Trusted Solaris Administrator's Procedures

Controlling Whether Security Information is Printed on Print Jobs

The Security Administrator role can change the default for the printing of labels on body pages in the following ways:

Give users an authorization on the print server to allow them to print jobs without labels on the body pages or print jobs without banner or trailer pages.

See "To Enable Some Users to Print Without Banners and Trailer Pages ".
Redefine fields in the /usr/lib/lp/postscript/tsol_separator.ps file on the print server in one of the following ways:
- Completely disable the printing of labels on body pages for all users, as described in "To Suppress the Printing of Page Labels on All Print Jobs".
- Specify that another label or other wording is printed on body pages for all users.

By default, the Protect As classification is printed at the top and bottom of every body page. The "Protect As" classification is the dominant classification when the classification from the job's label is compared to the minimum protect as classification that is defined in the label_encodings file.

The label printed at the top and bottom of banner and trailer pages as shown in the following figure is specified by means of the /PageLabel definition.

Figure 11-1 Job's Label Printed on Body Pages

The /HeadLabel definition can be changed to put a different value or string at the top and bottom of the banner trailer pages or to print nothing at all.

Print Job Information on Banner and Trailer Pages

The following figures show a default banner page and the differences in the default trailer page. The names of the various sections are shown because they are needed when configuring what appears.

All the text and the labels and warnings that appear on print jobs are site-configurable. The text can also be replaced with text in another language for localization.

Figure 11-2 Typical Print Job Banner Page

Figure 11-3 Differences on a Trailer Page

The following table shows aspects of trusted printing that the Security Administrator can change by assigning an authorization. For other printing-related authorizations see the Trusted Solaris Administration Overview.

Table 11-2 Modifiable Printing Features


What Can Be Changed	Authorization Name	How to Change
Whether individual users can print jobs without labels on body pages	Print without Label	Assign a rights profile with the Print without Label authorization to the user.
Whether all users can print jobs without labels on body pages	Print without Label	Enter AUTHS_GRANTED= solaris.print.unlabeled in `policy.conf` file.
Whether individual users can print jobs without banner or trailer pages	Print without Banner	Assign a rights profile with the Print without Banner authorization to the user.
Whether all users can print jobs without banner or trailer pages	Print without Banner	Security administrator enters Enter AUTHS_GRANTED= solaris.print.nobanner in `policy.conf` file.

The Security Administrator role can do the following to modify defaults that set labels and handling caveats on printer output:

Localize or customize the text on the banner and trailer pages.
Specify alternate labels to be printed in the various fields of the banner and trailer pages or at the top and bottom of body pages.
Change or omit any of the text or labels.

Note -

For how to do customizations or internationalization, see the comments in the tsol_separator.ps file.

Permitting Safe Jobs to Be Printed Without Labeled Pages

Certain users, such as technical writers, need to produce publicly-readable documents that do not have labels printed on the top and bottom of the pages. If a printer connected to a Solaris print server is available, the Security Administrator role can set up the users' environments so that the publicly-readable jobs go to the printer connected to the Solaris computer while jobs at all other labels go to Trusted Solaris computers. See: "To Set Up Public Print Jobs from an Unlabeled Print Server". The procedure requires understanding of how to set up user accounts as described in Chapter 3, Managing User Accounts , and computer network entries as described in Chapter 8, Specifying Routing and Security for Remote Computers.