Cups interface not accessible from Tor Browser

Support Tails
,
1

Hello,

I recently discovered Tails.
I installed Tails V7.10 USB image.
I’ve been able to create a Tails environment that fit my needs… except I’m unable to configure a printer.
While trying to configure using ‘Parameters->Printers->Discover’ only a BRF-Cups printer is shown. However on a fresh Debian installed for this purpose, my printer is found just after plugging in its USB cable.
In parallel, I found that Tor Browser (secure or insecure) failed to display the cups web interface with ‘connection error’.
That is particularly strange, since the ‘wget’ command downloads properly the cups web interface html page (using the same URL), meaning the Web Interface is running, and the issue is not related to the printer itself.
For information:
'Webinterface = yes and Listen 127.0.0.1:631 are configured in /etc/cups/cupsd.conf
cups.service and cups.socket are started and running
No error is logged into /var/log/cups/error_log neither in systemd journal

I hope I’ve been clear enough (as you surely understood, english is not my native language)

2

Hi, it’s a common issue for Tails users:

3

thanks Gus for this advice.

However since I’m in doubt with my USB key, I’m rebuilding it from scratch.

I hope issues will go away after this

Anyway I will let you know soon.

4

So the status after having rebuilt the USB key and started Tails for the first time:

1 - Cups admin interface not accessible:

  • from Tor (as expected)
  • from Unsafe browser (unexpected)
    2 - Cups admin interface accessible from Chromium (after package installation)
    3 - Brother printer not recognized by Tails (even as suggested on another thread by unmasking avahi-daemon)
    4 - Need to install Brother drivers from a .deb file provided by Brother official site (Bad says CUPS)
    5 - Printer is now recognized by Cups and by Gnome (youpi…)
    6 - No way to print any job (waiting for printer to be available :frowning: )

While requiring to print, journal shows 1 error about apparmor denying ‘open’ for profile /usr/sbin/cupsd

5

Here’s my final findings.

I could achieve to print a job on my Brother HL-L2375DW printer.

Below what I did for (I repeated this many times with different order to ensure all actions were required) :

  • I unmasked avahi-daemon.service and avahi-daemon.socket (systemctl unmask avahi-daemon…).
    This was suggested by a dev, but it’s not enough since the printer is connected by an USB cable and use IPP over USB whose service is listening at port 60000 (among others), port wich is not accessible out of the box.
  • I removed all firewall rules (testing purpose :wink: )
    Once this 2nd action performed, parameters->printer automatically discovered the printer and I could print a test page.

I’m not skilled enough to determine which rules to add keeping the system safe, so I will not investigate more.
I could see that IPP service is listening to a huge number of ports (lsof | grep -i ipp).
I fear that allowing trafic for the lo interface would break the global security.

So I let you decide what can be done so a printer can be discovered and configure as it is on Debian system without breaking Tails security.

Let me know if my request is admissible :slight_smile: