PrintMarshal Self-Hosted · Apache-2.0
Wiki GitHub ↗ Get started
Capabilities & Implementation Status

Outcome-oriented capabilities with explicit driver boundaries.

Every feature below pairs real captures of the shipped PrintMarshal web console with verified implementation status labels—distinguishing what runs today over standards SNMP, IPP, and TLS probes from operations that require a vendor driver.

✓ Implemented

Ships end-to-end in the binary and works against supported protocols or standard endpoints today.

◐ Device-dependent

Implemented in PrintMarshal; depth or writability depends on what the target printer exposes via SNMP/IPP/eSCL.

⬚ Requires additional driver

Workflow, UI, and job engine ship today, but device execution requires a vendor driver interface not yet shipped.

◈ Simulator-only

End-to-end execution is restricted to opt-in simulator targets (pm-sim / fwsim) for safe workflow evaluation.

01 · Security Posture & Certificates

Assess protocol, TLS, and certificate exposure across the fleet.

Evaluate printers against the built-in 14-item Baseline policy or custom policies, inspect TLS handshakes on ports 443 and 631, and manage CA certificate enrollment.

✓ Policy Assessment Implemented ✓ SCEP / EST / ACME Enrollment ⬚ Remediation & Cert Install require driver

What you can investigate and operate

  • 17-item security catalog & 14-item Baseline policy: Evaluates SNMPv1/v2c, SNMPv3, Telnet (:23), FTP (:21), HTTPS (:443), HTTP-to-HTTPS redirect, minimum TLS version, admin password set, identity certificate presence/expiry/self-signed status, Raw 9100, WS-Discovery, SLP, and LLMNR.
  • Weighted scoring that preserves unknowns: Items evaluate to pass, fail, or unknown (severity weights: Critical 4, High 3, Medium 2, Low 1). Unknown items are excluded from the score denominator and listed explicitly.
  • Management-path lockout protection: Remediation checks whether disabling SNMPv1/v2c or plain HTTP would sever the only reachable management path to the device.
  • Certificate inventory & CA enrollment: Tracks installed, TLS-observed, and PrintMarshal-issued certificates with 30 / 14 / 7 day expiry alerts. Enrolls certificates via SCEP, EST, or ACME DNS-01 (with manual DNS TXT creation).
Necessary boundary: Security assessment is not automatic remediation, and certificate enrollment is not certificate installation. Applying security remediations or staged credential rotations to a printer requires a driver with SecurityWriter (CapWriteSecurity), and installing an issued certificate onto a printer requires a CertManager driver. No real-vendor SecurityWriter or CertManager ships today.
/devices/c50ea9fb… (Security tab) — Per-device policy & certificate state
Device Security tab showing 4/5 items passing, Non-compliant status, failing SNMP v1/v2c, and 9 unknown items. Focused mobile view of the Compliance · Baseline card.
02 · Fleet Discovery & Monitoring

Multi-method discovery, deterministic deduplication, and consumable forecasting.

Build an accurate inventory across office subnets without duplicate device records or overwritten operator notes.

/devices — Reconciled fleet inventory & supply levels
Devices inventory table showing 5 discovered printers with status pills, supply bars, and page counts. Mobile cards view of discovered printers.
✓ Discovery & Traps Implemented ◐ Telemetry depth is Device-dependent

How discovery and monitoring work

  • Active + passive discovery: Scan CIDR blocks, IP ranges, or individual hosts via SNMPv1/v2c/v3, IPP/IPPS, eSCL, and TCP port probes (9100, 515, 631, 80, 443), or enable passive mDNS, WS-Discovery, and SSDP listeners.
  • Identity reconciliation hierarchy: Matches records by serial → UUID → MAC → IP address. Operator-edited fields (displayName, location, assetTag, notes) are protected from poll overwrites.
  • Consumables, burn rates & stock rooms: Computes 14-day linear regression burn rates from supply history, estimates days remaining, and tracks spare cartridge inventory across stock rooms.
  • Static & dynamic rule groups: Organize printers into static lists or dynamic rule groups (AND/OR predicates on make, model, firmware, location, state, or subnet).
03 · Configuration Management

Snapshots, drift detection, dry-run previews, and read-back verification.

Inspect normalized printer settings across 7 areas, compare devices, preview profile changes without network writes, and verify every applied setting by reading the device back.

✓ Snapshots, Diff & Dry-Run Implemented ◐ Standards SNMP/IPP writable keys

Controlled configuration lifecycle

  • 35-key canonical catalog across 7 areas: Normalizes settings across identity, network, protocols, security, trays, power, and print. Secret-typed values are masked and never returned in plaintext.
  • Mandatory dry-run preview: Profile apply (POST /api/profiles/{id}/apply) defaults to dryRun: true, reading live device values and reporting would_write, unchanged, or unsupported per setting. Batches over 10 devices require typed confirmation.
  • Read-back verification: After writing, PrintMarshal re-reads each changed key and records verified (matches target), diverged (device accepted write but reports a different value), or unverifiable.
  • Stored rollback history: Every real write saves prior values so operators can preview and revert changes from the device's Write history card.
Writable keys over standards drivers: Standards snmp writes identity.hostname (sysName), identity.location (sysLocation), identity.contact (sysContact), identity.printerName (prtGeneralPrinterName), trays.defaultInputIndex, and print.defaultMarkerIndex. Standards ipp writes printer-location, printer-info, printer-organization, printer-organizational-unit, and *-default print/media attributes when the printer advertises Set-Printer-Attributes. No vendor-private ConfigWriter ships today.
/profiles/:id/apply — Dry-run preview before confirmation
Dry-run preview screen showing 1 device that would change and 2 setting writes. Focused view of Changes by setting in dry-run preview.
/devices/c50ea9fb… — Configuration snapshots & verified write history
Device Configuration tab showing Snapshot history and Write history with 1 verified write and Revert button. Focused view of the Write history card.
04 · Device Model Catalogue & Drivers

126 researched enterprise families—with strict separation between documentation and live observation.

The embedded catalog (internal/catalog/enterprise_printers.json) indexes 495 base model identifiers across 15 brands while keeping unvalidated research distinct from observed driver capabilities.

/catalog — Enterprise printer research catalogue
Device model catalogue showing 126 families across 15 brands and 0 physically validated badge. Support & evidence card for Ricoh RI02.
✓ 3 Standards Drivers ◐ 13 Vendor Plugins (Read/Identify)

How drivers and catalog evidence combine

  • Three standards drivers (snmp, ipp, escl): Provide the baseline for identity, status, supplies, trays, counters, alerts, configuration read/write, and scanner status.
  • Thirteen compiled-in vendor plugins:
    • HP (hp, IANA 11): Identity + read-only PML total impressions and LEDM XML status/consumables/counters.
    • Ricoh (ricoh, IANA 367) & Canon (canon, IANA 1602): Identity + probe-gated private MIB total impression counters.
    • Brother, Lexmark, Xerox, Epson, Kyocera, Konica Minolta, Sharp, Toshiba, OKI, Fujifilm: Brand/model/serial normalisation (CapIdentify); operational reads and writes fall back to standards drivers.
  • Lab qualification overrides: Every catalog family ships as research_candidate_unvalidated (0 physically validated in the shipped catalog). Operators can record Lab-validated in your fleet or Blocked in your fleet per family.
05 · Firmware, Print Release & Observability

Campaign orchestration, pull-print release, and SIEM/Prometheus telemetry.

✓ Artifact & Campaign Engine ◈ Delivery is Simulator-only

Firmware repository & campaigns

Upload firmware images with verified SHA-256 digests, record signature metadata (verified / unsigned / unverified), and orchestrate canary → staged wave campaigns with automatic failure halts.

Simulator-only delivery: Only the built-in fwsim driver implements FirmwareUpdater today, gated by PM_FIRMWARE_SIM_TARGETS. Physical printer firmware upload requires a vendor driver.
Wiki: Firmware Management →
◐ IPP Hold/Release Device-dependent ✓ Accounting Import

Print management & badge release

Upload PDF/PostScript/PWG-Raster jobs into a hold queue, release via the console or POST /api/print/release/card badge reader webhook, and import PaperCut or uniFLOW CSV/JSON accounting logs.

Boundary: PrintMarshal is not a virtual print queue or print driver server. Native IPP hold/release requires printer support for RFC 3998 (Hold-New-Jobs / Release-Job).
Wiki: Print Management →
✓ Implemented

Prometheus metrics, notifications & SIEM

Expose fleet, alert, supply, and job metrics on GET /metrics, dispatch alerts via Email (SMTP), Slack, or HMAC-SHA256 webhooks with quiet hours and escalations, and stream audit events over RFC 5424 Syslog / CEF.

Note on reports: GET /api/reports/utilization, cost, and supplies-forecast are implemented; GET /api/reports/compliance is a placeholder (use /api/compliance for live assessments).
Wiki: API & Metrics Reference →
Product screenshot
Enlarged product screenshot