CUPS package ships with non-functional default configuration — blocks all printer administration

_(Please note my technical ability isn't great in Linux and was using Claude Code at the time to configure my printer. I saw the issues it ran into and asked questions an thought it would be beneficial for the AerynOS community to file an issue. I asked Claude Code to generate the following summany and I reviewed it accordingly. It makes sense what we went through and the suggestions it made.)_ ### Summary After installing CUPS from the moss repo (sudo moss it cups cups-client cups-filters cups-browsed), the service starts successfully but all printer administration is denied with "Forbidden" errors. This affects both the lpadmin CLI and the web interface at localhost:631. Printer auto-discovery via avahi/cups-browsed works correctly — the issue is purely in the default cupsd.conf configuration. ### Environment - AerynOS (latest as of 2026-03-29) - Packages: cups, cups-client, cups-filters, cups-browsed - Printer: Canon MF264dw (networked, discovered via IPP Everywhere/dnssd) ### Issues Found 1. No SystemGroup defined in default cupsd.conf The default config at /usr/share/defaults/etc/cups/cupsd.conf does not contain a SystemGroup directive. CUPS uses @SYSTEM throughout its <Location> and <Policy> blocks to authorize admin operations, but without SystemGroup defined, no user or group is mapped to @SYSTEM, so all admin actions are denied — even for root. Expected: SystemGroup should be set to an appropriate system group. On AerynOS, wheel would be the logical choice since that's the standard admin/sudo group. Suggested fix: Add to cupsd.conf: SystemGroup wheel 2. <Location> blocks deny all connections including localhost All <Location> blocks in the default config use Order allow,deny but contain no Allow directives: <Location /> Order allow,deny </Location> <Location /admin> AuthType Default Require user @SYSTEM Order allow,deny </Location> With Order allow,deny and no Allow lines, the default action is to deny all requests. This blocks connections from localhost before authentication is even attempted. Expected: Local connections should be permitted so that CUPS is functional for the local user. Suggested fix: Add Allow localhost to each <Location> block: <Location /> Order allow,deny Allow localhost </Location> <Location /admin> AuthType Default Require user @SYSTEM Order allow,deny Allow localhost </Location> <Location /admin/conf> AuthType Default Require user @SYSTEM Order allow,deny Allow localhost </Location> <Location /admin/log> AuthType Default Require user @SYSTEM Order allow,deny Allow localhost </Location> ### Workaround To get printing working currently, users need to: 1. Copy the default config: sudo cp /usr/share/defaults/etc/cups/cupsd.conf /etc/cups/cupsd.conf 2. Add SystemGroup wheel to the config 3. Add Allow localhost to all <Location> blocks 4. Restart CUPS: sudo systemctl restart cups Alternatively, printer definitions can be written directly to /etc/cups/printers.conf to bypass CUPS authentication entirely. ### Notes - Avahi discovery, cups-browsed, and IPP Everywhere driverless printing all work correctly once the config issues are resolved - This likely affects all AerynOS users attempting to set up any printer, not just this specific model - The lpadmin group (used by Debian/Ubuntu for CUPS admin) does not exist on AerynOS, which is fine — using wheel via SystemGroup is the appropriate solution