[arch-general] CUPS - 'DefaultEncryption Never' required to prevent cups 'Add Printer' hang - ssl for apache OK?

[David C. Rankin]

Guys,

   Cups has always been great, it either works or it doesn't. When it doesn't, 
it has been difficult to find good documentation to fix it. On Arch, I have 
run across an issue that seems simple, but I don't understand it enough to 
update the Arch wiki yet, so I'm looking for a bit of help.

   Symptoms:

Cups web interface (on network server - not localhost) can be accessed fine, 
user is a member of 'lp' with lppasswd set giving user admin rights in the 
cups password digest (md5).

SystemGroup lp sys root wheel

ServerName, ServerAdmin, ServerAlias, Port, Listen and 'Location /', 'Location 
/admin' and 'Location /admin/conf' all properly set. /etc/hosts is correct.

In the web interface clicking on "admin" then "Add Printer" returns the error: 
"426 Upgrade Required" meaning cups tried to switch to ssl for the Add Printer 
feature and something has failed leaving the cups process hung. 
'/etc/rc.d/cups stop' has no effect, 'pidof cupsd' and then 'kill <pid>' has 
no effect. The only way to kill the hung process is 'kill -9 <pid>'

The cups web interface can "Edit Configuration File', 'View Access Log', 'View 
Error Log', etc. all work just fine with no hang, but if you try and 'Add 
Printer' the cups process hangs.

The httpd-ssl.conf is correct as are the /etc/httpd/certs. All other pages on 
the site can be accessed via https, but cups hangs for some reason.

Googling, easily turns up a workaround for cupsd.conf:

DefaultEncryption Never

Which prevents cups from ever switching to ssl for configuration via the web 
interface but doesn't explain why it is needed. I would like to understand why 
this workaround is needed and add this information to the 
https://wiki.archlinux.org/index.php/Cups page, but I don't understand why 
cups is hanging.

 From the error log you have the entry:

Unable to set ACLs on root certificate "/var/run/cups/certs/0" - Operation not 
supported. That looks related to me.

Threads like:

https://bbs.archlinux.org/viewtopic.php?pid=756693
https://bbs.archlinux.org/viewtopic.php?id=85454

don't give any solutions - just more guessed at work-arounds.

Obviously, I'm not the only one bitten by this one:

https://bugs.archlinux.org/task/22895

but no solution or explanation there either.

Also, in all the arch bbs threads everybody says you have to use 'lp' as the 
SystemGroup -- why? Why not 'sys' or 'wheel' if you are already a member and 
you have proper entries in the cups password digest? It's just a group right? 
If it has to be used, then why isn't it the default?

If any cups expert can steer me straight on the SystemGroup requirement and 
why 'DefaultEncryption Never' is needed, I'm more than happy to write it up in 
the wiki. Anybody got an explanation or link I didn't find on these issues?


-- 
David C. Rankin, J.D.,P.E.