[cups.development] cups print accounting and lpr -U

[Jerome Alet]

On Fri, May 16, 2008 at 02:18:28AM -0700, Kevin Pinte wrote:
> I'm a member of a students organisation called Infogroep at the 
> Vrije Universiteit Brussels. We manage the main computerrooms at the 
> university and I'm responsible for the print services. 
> 
> I manage a script to account each student for it's prints (they 
> pay in advance). The script is run as a cups backend, when the 
> caccounting is done if forwards the job to the lpr backend with the 
> correct printer. This all works very well, there is only one flaw: 
> lpr -U 
> 
> Linux and OSX users can change their username using the -U option 
> for lpr. I'm searching for a solution to this issue, as it makes it 
> really simple to print with someone else's username. 
> 
> The printjob mentions only one username (the username one logs in 
> with or the one provided with the -U option). So at first I thought 
> I could path the lpr source to mention an extra variable 
> REAL_USERNAME that contains the username the user logged in with. 
> 
> Are there better ways to do this or any other solutions/thoughts 
> that might help me? 

Not sure about the print accounting software you are using, but 
PyKota (http://www.pykota.com) features a client side add-on named 
PykotIcon allow the print server to ask additional information to 
the end user at print time. These additional informations can be 
anything, but a special feature allow to ask for an username and 
password which are checked on the print server side through PAM and 
if the check is successful, the username from the print job is 
overwritten which the username which was asked (and confirmed 
through PAM with the matching password). 

Without the PyKotIcon add-on, you can still overwrite the printjob's
username with any other value depending on any of the print job
characteristics with a simple shell script : for example you could
set the username based on the client's IP address, or anything
like that, or even replace the username with the IP address and
account on IP addresses instead of users, the sky is the limit...

Hoping this answers your question

bye

Jerome Alet