Cups "add printer" page returns forbidden on Web Interface on http://localhost:631/admin

I tried adding my main user to "lp" and restarting, but no change. I also tried setting at the top of the cups.conf SystemGroup printadmin and doing sudo systemctl restart cups to no avail.

Here is the relevant cups.conf

# Restrict access to configuration files...
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny

I'm just trying to add a printer using the web interface, but something about the permissions doesn't allow my user credentials to work. There is no group named SYSTEM or lpadmin.

  • It's not obvious to me from the question, but it sounds like you have a web interface for cups and it's not working? Two ideas jump to mind -- that the HTTP server user (that's running the interface) does not have permission; the other is that there's an HTTP permission issue (or misconfiguration) that's preventing the interface from running/doing something. Could you expand on your question to clarify what you're doing? – Jeff Schaller Oct 11 '15 at 23:46

Update: On Fedora 25 this is now default... So if you're having this problem on Fedora 25+, you likely messed up your config or you have a different problem. But this might still be useful users of old installs of CentOS/RHEL... you should not be using Fedora 24 at this point.

Find /etc/cups/cups-files.conf as root. Look for the line with SystemGroup sys root add wheel to it.

The following two liner should do it for you on Fedora 24

 sudo sed -i '/SystemGroup sys root$/ s/$/ wheel/' /etc/cups/cups-files.conf
 sudo systemctl restart cups
  • 1
    Fedora 24 is still a supported release until sometime in the summer of 2017. So, while I too recommend upgrading, it's okay that not everyone has yet. :) – mattdm Jan 14 '17 at 14:23
  • 1
    In debian the wheel group isn't use. If you use Debian/Ubuntu add sudo to the list instead. – Guy Aug 5 '20 at 8:31

I had to combine two other answers for Ubuntu, and the solution is to add myself to the lpadmin group:

sudo usermod -a -G lpadmin your-username

For every system, the solution should be:

  • Open the file /etc/cups/cups-files.conf.
  • Find the group name at the line containing SystemGroup.
  • Add yourself to that group (command above) and apply it (reboot for example).

The solution is

sudo usermod -a -G sys YourUser

I wrote a more detailed article on how to debug such issues.

  • 6
    It's a bit of a sledgehammer to add yourself to the system group, which may grant your user/processes more power than you'd expect. See my answer for a good alternative grants you access to cups alone. – Ray Foss Jul 8 '16 at 14:48
  • 4
    Eek - don't do this if you're setting it up for anyone other than yourself.. in your own home.. Can't use this solution as I'm setting up printing for a whole business, I don't want to give my users god-powers on the device. – Dagrooms Jun 13 '17 at 19:03
  • On a Debian-based OS this answer is valid if you use the group lpadmin. – AnthonyB Jul 29 '19 at 13:50

I have cups installed in OMV5/Docker/Portainer and in the settings file only users in lpadmin group can add printers, so the solution (at least in this particular case) is to add your user to that group or add your user group to the config file. You can check the required group in /etc/cups/cups-files.conf and if it turns out its the same as me just run.

usermod -a -G lpadmin yourusername

on the other hand if you're using the same configuration as I am, users in OMV and portainer wont migrate to cups so you'll have to create them(it) 1st:

adduser yourusername
usermod -aG sudo yourusername

and only then:

usermod -a -G lpadmin yourusername

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.