Installation on Novell OES Linux (iPrint)

Step 2: Create the host user account and firewall settings

PaperCut NG/MF runs and installs under a non-privileged user account called "papercut". The papercut user's home directory location is the application install location. /home/papercut is recommended, however, Administrators might choose an alternate install location depending on personal preference. Alternatives include:

• /usr/local/papercut

• /opt/papercut

The host user account is not an eDirectory account but a local system account. One way to create the "papercut" account on OES Linux is:

1. Open YaST Control Panel; then under Security and Users select User and Group Administration.

   

2. Select Users; then click Add to create a new user. The New Local User screen is displayed.

3. On the User Data tab, enter a username of papercut and assign a password.

   

4. On the Details tab, select Empty Home with permissions 755 and change the Home Directory path to define an alternate install location.

   

5. Click OK. The User and Group Administration screen is displayed.

6. Select Groups; then click Add. The New Local Group screen is displayed.

   

7. Type the group's name as papercut.

8. In the Group Members list, select the new user you just added.

9. Click OK; then click Accept to create the account.

IMPORTANT

This quick start guide assumes the install location is /home/papercut. If an alternate home location is defined, some of the paths listed in subsequent sections will require modification.

A default OES Linux installation imposes strict resource usage limits on user accounts (ulimit). The papercut account is a special account used for hosting an application so needs to be granted satisfactory resource limits such as the ability to open many files. On systemd Linux distributions, this limit is automatically configured so you do not need to do anything. For other distributions, the methods of setting user-level ulimit levels vary, however, the common solution is to add the following line to /etc/security/limits.conf:

papercut - nofile 65535

Novell OES Linux has a strict default firewall policy. PaperCut NG/MF uses TCP Ports 9191 (for HTTP), 9192 (for HTTPS/ SSLSecure Sockets Layer (SSL) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. The protocol uses a third party, a Certificate Authority (CA), to identify one end or both end of the transactions. To be able to create an SSL connection a web server requires an SSL certificate. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys - a Private Key and a Public Key.), 9193 (for Binary) and 9195 (for HTTPS/ SSL on supported devices) and these ports must be open. To open these ports:

1. Open YaST Control Panel; then select Firewall under Security and Users.

2. Select Allowed Services, then click Advanced.

3. Add ports 9191 and 9192 to the TCP Ports list (separated by spaces).

4. Click OK, Next, then Accept to apply the changes.

Step 3: Download and install PaperCut NG/MF

PaperCut NG/MF is supplied as a self-extracting and self-installing archive. The installation is performed under the rights of the newly created papercut account and temporary root access is required. Make sure the root password is handy. (Administrators who are after a detailed explanation of the install process should also consult the background information in PaperCut NG/MF on Linux).

Log on as the newly created papercut user and download and execute the installer from the command prompt. Here is an example using wget to fetch the installer:

shell> su - papercut

shell> wget [download url from PaperCut Software website]

shell> sh ./pcmf-setup-novell-oes-linux.sh

Follow the installation instructions and enter the root password when requested.

IMPORTANT

Ensure you login as the user papercut so that the user's environment is sourced and the home directory (install location) is correctly defined.

The installation process takes between two and five minutes depending on the speed of the system. A system restart is not required but administrators are advised to perform installation on live production systems during periods of low activity - for example, not during backup operations or other administration activities.

Step 4: Run the Configuration Wizard

After installation, you are prompted to open a web browser at :

http://[server-name]:9191/admin

The configuration stages are explained below:

Administrative password

1. Complete the following fields:

   • Password—enter the master password for the main in-built admin account. This password is independent of the operating system or domain passwords. The password must be at least six characters.

     TIP

     Keep this password secure. If you forget your password, you can reset it. For more information, see Resetting the Admin Password.

   • Verify password—re-enter the password.

   • Location—select the system's physical location and language.

2. Click Next.

Organization type

The Organization type screen is displayed.

This selection determines which system defaults are used. For example, in a Professional (Client Billing) organization, where it is useful to charge-back printing to customers, an advanced client popup is provided with additional features useful for dealing with large numbers of client (shared) accounts. You can change these default settings chosen for an organization type after installation.

1. Select your organization type.

2. Click Next.

Default cost for printing

The Default costs for printing screen is displayed.

IMPORTANT

For an education implementation, where users are charged for their printing, leave these values as zero during the implementation stage, otherwise, students will not be able to print as they cannot yet add credit to their account.

If required, you can change this setting after installation.

1. Complete the following fields:

   • Color (cost per page)—enter the default cost per page for color printing on all printers.

   • Grayscale (cost per page)—enter the default cost per page for grayscale printing on all printers.

2. Click Next.

Initial user credit (Education organization type only)

If you selected Education as the organization type, the Initial user credit screen is displayed.

If you selected Small/Medium Enterprise (SME) or Corporate) or Professional (Client Billing) as the organization type, go to step 5.

1. Complete the following fields:

   • Initial user credit—enter the amount of credit each/quota each user will receive when the system is first enabled. You can change these settings after setup.

   • Deny access when users run out of credit/quota—select this check box to prevent users from printing when they run out of credit/quota.

     TIP

     If you are evaluating PaperCut NG/MF it might be appropriate not to disable printing when a users funds run out. This way you can be assured that user printing is not disrupted during the evaluation.

2. Click Next.

User/Group Synchronization

TIP

To speed up the installation, you can click Skip this step and synchronize the users/groups later.

PaperCut NG/MF extracts user information out of the System or Domain. This is usually LDAPThe Lightweight Directory Access Protocol (LDAP) is a directory service protocol that runs on a layer above the TCP/IP stack. It provides a mechanism used to connect to, search, and modify Internet directories. The LDAP directory service is based on a client-server model. or Google Cloud Directory. The options presented here vary depending on the Operating System and its environment. During evaluation, most sites import all users from the system/domain into PaperCut NG/MF. An option also exists to import a subset of users from a given group. This option is useful when only a subset of users will use the printers.

LDAP

PaperCut NG/MF has native support for eDirectory LDAP schemas. This is the default user import option for most sites.

PaperCut NG/MF does its best to auto-discover LDAP settings, but some knowledge of eDirectory and/or LDAP is required. More information on LDAP is available in Synchronize user and group details with LDAP.

Google Cloud Directory

You also have the option to use Google Cloud Directory as the sync source. To set up Google Cloud Directory as the sync source, follow these instructions.

On the Google Cloud Directory Details screen:

NOTE

Remember, this functionality is available for organizations using G Suite Education, G Suite Enterprise for Education, G Suite Enterprise, and Cloud Identity Premium.

IMPORTANT

Before you start, make sure you can log in to Google as a Super Admin.

1. Log in to admin.google.com using your Super Admin user login details. The Google Admin console is displayed.

2. Click the Apps tile. The Apps screen is displayed.

3. Click the LDAP tile. The LDAP screen is displayed.

4. Click ADD CLIENT.

5. Type a name for the LDAP client connection you’ll be configuring to use for PaperCut NG/MF (for example, "PaperCut MF"), and optionally type a description; then click CONTINUE. The Access permissions screen is displayed.

NOTE

This adds PaperCut NG/MF to the list of permitted LDAP clients. You can find more information about configuring access permissions from Google.

6. In the Verify user credentials section, select either:

   • Entire domain <domain name>

   • Selected organizational units; then click Add and select the units from the list. (Use this to limit syncing to users in a subset of groups.)

7. In the Read user information section, select either

   • Entire domain <domain name>

   • Selected organizational units; then either click Copy from Verify user credentials or click Add and select the units from the list. (Use this to limit syncing to users in a subset of groups.)

   • Depending on your organizational policies, tick all boxes for System attributes, Public custom attributes, and Private custom attributes as this will allow PaperCut to sync primary number and secondary number from custom fields of your choice stored under individual users as per your organization's schema on Google Cloud Directory. More details on this in Installation on Novell OES Linux (iPrint).

8. In the Read group information section, click the switch to set it to On; then click ADD LDAP CLIENT. Google displays a confirmation message and information about downloading the certificate.

9. On the same screen, click Download certificate; then save the downloaded certificate (which is a PDF file) in a secure location.

10. Click CONTINUE TO CLIENT DETAILS. The Settings for <LDAP client name> screen is displayed.

NOTE

The service status, displayed at the top right of the screen, is initially set to OFF.

11. Click anywhere in the Service Status box. The Service Status screen is displayed.

12. Select On for everyone. The service status is updated for everyone.

13. Click SAVE.

NOTE

Depending on the size of your organization, it can take up to 24 hours for Google Cloud Directory changes to apply.

User Client options (Professional Client Billing organization type only)

If you selected Professional (Client Billing), as the organization type, the User client options screen is displayed.

If you selected Education or Small/Medium Enterprise (SME) or Corporate, go to Confirm Setup steps.

Every print job must be charged to an account via the process of Account Selection. This may or not require user interaction and is configured at the user level.

In environments where user interaction for Account Selection is required and the user has both options - User ClientThe User Client tool is an add-on that resides on a user's desktop. It allows users to view their current account balance via a popup window, provides users with the opportunity to confirm what they are about to print, allows users to select shared accounts via a popup, if administrators have granted access to this feature, and displays system messages, such as the "low credit" warning message or print policy popups. and printing device - running the User Client may be optional. Hence, deploying it immediately is also optional. If you choose not to deploy it now, you can still deploy it in the future. However, in environments where user interaction for Account Selection is required and can only be done via the User Client (and cannot be done at the printing device), running the User Client is mandatory. Hence, deploying it immediately is also mandatory. If not, the user is unable to carry out the configured user interaction for Account Selection, and the job remains paused in the print queueA print queue displays information about documents that are waiting to be printed, such as the printing status, document owner, and number of pages to print. You can use the print queue to view, pause, resume, restart, and cancel print jobs. and does not appear on the printing device. The User Client can be deployed directly from a network share (which is automatically configured on Windows). There is also the option to install the software locally on each workstation, however, this is not usually recommended because it makes the process of updating the User Client more complicated. For more information about the Account Selection options with and without user interaction (via the User Client or printing device), see Shared accounts, User Client, and Allocating accounts to print jobs at the device.

1. Depending on the Account Selection configuration for users (whether or not user interaction is required and whether or not your environment caters for this on the User Client AND on the printing device), select an appropriate User Client deployment strategy:

   • Immediate implementation (Enable for all users)—the Account Selection option requiring user interaction is enabled only for all users. If you have configured your users with Account Selection that requires user interaction, and this can only be done on the User Client (and cannot be done on the printing device), then you must install the User Client on all user desktops immediately to prevent disruption of user printing services. If in doubt, select the minimal impact strategy. This ensures the impact is isolated to only the nominated test account.

   • Minimal impact (Initial single user testing)—the Account Selection option requiring user interaction is enabled only for a single user for testing purposes. You need to nominate the testing account; this can be an existing system/domain account used for testing purposes or your own user account. The username should be in the format used to log in to the domain/system (usually the short form). Depending on the environment, you can test the user interaction for Account Selection either on the User Client or on the printing device. The minimal impact strategy allows you to test Account Selection with user interaction using the nominated test system/domain user account, after which you can configure other users with similar Account Selection options.

1. Click Next.

Confirm setup options

The Confirm setup options screen is displayed.

1. Check the settings you have entered. If you want to change anything, you can return to any of the configuration screens to alter the options.

2. Click Confirm.

The Initial user import screen is displayed.

3. Click Close.

Setup complete

After completing the configuration wizard you are presented with a user synchronization status screen, showing the progress and results of the setup.

1. Click Login to access the Admin web interface and begin familiarizing yourself with the options and features available. Take some time to explore, and refer back to the relevant sections of this manual as required.

Step 5: Configure the iPrint printer

PaperCut NG/MF works by directly integrating with the Novell iPrint Print Manager. iPrint must, however, be configured to use PaperCut NG/MF as an accounting control source. In the current release, this configuration is done manually at the individual print queue level:

1. Log in to iManager, expand iPrint; then select Manage Printer Manager.

2. Select the Printer Manager associated with one of your print queues.

3. Click the Manage health monitor link. A list of all your printers is displayed.

   

4. Select a Printer Agent from the list.

5. Click Configuration Options.

   

6. Enter papercut under the Accounting Autoload Command. Take care to write this all in lower case with no spaces.

   

7. Click Apply.

8. Click Back, then Back and repeat steps 4 through 7 for all printers you want monitored/controlled by PaperCut NG/MF

9. In line with best practice, backup the new printer configuration (padbtxt.xml) as follows:

   1. In iManager open up the active Print Manager.

   2. Select Manager health monitor > Advanced iPrint Manager Information > iPrint Manager Internal

   3. Click Backup Database.

10. Finally restart the Printer Manager in iManager by clicking Shutdown then Startup. After this, all jobs on the queues are tracked.

Step 6 - Sharing User Client software

The PaperCut NG/MF client software is located in the local directory:

/home/papercut/client

This software needs to be shared over the network so workstations can access/install the client application. Novell iManager provides a number of file sharing options. One simple solution is to add a read-only NCP or SambaSamba is a Windows interoperability suite of programs for Linux and Unix. It is used to integrate Linux/Unix servers and desktops into Active Directory environments. It can function as both a domain controller or as a regular domain member. share called PCClient pointing to /home/papercut/client. Established networks will benefit from ensuring the client files are available in their Distributed Files Services. The deployment of the client software (e.g. zero-install deployment) is covered in User Client.

Step 6: Deployment for a Professional (Client Billing) installation

Every print job must be charged to an account via the process of Account Selection. This may or not require user interaction and is configured at the user level. When Account Selection requires user interaction, then depending on your environment, the user can do so either on the User Client or on the printing device.

The User Client

In environments where user interaction for Account Selection is required and the user has both options - User Client and printing device - running the User Client may be optional. Hence, deploying it immediately is also optional. If you choose not to deploy it now, you can still deploy it in the future. However, in environments where user interaction for Account Selection is required and can only be done via the User Client (and cannot be done at the printing device), running the User Client is mandatory. Hence, deploying it immediately is also mandatory. If not, the user is unable to carry out the configured user interaction for Account Selection, and the job remains paused in the print queue and does not appear on the printing device. The User Client can be deployed directly from a network share (which is automatically configured on Windows). There is also the option to install the software locally on each workstation, however, this is not usually recommended because it makes the process of updating the User Client more complicated. For more information about the Account Selection options with and without user interaction (via the User Client or printing device), see Shared accounts, User Client, and Allocating accounts to print jobs at the device.

Account Selection

After deploying the User Client on user workstations (if required), you can configure users with the required Account Selection option (whether or not user interaction is required). For example, in a Professional (Client Billing) installation, users who print jobs for clients are often given the Advanced Account Selection option, however, other Account Selection options might be better suited for some users based on their job function.

You can configure the required Account Selection option on one user at a time or update for all users in bulk.

Use the User Details page to configure the required Account Selection option for a single user.

To configure the required Account Selection option for all users in bulk:

1. Click the Users tab.

   The User List page is displayed.

2. In the Actions menu, click Bulk user actions.

   The Bulk User Operations page is displayed.

TIP

By default the action is applied to all users (the special [All Users] group). To apply the action to a subset of users (a user group), select that group from the list.

3. In the Change settings area, select the Change account selection setting check box; then select Show advanced account selection from the list.

4. If you do not want to allow users to charge printing to their personal account (i.e. they must select a shared accountA shared account is an account that is shared by multiple users. For example, in business, shared accounts can be used to track printing costs by business unit, project, or client. Organizations like legal firms, engineering firms, or accounting offices often have long lists of accounts, projects, clients, or matters. In a school or university, shared accounts can be used to track printing by departments, classes, or subjects.) then clear the Allow user to charge to their personal account check box.

5. Click OK.

A confirmation window is displayed.

6. Click OK.

Once completed, the configured Account Selection option is enabled for the selected users. If you have configured users with an Account Selection option that requires user interaction, then it is recommended that you test this from the User Client on a desktop or on the printing device (if applicable). Ensure that user interaction provided is as per the configured Account Selection option. Once the interaction is completed, ensure that the job is printed, logged and appropriate account charged.

Step 7: Testing

Following a fresh installation, it is highly recommended to test core features of the system. For further details, see Testing the installation.

What next?

Take some time to explore the features of PaperCut NG/MF before continuing reading at Implementation by example or Tour. Business users might be interested in trying the popup client software as covered in Client software. If desired, the client software should also be deployed to other workstations. This procedure is detailed in User Client.