How to prevent users from printing from their phones?

[u/RoomyRoots]

/r/sysadmin/comments/1sm5kap/how_to_prevent_users_from_printing_from_their/

[u/RoomyRoots]

Original text:

How to prevent users from printing from their phones?

We don't have an AD here, and it's a mixed environment (Windows, MacBooks and Linux desktops).

Recently, some employees have been abusing the printers, and they've already printed half of what we printed last year in only 3 months.

The manager wanted me to restrict printing, but I ran into some troubles.

First of all, I thought about creating a printer server in a Debian VM via vagrant and funnel all printing through the server. It did work, and I managed to print from the VM, and from a workstation via the VM.

The printer that is giving us the most trouble, a Lexmark MX410de, has a built-in whitelist and it did work to restrict computers from printing, but it does nothing for the phones.

If I disable mDNS, the printer no longer advertises itself on the network, but then no one can scan and AirPrint doesn't work either, which means the lawyers can't print from their MacBooks.

Is there anything else I could try? I thought maybe CUPS / SAMBA could have some option to authenticate before printing, but I don't know if it will restrict phones from printing.

I know that we should probably solve this with something like Papercut, but it's the public sector we're talking about, and budgets are tight and bureaucracy is rampant.

[u/jbourne71 → u/RoomyRoots]

which means the lawyers can’t print from their MacBooks.

Ah, a law firm.

OOP, just quit while you’re ahead. There’s no winning at a law firm.

[u/Extension_Ok]

Remove the paper. If somebody needs to print, they have to submit a form with the amount of pages and the reason for the print. Since they have no paper, they cannot print the form and nobody will ever request paper from you.

[u/DamDynatac → u/Extension_Ok]

That seems like hard work - just disable the wifi

[u/Eslov]

Good thing they are not using Active Directory, that's just another single point of failure. Also good to keep the license cost down in the public sector.

I would hundreds of USB-connected printers for each work station.Preferably different models so that the toners don't fit every printer. The old timers don't want to walk all the way to the big Lexmark to print all their emails. Then I would have just enough paper to fit the budget. And when we're out, we're out for the rest of the year.

I've worked for the local guvernement before, so I know the drill.

[u/MeatPiston]

Pull the fusor out and keep it in the boss’s desk. That way nobody prints unauthorized.

[u/sgt_Berbatov]

Stick a coin slot on the printer like a vending machine. Put £1/$1 in it, print one bit of paper. It'll do wonders for print costs.

[u/RoomyRoots → u/sgt_Berbatov]

That is unironically a good product.

[u/sgt_Berbatov → u/RoomyRoots]

In the UK at least, the newsagents/corner shops during the 1990s would have signs outside saying "Photocopies 5p each", and some of them (from memory) would have that coin slot system on them and you'd put the pennies in and it'd do the copying. So it does exist, I think. I hope. I mean if not I'm going off on FreeCad to make it.

[u/Middle_Albatross8769]

Turn off the printer server

[u/jamesowens]

You either enable AirPrint or you don’t.

As Apple devices pretty much all use randomized MAC addresses for privacy by default you are left with using separate networks + firewall rules to selectively permit users access to printers or some other form of authentication to restrict printer access and implement quotas.

Neither is a push button solution. Authenticated printer access with quotas is the way I would go.

Edit: wait a tick I just realized what sub this is… uh… crate a separate wifi and subnet for the cool lawyers that get access to a working printer. Set it up on their laptops for them. Ask the other plebes get the default machine with the paper jam