Which TCP IP protocol is used by Windows to share files and printers on a network?

Network Printers

Network printers require the IP address or can be found using Simple Network Management Protocol (SNMP) built into CUPS. There are three network protocols supported by CUPS:

AppSocket Protocol, usually associated with HP JetDirect

Internet Printing Protocol (IPP), normally port 631

Line Printer Daemon (LPD) Protocol, port 515

Deploying Printer Connections

Installing a network printer on a client Windows computer is relatively easy.Now imagine you need to install a network printer on 500 Windows computers. Fortunately, Windows Server 2008 is all about working smarter rather than harder. You can easily install printers on client workstations by deploying them using Group Policy. In the following Sidebar, we will deploy printer connections.

Configuring & Implementing…

Using the Print Management Utility to Deploy Printer Connections

Open Print Management in Server Manager.

Expand Print Servers and expand your target server in the left pane.

Click on the Printers node to view a list of installed printers, as shown in Figure 7.34.

Right-click on the printer you would like to deploy and click the Deploy with Group Policy menu item.

For more information on how to deploy printer connections for Windows Vista and Windows XP clients, visit http://technet2.microsoft.com/windowsserver2008/en/library/8433a76a-0a5d-48f4-893d-35442aa8765e1033.mspx.

Installing a Network Printer

The procedure for installing network printers is a little different from installing locally attached printers. These printers either are directly connected to a network port or use wireless or Bluetooth printers. For printers that are connected directly to a network port, such as TCP/IP printers or wireless printers, the following steps explain the procedure:

Select Add a Network, Wireless, or a Bluetooth Printer in the Add Printer page. The wizard starts searching for the printer.

The wizard will display a list of available printers. Select your printer and click Finish.

If your printer is not listed, click The Printer That I Want Isn’t Listed.

The Find a printer by name or TCP/IP address page appears, as shown in Figure 5.11.

You can add the printer by browsing the network again, by typing the UNC name of the printer, or by specifying the TCP/IP address of the printer. For this exercise, we will select Add a printer using a TCP/IP address or hostname. Click Next.

The Type a printer hostname or IP address page appears, as shown in Figure 5.12.

Select TCP/IP Device in the Device type list. Type the hostname or the IP address of the printer. Notice that Windows automatically adds the port name. Click Next.

The Add Printer Wizard tries to connect to the specified printer. You must make sure that the printer is connected to the network; you have specified a correct TCP/IP address and hostname; and the printer is turned on. If the wizard is not able to connect to the specified port, the Additional Port Information Required page appears, as shown in Figure 5.13.

Select the type of network adapter installed in the printer in the Device Type drop-down list. You can also click Custom to specify custom settings for the network printer. Click Next.

From here onward, the procedure is similar to the one explained previously regarding manual installation of a local printer.

Installing a network printer on print server

Using the print management console, you can manage all your network printers from one central console. One of the first steps you will want to perform is to install network printers on your print server. This can be done by performing the following steps within the print management console:

Select the Printers node under Print Management | Print Servers | your print server name (see Figure 5.38).

Right click the Printers node and select the option Add Printer…

You can choose how to locate the printer you want to install including searching the network, using an existing port, or creating a new port. In this exercise, we will choose the option to search the network (see Figure 5.39). Then click Next.

The printer installation wizard will begin searching the local network for printers. After the search is complete, any network printers found are listed in the wizard as seen in Figure 5.40.

Select the printer you want to install, and then click Next. The wizard will attempt to add a port for the selected printer.

You will next need to give the printer a name and share name (see Figure 5.41). Additionally, you can list location and comments to make it easier for users to find the printer. For example, by using the notation HQ/2nd/Processing Room, users can search for a printer based on its location. When searching Active Directory for printers, a user could enter the search HQ/2nd/* to list all printers on the second floor in the HQ building.

After entering relevant printer information, click Next to continue. Then click Next again to install the printer driver. When the installation is complete you will receive a confirmation page. Click Finish to close the wizard.

Once the printer has been created, you can make the printer more accessible and easier to find by publishing it to Active Directory. To do this, locate the printer in the printer management console and choose properties. Then click the Sharing tab and select the option List in Directory as seen in Figure 5.42. Then click OK.

You can now access this printer from a Windows client by entering the UNC path to the printer share (\\Server Name\Printer Share) or by searching Active Directory as seen in Figure 5.43.

Definition of Policies and Procedures

The compliance legislation discussed previously is sufficient reason for establishing policies and procedures. However, even without being compelled by law, it's always wise to define and document policies and procedures for the IT department, as well as the user community.

For example, there may be an informal policy that has determined when personal printers (as opposed to shared network printers) are permitted. However, if this policy is documented and posted, it helps ensure that all employees (both IT and users) are aware of it and that it can be applied consistently. Other examples of policies that can be defined include:

Password requirements (length, frequency of changes, etc.)

Limits on the size of e-mail messages and mailboxes

Retention period for files and messages

Resources and rules in place for spam and virus defense (e.g., the blocking of certain attachment types)

Rules and approvals needed for nonstandard equipment requests (laptops, over-sized monitors, equipment at home)

Requirements for password-protected screen savers

Process for dealing with nonstandard software requests

Policies for disabling/deleting unused accounts

Policies pertaining to IDs and access for nonemployees (temps, consultants, partners, suppliers, etc.)

Provisions for requesting a restore of files

Approval required for accessing the files of a former or unreachable employee

Employee reimbursement for special services (cell phones, broadband connections at home)

Proper use of IT resources (e.g., no personal use of computer equipment, handhelds)

Guidelines for use of social networking sites during working hours and/or on company equipment.

Limitations of support for company equipment at home

Of course, many of these policies should include comment and approval beyond IT before being considered official. In some cases (e.g., file and message retention), Legal should be involved. In other cases (e.g., company equipment at home), it would be wise to involve HR and Finance. Involving other departments not only helps IT establish partnerships with these groups, but it ensures that IT isn't determining policies in a vacuum.

Citrix Printer Options

Printing is an important consideration as we are changing the physical structure of attaching to our printers. Print job routing is important to consider.

There are three different mechanisms by which Citrix virtual desktops can attach to physical print devices.

1.

Network printers

Session printers

Client autocreated printers

Network Printers

Network printers work exactly the same as they would when using a conventional desktop PC. Network printers are mapped in the conventional way using a login script; the login script could be a simple batch file, .vbs or .kix, for example. The important thing to bear in mind with network printers is the location of the print server, the location of the virtual desktops, and the location of the print device.

The print job will spool on the virtual desktop and traverse the network to the print server, and then to the print device. If your VDI project also includes a centralization aspect, the increase in print traffic needs to be considered. In Figure 5.50, you can see how the print job routes to the physical device.

Figure 5.50. Network printer's job routing.

The print traffic flows outside of the ICA stream and is not able to be compressed as it is outside of the ICA protocol. Physical devices like a Citrix Branch Repeater (or Cisco WAAS/Riverbed, etc.) are the best way to compress this type of traffic.

The print server should always be local to the virtual desktops, and this rule is applicable to all the types of printing. The print device and the user can be remote from the virtual desktop, but the print server should be on the same LAN as the virtual desktop.

Note

The print server and the virtual desktop must have matching drivers. The Windows print server won't load a Citrix universal driver, and consequently the universal drivers can only be used with Client autocreated direct printing.

Client Side Rendering (CSR) is a new “feature” introduced since Windows Vista. This places the load on the client to perform the rendering rather than the server. I would recommend disabling this on a Windows 2008 print server, as it improves the performance of the virtual desktop.

Connect Directly

Connect directly (Figure 5.51) can only be used with network printers. The virtual desktop reads the connection details and creates its own connection to the print server.

Figure 5.51. Autocreated printers using connect directly.

Connect Indirectly

Connect indirectly (Figure 5.52) means that the print jobs always routes through the client device.

Figure 5.52. Autocreated network printers using connect indirectly.

The print traffic to the client flows within the Citrix ICA session. The traffic is then sent to the print server, and from there to the print device.

This can be useful in scenarios where the print server is on a network that is not visible to the virtual desktop, but is visible to the client device (untrusted domains for example). Additionally, if it is unavoidable that the print server is local to the client device, but not to the virtual desktop, you may achieve better compression and management of the print traffic if it is kept within the Citrix Session.

Locally Attached Devices

Locally attached (Figure 5.53) printers by their very nature always connect indirectly. As the physical device is attached to the client device, the print job will always route through the client device. A local print device could be connected through a USB or LPT port.

Figure 5.53. Autocreated local print devices.

Scanners

We can use a large number of scanning tools to assist in detecting various security flaws when we are looking at hosts. Although we discussed this in Chapter 8 from a network perspective, such tools can also be used to enhance the security of our hosts. We can look for open ports and versions of services that are running, examine banners displayed by services for information, examine the information our systems display over the network, and perform a large number of similar tasks.

Earlier in this chapter, when we were discussing hardening, we looked at a very simple example of using Nmap to look at a device over the network in order to discover the ports that had services listening on them. Nmap actually has a very large and broad set of functionality and can give us considerably more information if we ask it to do so. In Figure 9.3, we can see the results of an Nmap scan directed against a network printer. In this case, we asked Nmap to also look for the particular versions of the services it found, and to attempt to identify the operating system running on the device. If we look at port 9220 in the listing, we can see that the service is hp-gsg, which, although a bit cryptic, might give us somewhat of a clue that it is a service specific to HP printers, but if we look at the version information on the same line, we can see very specifically that the service is HP Generic Scan Gateway 1.0. Based on this information, we might have a much better chance of successfully being able to attack the device.

Alert!

Looking closer at the Nmap results in Figure 9.3, you will notice that Nmap told us the device being scanned was a printer, but it also told us it was running Mac OS X as an operating system. Sometimes Nmap’s OS fingerprints can be a little skewed from what is actually on the device, so it is often best to verify the output from Nmap with another tool if something looks odd.

In addition to the many features built into Nmap, we can create custom Nmap functionality of our own, through the use of the Nmap Scripting Engine (NSE).

Copying Files to and from Devices

You can specify the source and destination in the Copy command as devices such as COM1 and LPT1, instead of as files or folders. In this case, the command either takes the input from a device or writes to it. When copying to and from a device, you must use the Ctrl + Z character to mark the end of the file. This character is shown in the command-line window as ^Z but is not sent to the destination device. The following sections discuss the supported devices you can use with the Copy command.

2.1.9 Optimizations for Small Cells and Local Access

In order to allow for access to content that is physically located close to the base station, alternative solutions for allowing local IP connectivity have been specified in the architecture. One example is a small-sized base station located on a corporation’s premises and being accessed by employees who primarily want to access the corporate Intranet. The 3GPP architecture specifies multiple options for how to realize this, which will be further described in Chapter 14. One option, referred to as LIPA (Local IP Access), means that the base station has a built-in IP GW functionality referred to as L-GW (Local GW), which is a simplified variant of a combined Serving GW + PDN GW. The LIPA feature developed in Release 10 is geared more towards end-user premise function where traffic towards a local network (printers, file storage, etc.) can be sent to/received from. The architecture is shown in Figure 2.20.

Note that the LTE base stations for corporate or home usage are called HeNB – “Home eNB” – in order to distinguish these from the eNBs serving the macro network. Regardless of whether LIPA is used or not, there is an optional HeNB GW in the architecture between the MME and the HeNBs. This GW appears to the MME as one single eNB, and as an MME towards all HeNBs. The HeNB GW relays messages between the MME and the HeNBs while protecting the MME from signaling due to, for example, HeNBs being powered on and off. It also allows for an efficient scaling of the number of HeNBs that can be connected to an MME. In order to protect the signaling and user traffic between the HeNBs and the HeNB GW and/or the MME and SGW, a Security GW is deployed (not shown in the figure).

The concept of “Closed Subscriber Groups” (CSG) is used to control access to specific cells, typically in home or enterprise locations. CSG identifies a group of subscribers as “members” who are permitted to access one or more CSG cells of the PLMN. A CSG manager can add, delete, or modify CSG subscription for a user.

Role of the systems librarian