search

apple / cups

Apple CUPS Sources
https://www.cups.org
Apache License 2.0
1.95k stars 464 forks source link

access to cups impossible with SSH tunnels #3912

Closed michaelrsweet closed 13 years ago

michaelrsweet commented 13 years ago

Version: 1.4.3 CUPS.org User: Uqbar

For technical reason I need to print from local CUPS to a remote CUPS printer. The access is done through an SSH tunnel. The remote CUPS says: Request from "localhost" using invalid Host: field "172.16.1.1"

where 172.16.1.1 is a local dummy interface used by SSH to forward traffic to the remote CUPS. For the sake of completeness, the tunnel is opened from the remote CUPS machine to the local one with a commmand like this:

ssh -C -N -T -R 172.16.1.1:631:127.0.0.1:631 -L 8080:127.0.0.1:631 root@localmachine

I think this very bug is related to this: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530027

michaelrsweet commented 13 years ago

CUPS.org User: mike

This configuration is not supported and supporting it would involve opening up cupsd to local browser-based attacks, which we went to great effort to block.

Not to be fixed.

michaelrsweet commented 13 years ago

CUPS.org User: brunoc68

It is problematic : I use freenx via a ssh-tunnel through a gateway, and I am not able to print locally. I suspect it is because of this issue, because the cups connection doesn't work "manually" ("...using invalid Host:..."). I found a workaround which is to make 2 ssh tunnels instead of one, so that on both ends there is "localhost:631". This is very complicated in the end : is there really no way to disable this security feature ? The directive "ServerAlias *" doesn't help at all in my case.