Ant <a...@zimage.comANT> wrote:
> >>> Having said that, if the computer and and printers are only used by one
> >>> person, it is possible to grant printing system admin rights to certain
> >>> user accounts without giving them full administration of the computer.
> >>>
> >>> You can set this up by logging in as an admin user, running Terminal and
> >>> entering a command in the following form (which is sensitive to case,
> >>> spacing and punctuation):
> >>>
> >>> sudo dscl . -append /Groups/_lpoperator GroupMembership ACCNAME
> >>>
> >>> Subsitute ACCNAME with the short name of the user's account, i.e. their
> >>> home folder name. For example, if their home folder name is "jim"
> >>> (/Users/jim) then the full command would be:
> >>>
> >>> sudo dscl . -append /Groups/_lpoperator GroupMembership jim
> >>>
> >>> (The sudo command will prompt you for a password: enter the password of
> >>> the admin account under which you are logged in.)
> >>>
> >>> If you want to remove this special privilege later, this is the
> >>> corresponding command:
> >>>
> >>> sudo dscl . -delete /Groups/_lpoperator GroupMembership ACCNAME
>
> Is this in CUPS web admin pages that I missed? I prefer to do it with GUI.
No, it is a user account setting (Directory Services, or Users &
Groups), not a CUPS setting.
You can do it via the UI in System Preferences, if you first enable
System Preferences to display system groups. _That_ requires the command
line or a third party utility.
TinkerTool is a free utility which lets you enable this setting, on a
per-account basis (do it within your admin account).
In TinkerTool, go to the Applications section, and near the bottom is
"Group accounts: Show all user groups in Users & Groups pane of System
Preferences".
Once you turn that on, go into System Preferences, choose Users &
Groups, click the padlock to make changes, enter your admin credentials.
You will see a "Groups" heading in the list on the left side, with a
collapse/expand triangle. Click the triangle to expand the list.
The group you want is "Print Operator". Click on that, then on the right
you can choose individual accounts to include in the Print Operator
group. Only bother marking standard accounts - you don't need to add
individual admin accounts to this group as any account with admin
privileges is automatically in this group (because the "Print
Administrators" group is included in "Print Operators", and the
"Administrators" group is included in "Print Administrators".
I'm not sure offhand if it would be helpful to put your client into the
Print Administrators group (_lpadmin) instead of the Print Operator
group (_lpoperator). The Print Operator group is sufficient to allow
pausing an unpausing the print queue, but I expect it doesn't let them
go as far as adding and deleting printers, or changing settings in CUPS.
Footnote: I should point out that both these sets of instructions apply
to Mountain Lion (10.8.x), and I expect they are the same on Lion
(10.7.x) and Snow Leopard (10.6.x) apart from minor details like the
name of the preference pane ("Accounts"), but I haven't tested them
there or confirmed the other details are the same.
Leopard (10.5.x) probably supports the same method via the command line,
but I don't know offhand if its System Preferences supports showing all
the groups.
This method will definitely not work for Tiger (10.4.x) or earlier,
since Directory Services doesn't exist on those systems (older OS X
verisons use NetInfo to manage users and groups, and System Preferences
doesn't have the group editing feature, as far as I know).
--
David Empson
dem...@actrix.gen.nz