Subject: Re: Does Netatalk allow printer accounting ...

From: Edan Idzerda <[email-masked]>
Date: Mon, 23 Jun 1997 11:44:06 -0400 (EDT)

Mario Klebsch DG1AM allegedly said...
> >
> >  - to be able to do per-user printer accounting,
> 
> Since the netatalk afp server runs as a UNIX process under the
> identity of the user, it should work (without any configuration) if
 
Well, since apfd doesn't do printing, that's not necessarily true, is 
it?  I haven't seen anything in the papd documentation describing
how you can get the username from the connecting Mac.  Of course,
the whole 'pr=|lpr' wasn't in the docs, either.
 
I'm certain that netatalk can be used as *part* of a system that
does printer accounting, but I don't believe it can be done with
the packages that they've released to the public :)

> >  - to be able to do licence metering (on applications),
> >      (CAPS appears to be able to do this.  That is, to have
> >      applications installed on the server, but limited in usage by netatalk
> >      according to how many licences I tell it we have for each application.)
> 
> I don't know, hos this can be done. The users always can copy the
> files on their local disk and after cpying them, they are not busy
> anymore, on the server.
 
I don't know exactly how it works, either, but I know it can be done.
I can't remember if CAP denied people from copying the application
or if we used different software for that function.  (MacPrefect comes
to mind.)  So if you keep people from copying the application,
then it can be done, eh?
 
I'd be interested in how other sites are doing print accounting
using netatalk, with or without Kerberos.  The MacOS's lack of
a "logged in user" really bites in a multiuser environment.
(I know there are probably ways to do it but it doesn't SHIP with
it.)
 
- edan
 
--
Edan Idzerda    <[email-masked]>
System Administrator --  Michigan Technological University, Houghton MI

---

From: Stefan Bethke <[email-masked]>
Date: Mon, 23 Jun 1997 18:56:02 +0200

netatalk 1.4b2 (or any early version) can neither do print job accounting
nor file copy protection.

>the whole 'pr=|lpr' wasn't in the docs, either.

Print job accounting is not easy to achieve. Although the Printer Access
Protocol contains provisions for a "password", neither LaserWriter 7.x nor
8.x make any use of, nor do they provide any user authentication data.

Two workarounds are possible:
- use the Owners Name (as set in the Sharing Setup control panel), which is
included as the ADSC comment %%For: to authenticate the user. This requires
that users have set this name correctly; it is quite easy to circumvent
this mechanism if you are to use the accounting data for billing or other
"real" accounting.
- require the user to be logged in to the file server on the same machine,
then matching the AppleTalk address of the job's sender to aquire
authentication data from the afpd process. This would require that afpd
would write something equivalent to stmp and wtmp; a good idea anyway.

>From Inside AppleTalk, 2nd., pp. 13-20:
"The Macintosh Finder will not copy a file whose CopyProtect bit is set. An
attempt to copy the file using the FPCopyFile command will result in an
error."

However, the Finder will allow launching if the file is an application
(APPL or appe). Actually, the Finder only inhibits copying the file;
openening it always OK. And if you have some other utility, say DiskTop,
you can copy the app regardless.

What would have to be implemented in afpd would be
- setting the CopyProtect bit for a file;
- managing a counter which counts the number of times the file is currently
open, and a mechanism to store the maximum allowed for that file (so you
can launch the app only so often).

Regards,
Stefan

--
Stefan Bethke
Promo Datentechnik      |  Tel. +49-40-851744-0
+ Systemberatung GmbH   |  Fax. +49-40-851744-44
Eduardstrasse 46-48     |  e-mail: [email-masked]
D-20257 Hamburg         |  http://www.Promo.DE/

---

From: Miles Nordin <[email-masked]>
Date: Mon, 23 Jun 1997 19:59:51 -0400 (EDT)

my email tends to piss people off, so please send hatemail to me directly
at [email-masked].  thanks.

> nor file copy protection.

Perhaps what you need to do is stop expecting netatalk to solve all your
problems for you.  Printer accouting and license managing are common
legitimate goals that have been solved and re-solved many times at many
Mac-centric Universities, with varying degrees of success.  A diverse
network requires diverse solutions.

While I don't know much about these things myself, I can give you some
places to start that will probably lead to your eventually solving your
problem.  If, however, your goal is to hammer craig and make him do more
work, work specific to the needs of your institution, don't bother reading
the rest of this message because none of my ideas are Netatalk-specific. 

"well, CAP can ......"  fine, go use CAP.

I believe the fascist sysadmins at Penn State have devised a way to
accomplish both of these goals.  Their license-accounting thing is done
with a control panel whose name i forget--it looks like a "key" though. 
It is a fairly common program that I've seen at many universities.  If you
can't find it I can probably track down the name for you in a few
days--please post a followup if you discover where someone can buy this
program. Anyway this is how it works:  You specify a keyserver, which i
think is another Mac.  Before deploying your applications on the net
share, you mangle them using a resedit-ish mechanism to merge a bit of
startup code into each app binary. This startup code does license
management.  If you copy the binary to a local disk, it still contains the
startup code and thus still is license-protected.  To defeat the mechanism
you would have to use resedit to remove their code, which may well be
trivial to the experienced KeyServer hacker but not to the average user. 
I believe Haverford College and several other universities also use this
program in their labs.  I believe it is a commercial program. 

It is, however, a well-written commercial program, unlike stopgap hacks
like MacPrefect that cause more trouble to legitimate users than they're
worth.  MacPrefect in my experience tends to encourage sysadmins to enact
fascist restrictive policies that encumber the most benign unforseen uses
and problem diagnosis, and any power user who isn't too stupid to live can
disable it within fifteen minutes, even if he's never seen it before.  the
key-server license manager works very smoothly, and is a very targeted
solution that does not interfere with things besides license management.
It is also harder to disable than MacPrefect, if you happen to be one of
these hatchet-weilding evil power-freak sysadmins who cares about having
your work trampled and reverse-engineered.

Penn State has written custom in-house code to do printer accounting. 
Their scheme is a shameless hack, using server code that runs on Windows
NT, and all jobs are eventually funneled through a Mac SE before going to
the printer.  Ugly, _but_ it works, reliably.  I don't know if you would
want to use it, because of the icky WinNT dependency and the unpolished
nature of the product--you would probably have to do some of your own
coding to get it working, and in my experience most sysadmins are too
stupid or too lazy to write their own code (myself included).  Also I do
not know if they would release it.  because the people at Penn State are
assholes who do not believe in the concept that universities should be
collaborative institutions striving to attain more knowledge and resources
for the whole world--rather they view themselves as an independent
nationalistic entity that has to protect their own "security" above all
else, and prevent outsiders from draining their precious state-funded
resources, which are meant to be applied to the churning out of identical
alcoholic imbecilic graduates ready to enter the work force and submit to
piss tests and do exactly what they're told, rather than to the attainment
of greater general knowledge and accomplishment for the betterment of
society.

Also, Penn State is the sort of place that would try to preserve the
security of their system by hiding source code and protocol information,
relying on the limitations of their attackers' intelligence rather than
the inherent security of their system.  Naturally this sort of strategy
does not work at places like MIT, CMU, Berkeley, u.s.w., but at a
decidedly mediocre institution like Penn State it makes sense.

The Penn State system works by using an init that forces users to login
with a Kerberos userid and password at system startup.  Kerberos is used
for authentication only, and the TGT is not retained throughout the
session.  When you shut down the Mac, the NT machine is somehow informed
of this logout.  Note that the TGT is _not_ retained throughout the
session, and is _not_ used for any subsequent authentication.  The mac
merely checks in with the NT server at login and logout, and the NT server
keeps track of who is where.  This defeats the beauty of Kerberos, but it
permits the system to function without any mods or patches to MacOS (or
the freeware mac utilites that I am about to discuss).

Print jobs are spooled using a drag-and-drop lpr client for the Mac, and
sent to a UNIX machine.  This means the user has to print-to-file, grab
the Postscript file, and drag it onto the "print me" icon.  This sounds
difficult, but believe it or not the drooling drunken idiots at Penn State
have no problem with this procedure.  netatalk could intervene at this
stage to make things simpler.  In their system, the drag-and-drop lpr
client does no accounting or authentication--it merely pushes the files
onto the UNIX server--so netatalk wouldn't need to do PAP authentication
either.  papd would, however, have to establish a clear and foolproof
notion of which Mac was making the request, and since PAP does not run
over IP, it would be hard to match papd's idea of identity with the idea
held by the Kerberos-based login tracker.

Once the jobs are on the UNIX machine, the UNIX machine queries the NT
machine to see who is logged in at that perticular Mac, and uses
that username to do the accounting.  The job is accepted or denied based
on the status of the user's account, and the user gets an account-balance
summary on the banner page. 

The nice thing about the Penn State system is that they can use it for
both their PC's and their Mac's.  The non-reusable pieces are only the
custom Kerberos app and the freeware lpr client.

Write to:
  John Kalbach <[email-masked]>

tell him Miles Nordin sent you, and that you're trying to get ahold of the
guy who wrote the printing accounting software for the public
microcomputer labs.  John Kalbach did not write it himself, but he will
know who did.  He is very busy, and unlike most of Penn State he is (at
least superficially, as far as I know him) a competent and free-thinking
individual, so please be polite and generally more respectful than I am.

or, browse the web pages starting at http://cac.psu.edu/.  You may be able
to find a link to the author's page that way.

Better yet, write to the guys at Stanford University.  I believe they have
a far superior accounting mechanism, and they are not assholes like the
people at Penn State so you are more likely to get a helpful response from
them.  Unfortunately I know less about their system because I never
attended there--just have a friend who does.

--
Miles Nordin                          home  1-888-857-2723
555 Bryant Street #182                 or  +1 510 608-1813
Palo Alto, CA 94301                   http://www.ivy.net/~carton

---

From: Edan Idzerda <[email-masked]>
Date: Tue, 24 Jun 1997 14:57:16 -0400 (EDT)

> nor file copy protection.

Though, I personally wouldn't want netatalk to do print job accounting
or page counting (well, if it was there...) but I would like to have
the ability to *pretend* that I know which user was printing.

> 8.x make any use of, nor do they provide any user authentication data.

No kidding, especially if you'd really like to hold people responsible
for pages printed.  And while we're vaguely on the subject, has anyone
gotten any other printer driver besides LaserWriter 8 to print to a
netatalk 1.4b2 papd running under Solaris 2.5?

I think the workaround you mentioned concerning afpd 
writing a utmp/wtmp is a good idea in general, as well.
 
I did some research into a platform-independent print accounting system
and came close to what I wanted, but not quite.  We're currently using
a system called Jake, from Columbia University.  I had to make some
changes in order to get it to run under Solaris 2, and I've made a
number of other changes.  But you can get the original distribution 
and more information from:

	http://www.columbia.edu/~denmark/resnet96/

Jake requires using an access terminal for each of your limited-access
queues.  The user selects their job from a menu and then they 
authenticate themselves on the spot.  It's just about the only
system that really reduces your security down to the security of their
password.  As long as you only have jobs going to a single queue,
you can get pretty darn reliable page counts.

I also looked at 

	http://www.maclaser.com/
	http://deathstar.stanford.edu/macauth.html
	http://info.utas.edu.au/docs/utas/utas88/Cost.Recovery.html
	http://tarzan.trincoll.edu/printing/pprfaq.html

The Stanford one was one of my favorites, but it was essentially Mac
only (and cost money).  Hope this saves somebody some beating on
a search engine.

- edan

---

From: [email-masked]
Date: Tue, 24 Jun 1997 16:06:07 -0400

> From:    Stefan Bethke <[email-masked]>
> To:      Edan Idzerda <[email-masked]>, [email-masked]

> nor file copy protection.

The latter is true, the former is not.  You just have to know how to
set it up, which requires a lot of lpd and psf/pap/psa knowledge.  As a
matter of fact, "psa" stands for "PostScript Accounting".  I'm sure
I've mentioned this on this mailing list.  It's not in the man pages,
tho.

:wes

---

From: [email-masked]
Date: Tue, 24 Jun 1997 16:10:06 -0400

> From:    Edan Idzerda <[email-masked]>
> To:      [email-masked] (Stefan Bethke)

> netatalk 1.4b2 papd running under Solaris 2.5?

I don't have old LaserWriter drivers sitting around to try.  And I
don't think our printing solution is currently working on the latest
LaserWriter driver.  That said, we have an Extension that traps the
PAPOpen call to PDEF 10 and inserts a kerberized login sequence into
the PAP stream.

:wes

---

From: Stefan Bethke <[email-masked]>
Date: Wed, 25 Jun 1997 12:28:48 +0200

At 22:10 Uhr +0200 24.06.1997, [email-masked] wrote:
>That said, we have an Extension that traps the

Would you mind to make that INIT, minus Kerberos code, availible? Maybe
some kind sould could make a compatible extension from outside the U.S.

Stefan

---

From: Stefan Bethke <[email-masked]>
Date: Wed, 25 Jun 1997 12:24:34 +0200

>I've mentioned this on this mailing list.  It's not in the man pages,

Sorry, yes, I didn't notice psa. Still neither papd not psf know who has
submitted the job, so if you want to hold someone responsible, this ain't
no solution, I would think.

Stefan

---

From: Dejan Ilic <[email-masked]>
Date: Wed, 25 Jun 1997 13:22:09 +0200 (MET DST)

> no solution, I would think.

Sorry for a little offtopic question but I have a urgent need need of
printer accounting. Is thet any commercial package that does is a) as a
separate product or b) as a part of a full system.

What Commecial system is the cheapest one the also does
printer-accounting ?

=====================================================================
Dejan Ilic, Tech Univ. of Linkoping, Sweden   Phone: +46-13-473 01 06
Email: [email-masked]   Web: http://www.lysator.liu.se/~svedja

"I may look like The Devil but i'm an angel deep down in my heart"
=====================================================================
[finger -l [email-masked] for public PGP key]

---

From: Stefan Bethke <[email-masked]>
Date: Wed, 25 Jun 1997 14:10:26 +0200

>separate product or b) as a part of a full system.

To the best of my knowledge, there are three genuine AFP/PAP products for Unix:
- Helios EtherShare, http://www.helios.com/
- IPT uShare, http://www.ipt.com/
- XiNet KAShare, http://www.xinet.com/

I don't know much about uShare and KAShare (well, I happen to work for the
German Helios distributor), but EtherShare has an accounting facilitly,
logging the number of pages that have been printed (if the printer dos
support it!), the size of the job, and some other details. Additionally,
EtherShare can be configured to only accept jobs if the Mac sending the job
also has an active AFP session to that server. The log then also contains
the username the AFP session is authenticated as.

Hope this helps,
Stefan

---

From: Dr Eberhard W Lisse <[email-masked]>
Date: Sun, 29 Jun 1997 22:49:55 +0100

Hi,

I run the 1.4b2 on linux 2.0.30 with a Dec Tulip card and
have a LaserWriter Select 310 with the proper PPD
installed.

/usr/local/atalk/etc nbplkup @*
                          linux:AFPServer                          65280.108:130
            Mac Printer Spooler:LaserWriter                        65280.108:128
                          linux:netatalk                           65280.108:4
                          linux:Workstation                        65280.108:4
                            mac:  Macintosh                        65325.1:253
                            mac:Workstation                        65325.1:4

/usr/local/atalk/etc papstatus -p "Mac Printer Spooler"
lp is ready and printing

I can not see the printer from the Chooser of my LCIII.
I can however mount the file system.

Is there something that I can do to be able to choose the
LaserWriter?

el

-- 
Dr. Eberhard W. Lisse\         /              Swakopmund State Hospital
<[email-masked]>         *        |               Resident Medical Officer
Private Bag 5004       \      / +264 81 124 6733 (cell) 64 461005(h) 461004(f)
Swakopmund, Namibia     ;____/ Domain Coordinator for NA-DOM (el108)
Vice-Chairman, Board of Trustees, Namibian Internet Development Foundation,
an Association not for Gain. NAMIDEF is the Namibian Internet Service Provider.

---

From: Patrik Schindler <[email-masked]>
Date: Mon, 30 Jun 1997 10:37:08 +0200 (MET DST)

> I can however mount the file system.

I cannot see the LaserWriter in your nbplkup, too. What type of 
connection does it have?

PoC

---

From: Dr Eberhard W Lisse <[email-masked]>
Date: Mon, 30 Jun 1997 20:09:36 +0100

>I cannot see the LaserWriter in your nbplkup, too. What type of 

Patrik,

it is connected to the linux box at the parallel port and working.

Here is my papd.conf:

Mac Printer Spooler:\
        :pr=lp:\
        :pd=/usr/local/atalk/etc/laserwriter-select-310.pdf:\
        op=el:

Here is the output of nbplkup @*

                          linux:AFPServer                          65280.108:130
            Mac Printer Spooler:LaserWriter                        65280.108:128
                          linux:netatalk                           65280.108:4
                          linux:Workstation                        65280.108:4
                            mac:  Macintosh                        65496.1:253
                            mac:Workstation                        65496.1:4

If you want to take this off the list we can continue this in
German...

el

---

From: Edan Idzerda <[email-masked]>
Date: Tue, 1 Jul 1997 01:11:18 -0400 (EDT)

> it is connected to the linux box at the parallel port and working.
 [ snip ] 
>         :pd=/usr/local/atalk/etc/laserwriter-select-310.pdf:\

I use LPRng with Solaris 2.5, so my experience has almost no
bearing with yours, BUT--I've only ever been able to get
netatalk to print using

	:pr=|/path/to/my/lpr -Pprinter:

For what it's worth.
 
> If you want to take this off the list we can continue this in

We can take it off the list, if you like, but, nine ech da lictenstein
und da veinerschtizel. Stupech Merkin no spich unie German.  Gahnow?

- edan

--
Edan Idzerda	<[email-masked]>
System Administrator --  Michigan Technological University, Houghton MI USA