3

I would like some help on securing a networked printer. Specifically, I'm interested in the following:

  1. Preventing unauthorized access to the printer: I would like only certain laptops that connect to the printer's network over Wi-Fi to be able to print but I would definitely want to prevent guest laptops from printing.

  2. Have some sort of accounting enabled whereby I can figure out who (read: which machine) printed/scanned/copied how many pages.

Is there a generic solution for this under *nix or does it depend on the printer?

1

There are two general approaches to do what you want to do.

  1. printer specific method: Using the printer manufacturer provided tools and documentation configure the printer. This has the advantage of the fewest components. On the other hand you would need to trust the manufacturer of the printer to securely implement the print server with all the needed functionality. I would have a real problem with doing this as every printer I have ever been responsible for had at a minimum three of the five following problems: Broken security, broken accounting, would not work with our security, known unpatched security flaw older than the ink, broken printer driver.

  2. unix print server as firewall and subnetting: setup a unix or linux box running the print server of your choice (you mentioned cups, it is a good choice) with either two network cards or trunking. Connect one network card to your main network and the second to a subnet consisting only of printers. Do Not Enable Routing, NAT, or port forwarding. Configure all other computers to use this machine as your print server, consulting the documentation for best practices for security and accounting. This machine would send the print jobs to the actual printers. The advantage of this approach is that the security, accounting and documentation is much better. The disadvantage is that you have another single point of failure with a hard disk. you also should restrict users on this box to those allowed to print as they can bypass the print server in many cases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.