配置网络扫描仪后saned拒绝访问，请求来源显示localhost异常

Let’s break down this problem step by step—seeing the request come from localhost instead of your client IP is the key clue here. Here are the most likely fixes to try:

1. Verify Saned is Listening on All Network Interfaces #

First, make sure saned isn’t restricted to only local connections. This is a common misconfiguration:

• If you’re using systemd socket activation:
  Check your saned socket file (usually /etc/systemd/system/saned.socket or /usr/lib/systemd/system/saned.socket). Look for the ListenStream line— it should be:

  ListenStream=0.0.0.0:6566
  ListenStream=[::]:6566
  

  If it’s set to 127.0.0.1:6566, saned will only accept local connections, which would explain why client requests show up as localhost (if there’s a port forward or proxy redirecting traffic locally). After editing, reload systemd and restart saned:

  sudo systemctl daemon-reload
  sudo systemctl restart saned.socket saned.service
  

• If you’re using xinetd:
  Open /etc/xinetd.d/saned and ensure:
  • disable = no
  • The server_args line doesn’t include -h 127.0.0.1 (which binds to localhost only)
  • The only_from section includes your client IP ranges (not just localhost)

2. Check for Unintended Port Forwarding/NAT #

If your scanner host has port forwarding rules (either via iptables, firewalld, or a router) that redirect external port 6566 to 127.0.0.1:6566, this will make all client requests appear to come from localhost. Double-check:

• Firewall rules on the host: Use sudo iptables -L -n or sudo firewall-cmd --list-all to look for any PREROUTING/DNAT rules targeting port 6566.
• Router port forwarding settings: Ensure you’re not forwarding the scanner port to the host’s localhost address (it should point directly to the host’s LAN IP).

3. Validate Saned Permissions (Beyond Group Membership) #

You mentioned adding saned to lp and saned groups—let’s confirm those changes are active and sufficient:

• Verify saned’s group membership: Run id saned to check if lp and saned are listed in the groups. If not, re-add them with sudo usermod -aG lp,saned saned and restart saned.
• Check scanner device permissions: Run ls -l /dev/usb/ (or the path to your scanner device) to ensure the device file has read/write permissions for the lp or saned group. If not, create a udev rule to fix this:
  Create /etc/udev/rules.d/99-scanner.rules with:

  SUBSYSTEM=="usb", ATTRS{idVendor}=="YOUR_VENDOR_ID", ATTRS{idProduct}=="YOUR_PRODUCT_ID", GROUP="saned", MODE="0660"
  

  Replace the vendor/product IDs with your scanner’s (find them with lsusb), then reload udev: sudo udevadm control --reload-rules && sudo udevadm trigger

4. Double-Check SANE Configuration Files #

• On the scanner host: In /etc/sane.d/saned.conf, add your client IP ranges (e.g., 192.168.1.0/24) alongside localhost. Don’t rely solely on localhost here—this is just a workaround for the source issue, not the fix.
• On client PCs: In /etc/sane.d/net.conf, add the scanner host’s LAN IP explicitly, like:

  scan-host=192.168.1.50
  

  Avoid using hostnames unless your DNS is fully working on the network.

5. Dig Into Logs for Specific Errors #

You mentioned logs changed when adding localhost—let’s get more details:

• For systemd setups: Run sudo journalctl -u saned -f to watch live logs while trying to connect from a client. Look for lines like access granted (which means the connection is allowed but there’s a device issue) or cannot open device (pointing to permission problems).
• For syslog-based setups: Check /var/log/syslog or /var/log/messages for saned entries—they’ll often tell you exactly why the connection failed (e.g., missing permissions, invalid device path).

Start with the interface listening check first—that’s the most common reason for the localhost source issue. Once you fix that, the client IP should show up correctly in saned logs, and you can adjust the allowed IPs accordingly.

内容的提问来源于stack exchange，提问作者Stefano Bianchi