High CPU Load with authentication over Internet

[zyrixx]

Hello, I use CUPS 2.2.1 and share the printers over the Internet via Https with Letsencrypt. As soon as I turn on authentication (user and password), the CPU load / usr / bin / cupsd -l increases to 100% as soon as I access the printer settings on the client side. So far only tested with Windows.

Abstract from the /etc/cups/cupsd.conf

DefaultAuthType Basic
WebInterface Yes
# Allow remote access
<Location />
  AuthType Default
  Satisfy any
  # Allow remote access...
  Order allow,deny
</Location>

I turn off the authentication, everything is normal. What can I do? Thanks for the answers.

[michaelrsweet]

This sounds like the Windows IPP client doesn’t support authentication and is not properly handling the 401 response. Do you have any logs showing the requests the Windows client is sending?

[zyrixx]

Hello Michael, I am honored that the Father of cups writes to me personally.

cupslogs.txt

Many Thanks!

[michaelrsweet]

The log doesn't show the client connections/requests. How many "Read:" lines are you getting per client, and over what period of time?

[zyrixx]

These were excerpts from the error logs. In the Accesslog I have only the following

93.243.20.57 - print1 [27/Jul/2018:13:48:41 +0200] "POST /printers/Samsung_Samsung_SCX-483x_5x3x_Series HTTP/1.1" 200 79021 Print-Job successful-ok

I turn on debug, running on a connection to the "[Client 2] Read: status=100"
in the erro.log infinite and does not stop, until I restart cups> show log excerpts
cupslogsnew.txt

Edit: It also behaves like this from a Linux computer (Mint).

[zyrixx]

I've now set up a completely new system, Debian Stretch Cups 2.2.1-8 + deb9u2, and tested the connectivity with a single Linux client. The same result. As soon as I open the printer settings, the CPU load jumps up and becomes normal again after the restart. The log entries are identical to those when accessing cups from a windows client.

For the test, I set up a test environment on a Debian 8 with Cups 1.7.5-11 + deb8u4. Same settings. No problem.

[michaelrsweet]

OK, looking at your cupsd.conf excerpt again, the access control directive (Order allow,deny) is wrong - by default all access will be denied.

You want:

Order deny,allow
AuthType Default
Satisfy all

[zyrixx]

Hello and thanks for the correction. The authentication works yes, the problem is only the enormously high CPU utilization. If I remove the authentication from the configuration files /etc/cups/cupsd.conf and /etc/cups/printers.conf, I can restore normal usage.

My current configuration:
error_log.txt
access_log.txt
printers_conf.txt
cupsd_conf.txt

[michaelrsweet]

I've tried multiple configurations using the stock CUPS source and have been unable to reproduce the issue on macOS, Ubuntu, or Fedora. It is possible you are running into a distro-specific issue...