CUPS jobs stay pending — permission reset guide
Joe B.
Reviewed for technical accuracy
Specialities: Linux (Ubuntu/Fedora/Debian/Arch), CUPS, IPP, Printers, Networking
CUPS jobs stuck on pending / held for authentication — Ubuntu, Debian, Fedora, Arch, Raspberry Pi
Technician
http://localhost:631 works and whether jobs show “Pending”, “Held for authentication”, “Filter failed”, or “Processing – not authorized”.
Technician
• User not in the
lp or lpadmin groups; no rights to manage queues or authenticate to the CUPS web interface.• Wrong ownership/permissions on
/var/run/cups, /var/spool/cups, or /etc/cups after an upgrade.• Polkit/AppArmor/SELinux rules denying access to USB devices or the
ippusbxd backend.• Backend/driver mismatch (HPLIP, Gutenprint, IPP Everywhere) or IPP-over-USB not enabled.
• Stale jobs and filters; CUPS needs a clean spool and service restart.
Plan: reset permissions, add you to lpadmin, clear the spool, and restart
cupsd.
Technician
1) Add your user to lpadmin and lp: run “sudo usermod -aG lpadmin,lp <your-username>” and sign out/in.
2) Reset ownership of CUPS directories: ensure
/var/run/cups and /var/spool/cups belong to root:lp with mode 755/700 and that /etc/cups is root:lp 755; the files inside can be 644.3) Clean the queue: “cancel -a” then remove temporary files from
/var/spool/cups if any are stuck.4) Restart services: “sudo systemctl restart cups” (and “cups-browsed” if present). On Fedora/RHEL restart
cups and cups.socket.5) Re-enable the printer and accept jobs: “lpadmin -p PRINTER -E” and set it default with “lpoptions -d PRINTER”.
6) Test with “lpstat -t” and a one-page test print from the CUPS web UI at
http://localhost:631/printers.
Technician
• Confirm you’re in the lpadmin group, then restart your session.
• In
/etc/cups/cupsd.conf ensure the “WebInterface Yes” is set and the Policy default blocks allow AuthType Default with Require user @SYSTEM for admin sections.• Reload with “sudo systemctl reload cups”. If you still get 403 Forbidden, check polkit rules in
/usr/share/polkit-1/actions/org.cups.cupsd.policy and confirm your desktop prompts for admin auth.• On SELinux systems (Fedora/RHEL), temporarily set to permissive to test: if printing works, allow the denied AVCs or enable the cupsd_enable_ldap or USB rules as needed. On AppArmor (Ubuntu), ensure the cupsd profile isn’t blocking backends.
Technician
• Install or repair HPLIP for HP, or use the IPP Everywhere / driverless model. Recreate the queue with “lpadmin -p PRINTER -v ipp-usb://…” if your device supports IPP over USB.
• Ensure the ipp-usb service is enabled (Ubuntu 22.04+). It exposes the printer as an IPP device on
localhost which avoids low-level USB permission issues.• Verify udev rules in
/usr/lib/udev/rules.d/ reference your vendor ID; install the printer vendor package if missing.• For network printers, confirm firewall rules (UFW/firewalld) allow IPP (631/tcp) and mDNS/Avahi for discovery.
Technician
• Keep CUPS, cups-filters, and backends (HPLIP, Gutenprint, ipp-usb) updated.
• Set the queue to accept jobs and start at boot: “systemctl enable cups”.
• Periodically clear old jobs with a cron task running “cancel -a” and rotating
/var/log/cups/error_log.• Use driverless or IPP Everywhere where possible to reduce filter errors.
• Snapshot
/etc/cups (printers.conf, cupsd.conf) so you can quickly restore working configs after upgrades.
Technician
/var/run/cups and /var/spool/cups, clear the queue, and restart cupsd. Fix driver/backend issues by using IPP Everywhere or repairing HPLIP. Still stuck? Open the chat and a Linux printing expert will help.
Quick answer: the accepted fix
Accepted fix when CUPS jobs are pending on Linux: add user to lpadmin, reset permissions for /var/run/cups, /var/spool/cups, and /etc/cups, cancel all jobs, and restart cups. Recreate the queue using IPP Everywhere / driverless or reinstall vendor drivers (HPLIP/Gutenprint).
CUPS shows “Held for authentication” or 403 Forbidden
Join the lpadmin group, re-login, and confirm CUPS policies in cupsd.conf. If the CUPS web interface denies access, reload cupsd and check polkit/SELinux/AppArmor rules. Enabling WebInterface Yes and allowing @SYSTEM users typically restores admin access.
How to verify printing works
Run lpstat -t to confirm the printer is idle and accepting jobs. Print the CUPS test page from http://localhost:631/printers. If it fails with “filter failed”, switch to driverless / IPP-over-USB or reinstall the backend package.
CUPS “Pending” — troubleshooting tips
Most Linux printing stalls are permission or backend policy problems.
Quick path: add to lpadmin → fix directory ownership → clear the spool → restart cupsd → use IPP Everywhere or vendor drivers → check polkit/SELinux/AppArmor if admin prompts fail.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including Linux and CUPS specialists.
Expert will respond in minutes
We match you with a Linux printing Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
Why do CUPS jobs stay pending on Linux?
Usually the user lacks lpadmin rights or CUPS directories have wrong ownership after an upgrade. Reset permissions on /var/run/cups and /var/spool/cups, add the user to lpadmin, clear the spool, and restart CUPS.
How do I enable access to the CUPS web interface?
Join the lpadmin group, ensure WebInterface Yes in cupsd.conf, and allow @SYSTEM users for admin tasks. Reload cupsd and confirm polkit prompts for authentication.
“Held for authentication” — what now?
Recreate the printer using IPP Everywhere or vendor drivers and make sure your account can authenticate. On desktops, a polkit agent must be running; on servers, use lpadmin with sudo.
USB printer shows “permission denied” in the log
Enable ipp-usb (IPP over USB) or install the vendor’s udev rules. Check AppArmor/SELinux for denials and allow the CUPS backend.
Which driver should I use?
Prefer driverless / IPP Everywhere when your printer supports it. Otherwise use HPLIP for HP, Gutenprint for many models, or the manufacturer’s PPD.
| Symptom | Likely cause | Quick fix |
|---|---|---|
| Job stuck on Pending/Held | Missing lpadmin rights; bad spool perms | Add to lpadmin; reset /var/run/cups and /var/spool/cups; restart cupsd |
| 403 Forbidden in web UI | CUPS policy/polkit denies admin | Enable WebInterface; allow @SYSTEM; reload cupsd; check polkit |
| Filter failed / permission denied | Backend blocked; wrong driver | Use IPP Everywhere/ipp-usb; reinstall HPLIP/Gutenprint |
| Network printer not discovered | Firewall or mDNS disabled | Allow IPP 631/tcp and Avahi/mDNS; add by IPP URI |
Step‑by‑step (Linux permission reset)
- Add your user to lpadmin, lp, then sign out/in.
- Fix ownership:
/var/run/cupsand/var/spool/cups→ root:lp; ensure secure modes. - Clear jobs with cancel -a and restart cups/cups-browsed.
- Recreate the printer using driverless / IPP Everywhere (or vendor driver) and set as default.
Step‑by‑step (network/USB backends)
- Enable ipp-usb for IPP over USB or use the native network IPP URI.
- Open firewall for IPP (631/tcp) and ensure avahi-daemon is running for discovery.
- Print a CUPS test page and inspect
/var/log/cups/error_logat “Info” or “Debug” level if issues persist.
Sources
- CUPS — Official documentation
- IPP over USB (ipp-usb)
- Arch Wiki — CUPS
- Ubuntu — Printers
- HPLIP — HP Linux Imaging and Printing
Filed under: macOS printing & CUPS
Related articles
- CUPS Bad Request or TLS Error on Linux — What's Breaking It and How to Fix It
- CUPS sees printer but “Filter failed” — missing PPD/filter fix
- CUPS Filter Failed Linux — Ghostscript & cups-filters Fix Guide
- CUPS “admins-only access” (Forbidden)
- Fedora PDF background missing — poppler flag
- Ubuntu sandboxed PDF viewer wrong color — Ghostscript route (print/render)
- Linux cups-browsed gives wrong PPD — force assign (without breaking auto-discovery)
- macOS Photos Book Export Has Blurry Text — What's Lowering the Quality and How to Get Sharp Results