Installing Printer requires password, then crashes on driver search

[mimp]

Running Whonix-ws in Qubes 4.0rc4

When I open Print Settings and click the button to add a printer it asks for authentication. I tried

root
changeme

AND

user
changeme

Neither worked. So I did:

su
passwd

and changed the root password. Opened Print Settings again and entered those credentials and it accepted them. I connected the printer to the whonix-ws qube and it showed up in the list as a USB printer. I select it and click Next. A box pops up saying searching for drivers and then Print Settings crashes.

I tried this in the TemplateVM and an AppVM based on the whonix-ws template with the same results in both.

[0brand]

Hi mimp

Are you following the steps in:

Network Printer

Remember Qubes 4.rc4 is still in testing. You may want to ask for help on the Qubes mailing list.

[mimp]

Hi 0brand,

I did see that page, but it doesn’t really help me. It’s not a network printer. And I am able to install a printer in debian Template VM using the method I attempted above. It is just in Whonix where it a) asks for a password, which I think I addressed, and b) crashes after attempting to get the drivers.

The one thing of interest mentioned on that page is that the TemplateVM won’t have network access except for for updates. Which seemingly is enough to get the drivers since it worked on my debian template.

[0brand]

Hi mimp

And I am able to install a printer in debian Template VM using the method I attempted above

That changes things a little

I did see that page, but it doesn’t really help me.

Even though that page is for network printers it still has helpful info.

One would normally want to configure a printer in a template VM, rather than in particular AppVMs. This is because all the global settings made to AppVMs (those stored in its /etc, as well as binaries installed in /usr) would be discarded upon AppVM shutdown

Also “Steps to configure a network printer in a template VM” on that page would be similar for USB or network printer. However, in Qubes 4.x Template VMs do not have network interface by default which is a change from Qubes 3.2. (just informational)

https://www.qubes-os.org/doc/releases/4.0/release-notes/
https://github.com/QubesOS/qubes-issues/issues/1854

It looks like cups and system-config-printer may have been removed from qubes-whonix-workstation-packages. Can you confirm you have/do not have those packages.

https://phabricator.whonix.org/T619

https://github.com/Whonix/qubes-whonix/commit/fe3a2329739ad78ad2a6c48ed7dfb5a0893006a2

[mimp]

Thanks for the links. And you’re right, that page would be helpful for someone trying to set up any printer, just didn’t give me any additional info except for the network connection thing, which may be connected to this.

I do have /usr/bin/system-config-printer, which is what pops up when you open the “Print Settings” application in whonix-ws.

which cups

doesn’t return anything, but I can open firefox and go to 127.0.0.1:631 and access cups

This inquiry made me think to look for hplip, the package for HP print drivers. Neither whonix-ws or debian had it installed. So does this mean that system-config-printer pulled the drivers from the internet when I installed in debian?

I installed hplip in my Whonix AppVM (just to test it)

sudo apt install hplip

Then I reran Print Settings and it worked! instead of shutting down it found the print drivers and installed the printer. I printed a test page.

[0brand]

Hi mimp

A primary Whonix goal is to greatly reduce the risk posed by (additional) software installations that are not exclusively designed to work with Tor. Drivers such as hplip will have to be installed on an individual basis. Even if it comes installed in Debian Templates i.e not Whonix Templates. That’s why the link to Qubes Printer set up. Must install software. I should have asked to be sure this was done.

https://www.whonix.org/wiki/Install_Software

Also a must read for using printers

Software

[mimp]

Well, like I said, the debian template doesn’t appear to have hplip installed either. Which is why i wondered if system-config-printer was crashing due to a lack of network connection that it had in debian in order to pull down the needed drivers?

Whatever the cause the crashing of system-config-printer is not the desired outcome when you don’t have the proper drivers already available on your system.

Thanks for your responses and guiding me towards a solution.

[0brand]

Hi mimp

why i wondered if system-config-printer was crashing due to a lack of network connection that it had in debian in order to pull down the needed drivers?

Could very well have something to do with it. I’m not 100% sure so I don’t want to give you incorrect info.

Thanks for your responses and guiding me towards a solution.

Glad to see your printer is up and running! Please use extreme caution when using a printer. Especially when anonymity is paramount. If you have anymore issues I’ll do my best to help if i can.

[Patrick]

Printing read:
https://www.whonix.org/wiki/Software#Printing_and_Scanning

Don’t install hplip driver-plugin your only trusted TemplateVM!

• keep redoing the installation in a TemplateBasedVM
• or use a StandaloneVM
• or figure what needs bind-dirs selective persistence (undocumented,
  research task, difficult)

This is because the driver plugin is a proprietary closed source binary.

Could you document this please?

“keep redoing the installation in a TemplateBasedVM” - this could use
some separate Qubes specific documentation. There is no reason to avoid
installation of software in TempalteBasedVMs. I usually use scripts to
automate it. That saves disk space, fewer VMs to upgrade (no
StandaloneVM). For me, even less cumbersome.

[0brand]

Could you document this please?

Working on it now.

Qubes 4.x specific question:

Would it be safe to install printer binaries in a TemplateBasedVM and use as a Template for DispVMs i.e template_for_dispvm true. After binaries are installed in AppVM-dvm networking can be disable. Then use DispVMs to print?

I haven’t tested yet. Wanted to ask if its worthwhile to even try.

[Patrick]

I wouldn’t trust that template for anything other than printing - since it contains a closed source binary (printer driver plug-in). If it is a clone of a template that is only used for printing, ok.

Disabling networking and using a DispVM for printing is a very good idea.

[mimp]

Thanks for your input Patrick. I tried installing hplip in the AppVM to get the printer running, hoping it would work on restart without the package being installed, but that did not work.

Unfortunately I need to do a lot of printing from one of my primary AppVMs based on whonix. Copying to a disposable VM would be too much. Based on your recommendations I may create a StandaloneVM.

[0brand]

Hi mimp

Patrick moved the “Printing and Scanning” chapter to it own wiki page. This includes new content you may be interested in.

https://whonix.org/wiki/Printing_and_Scanning#Mitigating_Printing_Risk

[mimp]

That’s great. Well done!