The printers that are managed by the Research Computing Group are, with few exceptions, blocked from direct printing. Printers like to advertise their presence on the network with various broadcast protocols that your computer might recognize. However, if you attempt to print to them, your printing will, in general, fail. Because printers consume real resources that cost money, we like to keep track of who prints how much. For that reason, we use print servers. Only the print servers are allowed to print directly to printers, and users must print via the print servers.
RCG PRINT SERVER IN SFU CLOUD
This new RCG CUPS and samba server was set up in the fall of 2019:
This is a VM running Red Hat Enterprise Linux 7, and it exists within a VMware NSX environment known as “SFU Cloud”, physically located in the Water Tower Data Centre at SFU Burnaby.
OLD RCG PRINT SERVER
This old RCG CUPS and Samba server was retired on July 17th, 2020, and it will not be coming back:
This VM was running the very old CentOS 6 Linux. It existed on a KVM hypervisor located in SFU Burnaby’s TASC 2 server room which suffered a power distribution meltdown on the night of July 16th, 2020.
WHAT IS CUPS?
CUPS is the “Common Unix Printing System”, used by most Linux distributions and Mac OS X. This is what queues the print jobs on rcga-bluebell.dc.sfu.ca and sends them to the printers. It also keeps track of who prints how many pages.
If you want to see what printers are available and what their status is, point your web browser here:
https://rcga-bluebell.dc.sfu.ca:8008/printers/
Note that for security reasons, this URL will only work on-campus and not remotely.
If you get a certificate warning, you should download and install the RCG CA Certificate. For details, please see our SSL documentation.
If you want to see what print jobs are sitting in the queue, point your web browser here:
https://rcga-bluebell.dc.sfu.ca:8008/jobs/
If you want to cancel your print job, you need to log-in using your campus computing account name and password.
WHAT IS SAMBA?
Samba is used to re-share the CUPS printers to Windows computers. Windows computers print to samba printer shares on:
- \\rcga-bluebell.dc.sfu.ca\
and then samba sends the print job into the corresponding CUPS queue. To check the status of your print job, or to cancel it, use the aforementioned URLs.
NOTE: On the new rcga-bluebell.dc.sfu.ca server, the CUPS queues names used by samba are suffixed with “-raw”. For example, if a windows user prints to \\rcga-bluebell.dc.sfu.ca\cmpt-faculty, samba sends the job to the cmpt-faculty-raw CUPS queue. This is because the non-raw CUPS queues use postscript drivers, whereas the samba printers use PCL drivers, and they are incompatible with each other.
SFU_PRINT
SFU_Print is a service used to print to the Ricoh multi-function devices located in various places across the campus. This talks to a Windows PaperCut server which is independent from the RCG Print servers. Print jobs sent to SFU_Print bypass the RCG CUPS and Samba servers.
PRINTING FROM LINUX TO CUPS PRINT QUEUES
In versions of Linux that run older versions of CUPS such as CentOS 5 (CUPS 1.3) and CentOS 6 (CUPS 1.4) we use “BrowsePoll” to automatically get a list of all the printers on the RCG CUPS servers.
Unfortunately, the developers of CUPS, in their misguided zealotry, decided to drop “BrowsePoll” in CUPS 1.6 and above. This includes newer Linux versions such as CentOS 7. Fortunately, good people in the open source community developed “cups-browsed” which has similar functionality, and we use that on CentOS 7 and above to automatically populate the list of printers.
To see what printers are available, just type:
lpstat -a
You should see a list of all the CUPS printers on rcga-blubell.dc.sfu.ca, depending on how the Linux computer has been configured.
To print a pdf file such as “filename.pdf”, to a printer such as “cmpt-faculty” on the Linux command-line, then type:
lp -d cmpt-faculty filename.pdf
And to check the status of your print job, point your web browser to:
https://rcga-bluebell.dc.sfu.ca:8008/printers/cmpt-faculty
If you want to cancel your job, just hit the “Cancel Job” button. You’ll be prompted to authenticate. Use your campus computing account name and password.
If you’re using the GUI on a Linux Workstation, the “Print” menu of the applications should see the same list of printers as lpstat -a.
PRINTING FROM LINUX TO SFU_PRINT
You can print to SFU_Print from the command-line of the RCG Linux terminal server rcga-linux-ts1.dc.sfu.ca in SFU Cloud. (See RCG Linux Terminal Server in SFU Cloud for more details about this server.)
If you type:
lpstat -a
you’ll see a list of all the CUPS printers on rcga-bluebell.dc.sfu.ca, and additionally you’ll see extras like these:
SFU_Print accepting requests since Fri 31 Jan 2020 03:22:02 PM PST
SFU_Print-colour accepting requests since Wed 29 Jan 2020 10:49:17 PM PST
SFU_Print-colour-single accepting requests since Wed 29 Jan 2020 10:58:47 PM PST
SFU_Print-single accepting requests since Wed 29 Jan 2020 10:45:23 PM PST
These four SFU_Print queues serve the following purposes:
| SFU_Print queue |
Purpose |
| SFU_Print |
black&white 2-sided printing |
| SFU_Print-single |
black&white 1-sided printing |
| SFU_Print-colour |
colour 2-sided printing |
| SFU_Print-colour-single |
colour 1-sided printing |
To print a pdf file, say, “filename.pdf” to, say, SFU_Print-colour, just type the following:
lp -d SFU_Print-colour filename.pdf
This will work only if you have a valid Kerberos Ticket. If you log into rcga-linux-ts1.dc.sfu.ca using your password, you’ll automatically get a Kerberos Ticket upon login. However, if you use SSH public/private key exchange to log in without a password, that’ll bypass Kerberos Ticket creation and you’ll have to get one manually by typing:
kinit
For more information about Kerberos, please see our Kerberos FAQ for Linux Workstation Users.
If you type:
lpstat -o
and you still see your job listed, as in:
SFU_Print-colour-42 username 302080 Thu 06 Feb 2020 04:09:44 PM PST
that means that your print job did not make it to SFU_Print, probably because you didn’t have a valid Kerberos Ticket. You’ll need to cancel the stuck print job, using the cancel command, as in:
cancel SFU_Print-colour-42
and then kinit to get a Kerberos Ticket, and then try printing again.
Please note that, by default, Kerberos Tickets expire after 10 hours. If you want, you can set up a cron job to auto-renew your Kerberos Tickets. For details on this, please see Q #21: Help! I run long-term processes on my Linux Workstation and Kerberos is locking my home directory!.
However, this will only work for a maximum of one week. If you want Kerberos to work indefinitely without having to manually kinit, you can set up your own private keytab file. For details on this, please see Q #22: The answer to Q #21 isn’t good enough! I need my processes to run unattended for weeks!.
(For those of you who dont like the Unix System V print commands lp, lpstat, cancel, etc, the old Berkeley Unix print commands lpr, lpq, lprm, etc, are also available.)
PAPERCUT
PaperCut is the software that looks after page accounting for the SFU_Print system on campus. If you are using a Managed Desktop on campus, be it Linux, Mac, or Windows, it may be running a PaperCut Client App for SFU_Print. Here’s what it looks like on a Linux GNOME desktop:
You don’t need to run the PaperCut Client App when printing to SFU_Print from the command-line of rcga-linux-ts1.dc.sfu.ca with Kerberos authentication. Printing will work fine without it.
However, if the PaperCut Client App is running when you print from the command-line of rcga-linux-ts1.dc.sfu.ca to SFU_Print with Kerberos authentication, then a PaperCut window will pop-up with a notification that your print job is waiting for you to release it. Here’s what it looks like on a Linux GNOME desktop:
If you see this window, that means your print job was successful, and that all you have to do is go to the printer and tap your key fob to the sensor in order to release your printing. If you don’t have a key fob, you can type in your Campus username and password on the printer’s LCD screen.
Note that you don’t need to have the PaperCut Client running on the computer from which you print to SFU_Print. For example, you can print to SFU_Print from the command-line of rcga-linux-ts1.dc.sfu.ca, which you ssh’d into from a Macintosh Desktop, and if the PaperCut Client App is running on your Mac the notification window will pop up there. (And if you are logged into more than one desktop computer with PaperCut Client Apps running, then PaperCut appears to choose at random which one to notify. It doesn’t notify more than one.)
PRINTING FROM MAC OS X
Mac OS X 10.6 (Snow Leopard) and below came installed with CUPS 1.4 and below. This meant that printing worked much the same as on Linux.
Newer versions of Mac OS X come installed with newer versions of CUPS for which “BrowsePoll” has been dropped. Unfortunately, Apple doesn’t have the open source “cups-browsed” option that Linux has. Apple’s focus in recent years has been to make things easier for home users who print directly to their printers, at the expense of enterprise-level systems administrators who want their users to print via a print server. Thanks, Apple! :-(
This means that printers need to be manually managed on newer versions of Mac OS X. If you’re a do-it-yourselfer, here’s how:
1. Don’t use Apple’s Print GUI to add printers! You’ll see a list of printers on the network broadcasting their names via “Bonjour”. If you try to add one of these printers, they won’t work! You need to use the print server.
2. Point your web browser to https://rcga-bluebell.dc.sfu.ca:8008/printers/ in order to see what printers are available. Pick out a printer that you want to add. For illustration, suppose it is the “ensc1” printer, which is an HP LaserJet P3015 in ASB 9819.
- Assuming you have admin access to your Mac, open a Terminal and type the following:
sudo /usr/sbin/lpadmin -p ensc1 -v ipp://rcga-bluebell.dc.sfu.ca/printers/ensc1 -D "ensc1: HP LaserJet P3015 in ASB 9819" -L "ASB 9819" -E
The ensc1 printer will now be available for printing to.
(The “-v” string and the ‘-E’ are important. You can use whatever you want for the “-D” and “-L” strings. See man lpadmin for more details.)
NOTE 1: The printer shows up on the command-line as what you named it in the “-p” option. However, in the Mac OS X GUI, the printer shows up as what you gave in the “-D” option. Therefore it is a good idea to prefix the “-D” description string with the “-p” printer name so as to avoid confusion. In the above example, the “-p” printer name is “ensc1”, and it will show up in the Mac GUI as “ensc1: HP LaserJet P3015 in ASB 9819”.
NOTE 2: The aforementioned method adds the printer without a local .ppd file. In the past, this worked fine because all the information contained in the .ppd file comes from the CUPS server. These days, however, some software (notoriously Adobe software) won’t print without a local ``.ppd`` file! In this case you need to setup the printer with a local .ppd file like this:
sudo /usr/sbin/lpadmin -p ensc1 -v ipp://rcga-bluebell.dc.sfu.ca/printers/ensc1 -m "/Library/Printers/PPDs/Contents/Resources/HP LaserJet P3010 Series.gz" -D "ensc1: HP LaserJet P3015 in ASB 9819" -L "ASB 9819" -E
(This is assuming, of course, that you’ve installed the HPPrinterDrivers package on your Mac.)
Alternatively, you can ask us in the Research Computing Group to run script to add all the printers in your department/group/school.
Once you’ve printed a job to, say, the ensc1 printer via the Mac GUI, you can check its status by pointing your web browser to:
https://rcga-bluebell.dc.sfu.ca:8008/printers/ensc1
If you want to cancel your job, just hit the “Cancel Job” button. You’ll be prompted to authenticate. Use your campus computing account name and password.
If, at some point, a printer becomes obsolete and is removed from the rcga-bluebell.dc.sfu.ca print server, you’ll need to manually remove it from your Mac. Here’s how, assuming that the dead printer you want to get rid of is “ensc1”:
sudo /usr/sbin/lpadmin -x ensc1
PRINTING FROM WINDOWS
The Windows printer shares come from \\rcga-bluebell.dc.sfu.ca\.
Your department/group/school might have a Windows Group Policy Object in Active Directory that automatically deploys printer shares from our Samba server, in which case the printers automagically appear when you log-in.
If you need to manually add a printer, here’s how:
- Open up “Devices & Printers” in the Windows Control Panel.
- Hit “Add a printer”.
3. The computer will start scanning for printers. Don’t bother waiting! Just hit “The printer that I want isn’t listed”. This will bring up the “Add Printer” dialog box.
4. Hit “Select a shared printer by name”, and type \\rcga-bluebell.dc.sfu.ca\ into the field, but don’t hit “Enter” yet. Just wait long enough, and eventually a drop-down menu will appear showing all the Samba print shares on rcga-bluebell.dc.sfu.ca. Select the printer you want and then hit “Next”. For illustration, suppose it is the “cmpt-t9201” printer.
5. The first time you do this, the printer driver will be downloaded from rcga-bluebell.dc.sfu.ca. (For “cmpt-t9201”, it is “HP Universal Printing PCL6”, version 6.8.0.24296.) You will need admin access to install the driver. (One advantage of using a Group Policy Object is that the drivers are automatically downloaded and installed without requiring admin access.)
The cmpt-t9201 printer will now be available in the Windows GUI for printing to. Unless the driver install failed. This might happen if you’re using a laptop that hasn’t been joined to the ADSFU domain, because by default Windows 10 comes with “Point and Print Restrictions” that block print drivers from being installed. If you want to fix this, open a Command Prompt on your Windows computer and type:
gpedit
This will bring up the Local Group Policy Editor. Then go to:
Computer Configuration:Administrative Templates:Printers
to find the “Point and Print Restrictions” policy and disable it. (Or at least open it up to our Samba server rcga-bluebell.dc.sfu.ca.)
For good measure, you should also disable the “Always render print jobs on server” policy as well. The Samba server doesn’t render print jobs.
Once you’ve printed a job to the cmpt-t9201 printer via the Windows GUI, you can check its status by pointing your web browser to:
https://rcga-bluebell.dc.sfu.ca:8008/printers/cmpt-t9201
If you want to cancel your job, just hit the “Cancel Job” button. You’ll be prompted to authenticate. Use your campus computing account name and password.
PRINTER ACCESS CONTROL
There are two types of access control that we use for printers: host and user.
As mentioned above, the printers that are managed by us are, in general, blocked from direct printing. In other words, only a small set of hosts (namely, the print servers and other administrative servers) are allowed to access the printers via the network.
Additionally, rcga-bluebell.dc.sfu.ca is able to restrict specific printers to specific user groups (or SFU maillists). If you are a Lab Administrator and want your Lab Printer restricted to members of your Lab, please let us know at research-support@sfu.ca, and we will be happy to set this up for you.
SFU_Print has its own access control system that is independent from the Research Computing Group. Contact its-papercut-help@sfu.ca for more information.
PRINTER ACCOUNTING
The rcga-bluebell.dc.sfu.ca print server logs all print jobs, and once per month an accounting summary for each printer is automatically e-mailed to corresponding Lab Administrators and/or Departmental Administrators.
Additionally, some printers have a per-user page quota in order to restrict overuse. If you are a Lab Administrator and want your Lab Printer to have quotas, please let us know at research-support@sfu.ca, and we will be happy to set this up for you.