Secure Internet Printing???

**Andy Roberts** · September 24th, 2004, 10:49 AM

Quick question?

Is IPP a secure way to print over the Internet?

Basically, we are going through a remote working project here with Thin Clients accesing a Citrix NFuse system over a broadband connection. We need a way for the users to be able to print which I can get working by external ip addresses and port forwarding on routers but this means the print job isn't encrypted on its way to the printer over the internet.

I know I can create a VPN in but we want to move away from this as we might be getting upwards of 200 remote users so I don't want to do a VPN for each.

We were gonna have Citrix autocreate local printers but we have had loads of probs in the past with this.

Can we get a way to get the Thin Clients to auto create a locally connected printer which pops up in the NFuse session even though NFuse is set not to auto create local printers??

Alternativly, is there a way we can securely send print jobs over the web??

Ta!

**imaeditedbysowulo** · September 24th, 2004, 04:26 PM

Figuring out the proper way for them to be installed thru Citrix is your best bet. I never had much problem with HP laser printers thru citrix, but Canons or any kind of inkjet printer was a nightmare.

What type of printers are you dealing with?

**Andy Roberts** · September 27th, 2004, 02:17 AM

Originally Posted by imaeditedbysowulo

Figuring out the proper way for them to be installed thru Citrix is your best bet. I never had much problem with HP laser printers thru citrix, but Canons or any kind of inkjet printer was a nightmare.

What type of printers are you dealing with?

We have nearly all HP Laser printers here but ithankfully on the remote sites they are all going to be HP LaserJet 2300DN's.

**confus-ed** · September 27th, 2004, 02:24 AM

It is required that the Internet Printing Protocol be able to operate
within a secure environment. Wherever possible, IPP ought to make use
of existing security protocols and services. IPP will not invent new
security features when the requirements described in this document can
be met by existing protocols and services. Examples of such services
include Secure Sockets (SSL), Digest Access Authentication in HTTP,
and the Content MD-5 Header Field in MIME.

It is difficult to anticipate the security risks that might exist in
any given IPP environment. For example, if IPP is used within a given
corporation over a private network, the risks of exposing print data
may be low enough that the corporation will choose to not use
encryption on that data. However, if the connection between the
client and the Printer is over a public network, the client may wish
to protect the content of the information during transmission through
the network with encryption.

The guys who designed it don't seem to think its very secure in itself, that pretty much says to me its dependent on what you run it inside, as to how secure it is - from here

So yeah citrix client printing then

, especially if you've only got to figure out how to do one kind of printer..

**Andy Roberts** · September 27th, 2004, 02:34 AM

Originally Posted by confus-ed

The guys who designed it don't seem to think its very secure in itself, that pretty much says to me its dependent on what you run it inside, as to how secure it is - from here

So yeah citrix client printing then

, especially if you've only got to figure out how to do one kind of printer..

Thanks. Looks like for now we'll have to got down the individual VPN routes just to get secure printing.

Oh well.

Thanks for your help guys..

**confus-ed** · September 27th, 2004, 03:17 AM

How many locations btw ? can't some share ? then you just need a vpn to each place ?

Or even a lightweight print server(s) ? (I dunno how practical any of this is without knowing the 'spread' - so they might all be rubbish ideas ! )

**Andy Roberts** · September 27th, 2004, 03:34 AM

Originally Posted by confus-ed

How many locations btw ? can't some share ? then you just need a vpn to each place ?

Or even a lightweight print server(s) ? (I dunno how practical any of this is without knowing the 'spread' - so they might all be rubbish ideas ! )

We are rolling out home working for a large number of users (potentially 100+ by the end of the year) with more next year. The company are not allowing them to use there own home PCs even though we have NFuse in and all they would need to do is connect via a web browser. So they are being forced to have Thin Clients, Printers, TFT screens and desks etc seperate to any home equipment they have.

If we could enable citrix local printer creation it would be a doddle but we can't because of the problems we've had in the past with it and the Citrix bods not being able to solve the issues (lack of time).

**confus-ed** · September 27th, 2004, 03:52 AM

I think I feel forced to agree with your implication & say thats a silly idea ! .. but I ain't signing the cheques or in a position to tell the citrix dudes to 'get their act together' either !

!!

**Andy Roberts** · September 27th, 2004, 04:32 AM

Originally Posted by confus-ed

I think I feel forced to agree with your implication & say thats a silly idea ! .. but I ain't signing the cheques or in a position to tell the citrix dudes to 'get their act together' either !

!!

Nice to see that somone agrees with me for a change

You can tell the bosses its the wrong way to do things till your blue in the face but they never listen :butt:

Funny how this world works ain't it!

**confus-ed** · September 27th, 2004, 04:58 AM

Originally Posted by Andy Roberts

Nice to see that somone agrees with me for a change

You can tell the bosses its the wrong way to do things till your blue in the face but they never listen :butt:

Does this sum it up for you ?

? ..

I see the Technichally Challenged leading the chequebook obscured all the time, its like a disease in the industry..

If I had just a pound for how many times I've heard 'I said that when we were planning it' from some tech who wasn't listened to I'd be rich !

**Andy Roberts** · September 27th, 2004, 07:45 AM

Originally Posted by confus-ed

Does this sum it up for you ?

? ..

I see the Technichally Challenged leading the chequebook obscured all the time, its like a disease in the industry..

If I had just a pound for how many times I've heard 'I said that when we were planning it' from some tech who wasn't listened to I'd be rich !

So true.....

The thing that has tipped this on its head is that we already have an agreed remote working setup and spec and now at the last minute my boss goes "why isn't this wireless?? Its always been a wireless setup so make it wireless now!" You tell him it'll take a bit to make sure its all setup OK and that the wireless security is tight <cough> and you get "thats b****cks, I set my wireless router up at home in 10 minutes and thats solid secure!"

You know its no point arguing that one ......