr/share/hplip/data/models/models.dat. Model names are enclosed in square brackets; like so, [envy_4500_series].
Printer discovery and setting up a print queue can be done from the command line with hp-setup. For USB and printers on the network:
hp-setup -i -busb hp-setup -i -bnet
You will be led through the rest of the procedure.
The SLP service agent runs on port 427 of a printer; do you have such a service?
nmap -sU -p 427 <ip_address>
executed with root privileges will tell you.
The command hp-setup -i -bnet uses only SLP for discovery. If you want to setup a queue for an mdns advertised printer it is suggested to do
- hp-probe -mmdns (This provides a device URI).
hp-setup -i -d<device_URI>
A problem with firewall settings could lead to the first command failing.
HP printing devices can be set up with device-uri schemes other than hp:/... provided CUPS and a suitable printer-driver package such as printer-driver-hpcups, printer-driver-hpijs or printer-driver-postscript-hp have, as a minimum, been installed. Printer discovery would be done through any of lpadmin, the CUPS web interface or system-config-printer. Bear in mind that, depending on the age of the printer and the connection type, automatic scanner discovery on an HP MFD may become unavailable if this is done.
Creating a Print Queue with system-config-printer
The idea of system-config-printer is to provide functionality similar to lpadmin and the CUPS web interface but with greater desktop integration rather than interacting with a commandline or browser interface. However, anyone familiar with the CUPS web interface should feel at home with using it. Please see this other page for a view on how system-config-printer behaves on a default bullseye installation..
The initial screen seen when system-config-printer is run displays icons and names for local print queues; that is, queues that have been set up by a user or by cups-browsed. The Add button is for printer discovery and creating a new queue for a printer. A greyed-out button indicates a lack of some administrative privilege, so go to Server-->Connect-->Connect. Hopefully, the device-uri and CUPS web interface sections will be found useful for interpreting and acting on the discovered printers display.
- There is a difference in the way adminstrator privileges for the printing system are gained with system-config-printer compared with lpadmin and the CUPS web interface.
A default jessie or stretch system-config-printer installs cups-pk-helper as a recommended package to further the aim of desktop integration. cups-pk-helper is intended to give fine-grained control of aspects of CUPS management via policykit. Unlike lpadmin, the CUPS web interface and HPLIP, the cups-pk-helper utility does not respect the SystemGroup lpadmin directive in cups-files.conf and an adminstrator password will be requested to see remote print queues and to administer them and local queues.
Almost nothing is administratively possible for an ordinary user when cups-pk-helper is on the machine. A user is entitled to cancel her own jobs but, without the machine's administrator altering policykit's view of who is entitled to administer printers, nothing else is available.
This situation may be altered by the administrator putting a file ending with .pkla into /etc/polkit-1/localauthority/50-local.d. 99-printer.pkla would be a suitable name for the file. With its contents being
[Printer configuration] Identity=unix-user:milly;unix-user:molly;unix-user:mandy Action=org.opensuse.cupspkhelper.mechanism.* ResultAny=no ResultInactive=no ResultActive=yes
the users milly, molly, mandy would have privileges granted similar to those granted to a member of the lpadmin group and not have to provide a password.
- Removing the cups-pk-helper package would be an alternative strategy to allow users in the lpadmin group administrative privileges.
The CUPS web interface and the command /usr/sbin/lpinfo -v give a list of printers and print queues discovered on the network. Any of the entries in the list can be installed as a local print queue. In other words they will listed in /etc/cups/printers.conf on your machine.
For example, under Discovered Network Printers in the web interface you might see
testq @ desktop (DCP-9020CDW)
and the next web page shows a Connection beginning dnssd://.
The dnssd:// and @ desktop tell you this is a print queue discoverd by avahi-daemon. The (DCP-9020CDW) tells you the make and model of the printer. The latter information is obtained from the *Product line in the queue's PPD, so it implies the queue is not a raw queue and a job sent to it undergoes filtering on the server. The same information is given in the make-and-model field of the output of /usr/sbin/lpinfo -l -v.
On the third web page you should choose Raw as the Make. With lpadmin you should have -m raw. Then the client passes the data through without filtering and all filtering is done correctly on the server.
Alternatively, you can get such queues automatically set up locally by running cups-browsed on the client.
Upstream CUPS has something to say about double filtering. Quoting:
The issue is the MIME typing on the CUPS server - if the server doesn't recognize the MIME media type then you may end up with extra filtering. I'm not saying it can't work (because we have customers that use that configuration all of the time), it is just that we get a lot of support calls when people try to do Microsoft-style printer sharing to a server that is also hosting a CUPS printer driver on the same queue.
Reinforcing the previous point:
The issue is that for IPP we actually get to use MIME media types, and the filters in the PPD file specify what the final output type is. We then try to match things up on the remote system, which is where the problems typically occur. For example, if the local driver has a filter that specifies application/vnd.hp-pcl" as the destination MIME media type but the server does not have that MIME media type defined/supported for its queue, we have to revert to "application/octet-stream" (auto-detect). You can "fix" this with .types and .convs files on the server to specify a "-" filter for the affected MIME media types to application/vnd.cups-raw) but ultimately you are better off letting the server do the filtering...
You are strongly advised not to do double filtering. Set up the queue on the client as a raw queue if the remote queue is doing the filtering.
Auto-discovery of Remote, Shared Queues and Printers
All four of the previous setup tools for print queue creation (lpadmin, the CUPS web interface, hp-setup and s-c-p) are manual tools and the created queues are also permanent. There is often no need for this permanancy, especially when moving from network to network. Having queues set up automatically and then automatically disappearing when they go offline or are no longer required is useful for conserving resources and having an up-to-date enumeration of queues and printers.
There are currently three methods for getting information from avahi-daemon and automatically displaying print queues and IPP printers in a print dialog.
Use cups-browsed to manage queues and printers.
Have the dialog itself browse the DNS-SD broadcasts of the queues and printers using avahi-daemon.
Use CUPS version 2.2.4 or later versions. They support discovery of Bonjour advertised print queues and printers.
Firefox, Evince and Zathura are examples of applications that use the GTK print dialog. The Qt print dialog is used in Okular and Qpdfview. Libreoffice has its own print dialog. Some but not all programs expecting lp can instead use gtklp. Printing with lp or lpr is accomodated by the first and third methods.
This package was introduced for CUPS 1.6.x and is necessary on a Debian 8 (jessie) or 9 (stretch) client machine if it is wanted
- Have print queues automatically available in the print dialogs of GUI applications and usable by command line programs.
cups-browsed is not necessary on Debian 10 (buster), but could be seen as desirable if it deals with a situation CUPS cannot handle. An example might be the filtering of print queues from a print dialog.
The change in CUPS 1.6.x came about because upstream CUPS abandoned CUPS browsing as a way of broadcasting and discovering print queues and printers. There is a number of issues inherent in this method, as this mail explains. cups-browsed was devised to bring about backward compatibility and give continuity to the printing system. It does not intend to be available in perpetuity. With the arrival of CUPS 2.2.4 the cups-browsed author reassessed his work for the future:
In small home networks and on mobile devices cups-browsed is not actually needed any more, as the IPP backend replaces it in this simple case of not needing load-balancing printer clusters and remote CUPS servers being CUPS 1.6.x or newer. cups-browsed will be continued, to provide additional functionality, especially interoperability of CUPS 1.5.x or older with CUPS 1.6.x or newer, to create load-balancing printer clusters, and to allow complex filtering on which remote queues/printers one wants to see and which not.
Comprehensive documention is in /usr/share/doc/cups/README.Debian.gz, /etc/cups/cups-browsed.conf, cups-browsed and cups-browsed.conf. There are significant differences in the cups-browsed facilities, such as driverless printing, provided on jessie, stretch and buster.
The avahi-daemon package also needs to be installed on the client. The default cups-browsed.conf is set to do both DND-SD (Bonjour) discovery (CUPS only offers Bonjour broadcasting) and, for legacy purposes, CUPS IPP discovery of print queues. A server with a CUPS version of 1.6.x or greater does not need cups-browsed to do DNS-SD broadcasting but avahi-daemon is required.
DNS-SD Broadcasting (Server)
DNS-SD Discovery (Client)
jessie, stretch and buster
jessie and stretch
Legacy CUPS Broadcasting (Server)
Legacy CUPS Discovery (Client)
jessie, stretch and buster
jessie, stretch and buster
Temporary Queue Creation by CUPS
Since version 2.2.4 CUPS has gained the ability to browse the DNS-SD broadcasts of remote print queues and printers picked up by avahi-daemon. Discovered remote queues and IPP printers can be listed in the print dialogs of applications without having a local queue. On accessing a listed queue to print a job, CUPS on the client machine creates a PPD using the everywhere model. This queue is temporary and disappears a minute after being idle (or when the cups service is stopped). The intent is that a queue is added only when it is needed to print something and there is no need to use memory, CPU cycles, etc for printers that are only created just in case the user wants to print.
Having cups-browsed running leads to its controlling automatic queue creation instead. By default cups-browsed will use the same destination name as the CUPS temporary queue creation mechanism does (LocalQueueNamingRemoteCUPS DNS-SD in cups-browsed.conf). This allows it to overwrite a temporary queue and set up a local queue with the same name.
Qt applications and libreoffice use the CUPS temporary queue facility to form their print dialogs. lp and lpr can also use it. First discover local and remote queues and printers (note that lpstat -a shows only local queues):
Then print to a chosen one:
lp -d <printer_or_print_queue>
Printing and GTK Applications
The sections on cups-browsed and temporary queues might give the impression that remote printers and print queues cannot be discovered, and printing cannot take place from Debian 8, 9 and 10 clients, without either of them. This is not quite the case; it all depends on what you are printing from. Nevertheless, it is worth highlighting that
- cups-browsed promotes printing from all applications and from the command line.
Temporary queue formation is a central feature in the Qt and LibreOffice print dialogs.
Firefox, Evince and gedit (to name but three applications) use the GTK print dialog as a printing subsystem. The subsystem gets remote print queue and printer information directly from Avahi and the queues appear in the print dialogs of those applications. cups-browsed and temporary queues aren't needed and neither for that matter is CUPS. This means that printers and print queues get broadcasted via Bonjour and an application's GTK print dialog browses the Bonjour broadcasts to add available remote printers and queues to its list.
Displaying and printing to a queue advertised by a remote CUPS server should present no difficulty. However, although the GTK print dialog can detect an IPP printer, it would appear not to support printing to it.
- GTK applications need CUPS to handle local (but not remote) print queues.
Printing Without a Local CUPS Server
Print queue availability by browsing the Bonjour broadcasts from a server is a dynamic process. Queues will come and go as they are enabled and disabled or as a client is moved from network to network. In a world that more and more has a focus on mobile devices there are benefits to be gained from avahi-daemon and cups-browsed or from a print dialog that implements Avahi discovery itself.
However, it is possible a static configuration is entirely suitable for some purposes. In other words, no avahi-daemon, no cups-browsed and no cupsd running on a machine and instead connecting directly to a designated server. The first step is to read this manual. Then
apt-get install cups-client
followed by making the directory ~/.cups and putting a file client.conf in it.
mkdir ~/.cups touch ~/.cups/client.conf
The content of client.conf could be as simple as
The local queue is eliminated and print jobs from all applications and the command line go straight to ServerName for processing. There is the bother of changing ServerName when moving from network to network but this may be balanced by not having to run three daemons,
Even a client.conf may be dispensed with if the only printing to take place is from the command line. At its simplest:
lp -h <server_IP_or_hostname> -d <print_queue_on_server> <print_job?
Configuration Files for the Scheduler, cupsd
These are located in /etc/cups as cupsd.conf and cups-files.conf. The existence of two files arises from a Debian bug report that lead to the fixing of a privilege escalation from lpadmin to root on systems with all options contained in cupsd.conf, as they were at that time.
cups-files is editable only by root. cupsd.conf can be edited by root and, from the web interface only, by a user who is a member of the lpadmin group. After editing either file cupsd has to be restarted:
service cups restart
It can be very convenient to change some of the cupsd.conf settings with cupsctl (as root only). The current settings displayed by
_debug_logging=0 _remote_admin=0 _remote_any=0 _share_printers=0 _user_cancel_any=0 BrowseLocalProtocols=dnssd DefaultAuthType=Basic JobPrivateAccess=default JobPrivateValues=default MaxLogSize=0 SubscriptionPrivateAccess=default SubscriptionPrivateValues=default WebInterface=Yes
Change a displayed setting with
and, for a setting that is not displayed:
More than one line in cupsd.conf can be changed with some commands and cupsd is restarted when cupsctl is used. cups-files cannot be altered with cupsctl.