Re: [opensuse] Cups and Susefirewall don't work together, why ?

5 Apr 2014

      op 05-04-14 10:43, Togan Muftuoglu schreef:
...
...
...
...
...
...
"Koenraad" == Koenraad Lelong  writes:
Koenraad> Hi,
     Koenraad> I upgraded my desktop computer to OS13.1.
     Koenraad> I have a problem with SuSEfirewall2. My NIC is in the "External zone".
     Koenraad> To have available the printers of my CUPS-server I want to open the
     Koenraad> IPP-port of the firewall. This seems not to work.
     Koenraad> When I disable the firewall, I see the printers. When I enable the
     Koenraad> firewall, they disappear. For my that's a problem with the firewall.
Have you looked http://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings
Hi,

My desktop is in many cases a test-case to setup other computers.

I know it's a bit less secure when opening up those ports, but how do 
you distinguish between internal (trusted) and external (untrusted) zones ?
When I connect my laptop somehow (cable/wireless) to my home-network 
that network is trusted. When I say somehow it is because cables are not 
availbable everywhere in my house.
When I go "on the road" and connect my laptop (mostly wireless, but not 
always !), how do I specify that the network is now untrusted, as 
non-root user ? Network-manager _could_ do this by asking, but AFAIK 
it's not possible now.
As root-user I have to go to yast and set the right interface to the 
external zone. And I have to remember to do the opposite when I connect 
to a trusted network again. Etc. I can do this, but my wife ? When I 
explain it she could do this of course, but does she remember after a 
few weeks, when she takes her netbook to a conference ?

I work around this by losing a bit of security and using common sense, 
by not printing everywhere.

Remains the fact that susefirewall2 does not do what I tell it to do.

B.T.W. is CUPS so leaky that "opening its IPP port 631 removes 
effectively any firewall protection from the workstation" ? Which is 
what that web-page says. If so, I will reconsider and go the Windows-way 
: install every printer locally.

Thanks,

Koenraad.

-- 
To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org
To contact the owner, e-mail: opensuse+owner@opensuse.org