WolfPrint Accounted Printing at NC State

NC State University has deployed 147 accounted printers in fourteen different colleges and departments across campus. We use only HP printers with the WolfPrint Quota accounting system. All students, faculty, and staff receive a WolfPrint Quota Account as a part of their Unity computing accounts. WolfPrint Quota is deducted from a user's print quota account to cover the cost of charge-per-page printing.

To keep track of it all, two organizations at NC State University share the responsibility for accounted printing.

One of these organizations is WolfCopy, a group withint the Materials Management department. WolfCopy is managed by print services supervisor Jimmy Hennis. WolfCopy collects money from students to add to their WolfPrint quota accounts. Students can purchase print quota in one of two locations on campus. A representative is available to accept cash for print quota at DH Hill Library between the hours of 8:00AM and 4:30PM, Monday through Friday. A representative is also available at Administrative Services I on Sullivan Drive between the hours of 8:00AM and 5:00PM, Monday through Friday. A representative is also available at the Materials Management Warehouse at 3420 Ligon Street between the hours of 8:00AM and 4:30PM, Monday through Friday. Customer service representatives at these locations then use a web interface to increase the student's WolfPrint quota balance. Students may also choose to purchase print quota online with a credit card at: http://print.ncsu.edu.

With students' WolfPrint Quota monies, WolfCopy buys and maintains hardware and replacement parts for printers. WolfCopy also pays for printer consumables, such as paper and toner, with these monies. WolfPrint Quota funds also allow WolfCopy to provide a team of support persons to service the printers regularly, as well as to replace consumables as they run out.

The NCSU Office of Information Technology (OIT) developed and supports the back end of the WolfPrint Quota system. The Wolfprint back end is a set of Unix-based utilities to handle WolfPrint Quota accounting. These utilities also provide users with a web interface to monitor their WolfPrint Quota accounts. However, we support printing under Unix, Macintosh, and Windows.

WolfCopy also provides an FTE, to set up new printers on the network, add them to the WolfPrint debit system, monitor their status, and provide technical support for each device. This person acts as a liaison among WolfCopy, OIT Systems and Hosted Services, the OIT Technical Support Services/ HelpDesk, and local support persons in all fourteen colleges and departments. They troubleshoot problems as they occur, and keep both the JetDirect and PostScript firmware up-to-date.

Unlike many commercial charge-per-page printing applications, such as GPass, Pharos Uniprint, or Print Manager Plus, WolfPrint does not require users' print jobs to be "released" from a console, nor does it require users to pay for their printouts when they receive them. WolfPrint is a debit system which allows users to prepay their WolfPrint Quota account, without the hassle of remembering to carry cash or some type of access card when they, for example, need to print out something for their class that's starting in 10 minutes.

Printing via WolfPrint Quota accounts is available for Unix, Macintosh, and Windows users. Macintosh Information on how we handle accounted printing under both platforms, or as we refer to them, the Windows and Unix "sides," is described below:

Sybase Tables

The authoritative source for quota information is stored on a Sybase SQL server. Access to the data is through stored procedures, to ensure auditable and consistent access. The information kept in Sybase includes:

• User data, including how much money a user has in his/her print quota account, how much print quota a user has used, etc.
• Group data, which details accounted printing for a particular group of users which has its own print quota account.
• User logs. An entry is made in this table for every action on a user's quota account, such as $5 added to account, or 5 pages printed at 6 cents a page. This table does not contain log entries in straight text format, but rather separated out into 'codes' which are parsed and understood by client applications.
• Group logs, which are the same as user logs, but for a particular group of users which has its own print quota account.
• Admin users, a list of users that can perform administrative functions, as well as their level of access.
• Free printing logs. If deemed ok by WolfCopy, certain users can print for free, at which point every free print job they complete shows up in the free printing log.

Stored Procedures That Talk to the Sybase database:

• The lpquota command, which is way to see your user data and logs from the command line.
• The lpgrpadm command, which allows adding or removing members to and from groups.
• The lpadmin command, which is a "beefed up" version of lpquota, and has the capabilities to increase/decrease quota (will be phased out soon.)
• A web interface to administrative commands, which is what WolfCopy uses to add quota to a user's account, check on the status of a user's account, etc.
• A web interface users can use to check their quota status. This command, basically a web version of the lpquota command, allows users to check their quota from the web. It also checks and warns users if there is anything wrong with their accounts. For example, if a user is out of quota, an error message appears on that user's quota status web page, notifying him/her that s/he needs to purchase more quota...

Traditional unix line printing daemon

Solaris workstations use Kerberized lpd (line printer daemon) to print to WolfPrint queues. The lpd software we use is known as "lprng" As this was the original printing system, at this time both the CUPS and Samba systems print the jobs that they receive using lprng, on the print servers. Plans are underway to have CUPS actually be the final printing system, and replace lprng with Kerberized lpd provided by the CUPS system.

Programming Languages
Our solutions are a mixture of Perl and compiled C programs. We check whether a user has enough quota to print, that is, >= 0, before letting their job through. Although we have no good way to notify users if their jobs fail, if their quota balance falls below zero, we discard the job. If the quota server is down for whatever reason, it is assumed that the user can print and s/he gets backcharged after the server has come back up.

The print servers are Red Hat Enterprise Linux boxes running LPRng. There are 6 servers for the campus, load-balanced with keepalived and using the linux virtual server software to provide high availability and fault tolerance.

No code changes were made to LPRng, but the configuration is fairly customized. We require Kerberos authentication for the charged queues so that we can trust the username we receive. No quota charges are permitted on print queues that aren't protected via Kerberos, since that would allow any user to feign another user's identity, and charge that user for print jobs.

The Unix Accounting Utility

The Accounting Utility runs on the LPRng print servers. After every job, the Accounting Utility checks how many pages a user printed and to which queue, checks the price per page of that queue, and charges the user appropriately using Sybase stored procedures.

Common Unix Printing System (CUPS)

One issue with lprnd and lpd in general is that it hasn't kept up with modern printing requirements. Indeed, it hasn't changed for decades.

Modern linux and Macintosh systems use a newer system called CUPS, the Common Unix Printing System, in favor of lpd.

At this time, we run CUPS side by side with lprng. It provides automatic driver installation and much finer control of printer features. At this time, CUPS hands print jobs off to lprng to actually talk with the physical printers, but in time we'll remove lprng entirely and use CUPS's ability to publish queues using Kerberized lpd directly.

Samba and Windows Printing

Microsoft Windows workstations cannot download printer drivers from a CUPS server. MS has it's own remote procedure call (RPC) system that provides the same function, however.

OIT-SHS has created and maintains a protocol gateway that can convert the native Microsoft SMB/RPC print requests into a form that WolfPrint can use.

Because our Active Directory accounts use the same Kerberos authentication database that the Solaris/Linux/Mac machines do, secure billing is possible directly, without any need for syncronization.

No additional software is required on the Windows workstations. Printer management and driver downloads are all performed with the familar Microsoft tools on the Windows platform. Group policies and other AD management tools can be used without any special handling.

The print driver we are using can support "Departmental Billing Codes." This means that you can enter a billing code for a group or other special account, and not have the printout billed to you.