Configuring Labeled Printing (Task Map)

The following task map describes common configuration procedures that are related to labeled printing.

How to Configure a Multilevel Print Server and Its Printers

Printers that are connected to a Trusted Extensions print server print labels on body pages, banner pages, and trailer pages. Such printers can print jobs within the label range of the print server. If the printer is shared, any Trusted Extensions host that can reach the print server can use the shared printer.

Before You Begin

You must be in the System Administrator role in the global zone on this print server.

1. Determine the printer make and model.

   # lpinfo -m | grep printer-manufacturer

   For example, the following syntax finds all the Xerox printers:

   # lpinfo -m | grep Xerox
   gutenprint.5.2://xerox-able_1406/expert Xerox Able 1406 - CUPS+Gutenprint v5.2.4
   gutenprint.5.2://xerox-able_1406/simple Xerox Able 1406 - CUPS+Gutenprint v5.2.4 ...
   gutenprint.5.2://xerox-dc_400/expert Xerox Document Centre 400 - ...
   gutenprint.5.2://xerox-dc_400/simple Xerox Document Centre 400 - ...
   gutenprint.5.2://xerox-dp_4508/expert Xerox DocuPrint 4508 - ...
   gutenprint.5.2://xerox-dp_4508/simple Xerox DocuPrint 4508 - ...
   ...

2. Define the characteristics of every connected printer.

   # lpadmin -p printer-name -E -v socket://printer-IP-address -m printer-make-and-model
   -

   The -E option allows the named printers to accept a queue of printing requests. It also activates or enables the printers.

3. To create a network printer, share the printer.

   # lpadmin -p printer-name -o printer-is-shared=true

   To prevent the printer from being used by other systems, skip this step.

4. Display the printer defaults.

   # lpoptions -p printer-name

5. Adjust the defaults.

   For example, you could print double-sided and two-up.

   ---

   Tip - You can use the CUPS web interface to configure the printer, Home - CUPS version-number.

   ---

6. Configure each printer that is connected to the print server with a labeled banner and trailer page.

   # lpadmin -p printer-name -o job-sheets=labeled

   If the default printer label range of ADMIN_LOW to ADMIN_HIGH is acceptable for every printer, then your label configuration is done.

7. In every labeled zone where printing is allowed, configure the printer.

   Use the all-zones IP address for the global zone as the print server.

   1. Log in as root to the zone console of the labeled zone.

      # zlogin -C labeled-zone

   2. Add the printer.

      # lpadmin -p zone-printer-name -E \
      -v ipp://global-zone-IP-address/printers/printer-name-in-global-zone

   3. (Optional) Set the printer as the default.

      # lpadmin -d zone-printer-name

8. In every labeled zone, test the printer.

   As root and as a regular user, perform the following steps:

   1. Print text and PostScript files from the command line.

      # lp /etc/motd ~/PostScriptTest.ps
      % lp $HOME/file1.txt $HOME/PublicTest.ps

   2. Print files from your applications, such as mail, Oracle OpenOffice, Adobe Reader, and your browser.
   3. Verify that banner pages, trailer pages, and body page labels print correctly.

See Also

• Limit printer label range – How to Configure a Restricted Label Range for a Printer

• Prevent labeled output – Reducing Printing Restrictions in Trusted Extensions (Task Map)

• Use this zone as a print server – How to Enable a Trusted Extensions Client to Access a Printer

How to Configure a Network Printer

When a printer is shared, any Trusted Extensions host that can reach the print server can use the shared printer.

Before You Begin

You must be in the System Administrator role in the global zone on this print server.

1. Define the characteristics of your network printer.

   Follow Step 1 through Step 6 in How to Configure a Multilevel Print Server and Its Printers to configure your network printer.

   After the printer is shared in Step 3, all systems on the network that can reach this print server can print to this printer.

2. Test the network printer.

   As root and as a regular user, perform the following steps from systems that use this print server:

   1. Print text and PostScript files from the command line.

      # lp /etc/motd ~/PostScriptTest.ps
      % lp $HOME/file1.txt $HOME/PublicTest.ps

   2. Print files from your applications, such as mail, Oracle OpenOffice, Adobe Reader, and your browser.
   3. Verify that banner pages, trailer pages, and body page labels print correctly.

See Also

• Limit printer label range – How to Configure a Restricted Label Range for a Printer

• Prevent labeled output – Reducing Printing Restrictions in Trusted Extensions (Task Map)

How to Configure a Zone as a Single-Level Print Server

Before You Begin

The zone must not be sharing an IP address with the global zone. You must be in the System Administrator role in the global zone.

1. Add a workspace.

   For details, see How to Add a Workspace at Your Minimum Label in Trusted Extensions User’s Guide.

2. Change the label of the new workspace to the label of the zone that will be the print server for that label.

   For details, see How to Change the Label of a Workspace in Trusted Extensions User’s Guide.

3. Define the characteristics of every connected printer.

   Follow Step 1 through Step 6 in How to Configure a Multilevel Print Server and Its Printers to configure your zone printer.

   The attached printers can print jobs only at the label of the zone.

4. Test the printer.

   ---

   Note - For security reasons, files with an administrative label, ADMIN_HIGH or ADMIN_LOW, print ADMIN_HIGH on the body of the printout. The banner and trailer pages are labeled with the highest label and compartments in the label_encodings file.

   ---

   As root and as a regular user, perform the following steps:

   1. Print text and PostScript files from the command line.

      # lp /etc/motd ~/PostScriptTest.ps
      % lp $HOME/file1.txt $HOME/PublicTest.ps

   2. Print files from your applications, such as mail, Oracle OpenOffice, Adobe Reader, and your browser.
   3. Verify that banner pages, trailer pages, and body page labels print correctly.

See Also

• Prevent labeled output – Reducing Printing Restrictions in Trusted Extensions (Task Map)

• Use this zone as a print server – How to Enable a Trusted Extensions Client to Access a Printer

How to Enable a Trusted Extensions Client to Access a Printer

Initially, only the zone in which a print server was configured can print to the printers of that print server. The system administrator must explicitly add access to those printers for other zones and systems. The possibilities are as follows:

• For a global zone, add access to the shared printers that are connected to a global zone on a different system.

• For a labeled zone, add access to the shared printers that are connected to the global zone of its system.

• For a labeled zone, add access to a shared printer that a remote zone at the same label is configured for.

• For a labeled zone, add access to the shared printers that are connected to a global zone on a different system.

Before You Begin

A print server has been configured with a label range or a single label. In addition, the printers that are connected to the print server have been configured and shared. For details, see the following:

• How to Configure a Multilevel Print Server and Its Printers

• How to Configure a Zone as a Single-Level Print Server

• How to Assign a Label to an Unlabeled Print Server

You must be in the System Administrator role in the global zone.

1. Verify that you can ping the printer.

   # ping printer-IP-address

   If this command fails, you have a network connection problem. Fix the connection problem, then return to this procedure. For assistance, see Troubleshooting the Trusted Network (Task Map).

2. Complete one or more procedures that enable your systems to access a printer.
   • Configure the global zone on a system that is not a print server to use another system's global zone for printer access.
     1. On the system that does not have printer access, assume the System Administrator role.
     2. Add access to the printer that is connected to the remote Trusted Extensions print server.

        $ lpadmin -p printer-name -E \
        -v ipp://print-server-IP-address/printers/printer-name-on-server

   • Configure a labeled zone to use its global zone for printer access.
     1. Change the label of the role workspace to the label of the labeled zone.

        For details, see How to Change the Label of a Workspace in Trusted Extensions User’s Guide.

     2. Add access to the printer.

        $ lpadmin -p printer-name -E \
        -v ipp://print-server-IP-address/printers/printer-name-on-print-server

   • Configure a labeled zone to use another system's labeled zone for printer access.

     The labels of the zones must be identical.

     1. On the system that does not have printer access, assume the System Administrator role.
     2. Change the label of the role workspace to the label of the labeled zone.
     3. Add access to the printer that is connected to the print server of the remote labeled zone.

        $ lpadmin -p printer-name -E \
        -v ipp://zone-print-server-IP-address/printers/printer-name-on-zone-print-server

   • Configure a labeled zone to use an unlabeled print server for printing output with no security information.

     For instructions, see How to Assign a Label to an Unlabeled Print Server

3. Test the printers.

   ---

   Note - For security reasons, files with an administrative label, ADMIN_HIGH or ADMIN_LOW, print ADMIN_HIGH on the body pages of the printout. The banner and trailer pages are labeled with the highest label and compartments in the label_encodings file.

   ---

   On every client, test that printing works for all accounts that can access the global zone and for all accounts that can access labeled zones.

   1. Print text and PostScript files from the command line.

      # lp /etc/motd ~/PostScriptTest.ps
      % lp $HOME/file1.txt $HOME/PublicTest.ps

   2. Print files from your applications, such as mail, Oracle OpenOffice, Adobe Reader, and your browser.
   3. Verify that banner pages, trailer pages, and body page labels print correctly.

How to Configure a Restricted Label Range for a Printer

The default label range for a printer is ADMIN_LOW to ADMIN_HIGH. This procedure narrows the label range for a printer that is controlled by a Trusted Extensions print server.

Before You Begin

You must be in the Security Administrator role in the global zone.

1. Start the Device Manager.

   Choose the Allocate Device option from the Trusted Path menu.

2. Click the Administration button to display the Device Administration dialog box.
3. If the printer is listed in the dialog box and is attached to your system, find the name of the printer.

   Otherwise, click the Add button and type a name for the new printer.

4. Click the Configure button to display the Device Configuration dialog box.
5. Change the printer's label range.
   1. Click the Min Label button to change the minimum label.

      Choose a label from the label builder. For information about the label builder, see Label Builder in Trusted Extensions.

   2. Click the Max Label button to change the maximum label.
6. Save the changes.
   1. Click OK in the Configuration dialog box.
   2. Click OK in the Administration dialog box.
7. Close the Device Manager.