X-Git-Url: http://andersk.mit.edu/gitweb/moira.git/blobdiff_plain/5647f1574975929b939aa9e9738c1e571afdb6ba..954559400f01001e89fc58ec03d8d5e85066b74b:/gen/print.pc

diff --git a/gen/print.pc b/gen/print.pc
index 71d24ba4..6399b6fc 100644
--- a/gen/print.pc
+++ b/gen/print.pc
@@ -160,10 +160,11 @@ void do_host(char *host)
   fprintf(out, "ACCEPT SERVICE=X,S,Q,P\nACCEPT LPC=status,lpq,printcap\n\n");
 
   fprintf(out, "# Only trust certain host keys to forward jobs/commands\n");
-  fprintf(out, "REJECT AUTHFROM=?* PRINTER=</var/spool/printer/queues.secure "
-	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow\n");
-  fprintf(out, "REJECT AUTHFROM=?* AUTHJOB "
-	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow\n\n");
+  fprintf(out, "REJECT SERVICE=R AUTHFROM=?* "
+	  "PRINTER=</var/spool/printer/queues.secure "
+	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD\n");
+  fprintf(out, "REJECT SERVICE=R AUTHFROM=?* AUTHJOB "
+	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD\n\n");
 
   fprintf(out, "# Allow root to control and remove jobs\n");
   fprintf(out, "ACCEPT SERVICE=C,R SERVER REMOTEUSER=root\n\n");
@@ -212,13 +213,15 @@ void do_host(char *host)
   EXEC SQL CLOSE csr_ac;
   fprintf(out, "\n");
 
+  fprintf(out, "# Allow us to lock out users\n");
+  fprintf(out, "REJECT SERVICE=R USER=</var/spool/printer/users.deny\n");
   fprintf(out, "# Accept authenticated jobs to all other printers\n");
   fprintf(out, "ACCEPT SERVICE=R AUTH=USER,FWD\n");
   fprintf(out, "# Allow authenticated users to lprm their jobs\n");
   fprintf(out, "ACCEPT SERVICE=M AUTH=USER,FWD AUTHJOB AUTHSAMEUSER\n\n");
 
   fprintf(out, "# Reject unauthentic print/lprm requests to authenticated queues\n");
-  fprintf(out, "REJECT SERVICE=R,M "
+  fprintf(out, "REJECT SERVICE=R,M NOT AUTH "
 	  "PRINTER=</var/spool/printer/queues.secure\n\n");
 
   fprintf(out, "# Reject unauthentic print requests from off MITnet\n");
@@ -229,7 +232,7 @@ void do_host(char *host)
   
   fprintf(out, "# Reject any other lpc, or lprm. Accept all else\n");
   fprintf(out, "REJECT SERVICE=C,M\n");
-  fprintf(out, "DEFAULT ACCEPT");
+  fprintf(out, "DEFAULT ACCEPT\n");
   tarfile_end(tf);
 
   /* list of kerberized queues */