Secure release printing
On this page
How it works
Workstations print to one queue instead of to a printer. The job stops on the unit. The person walks to whichever device they like, identifies themselves, picks the job from the panel or from the release page, and it prints there. Nothing sits in an output tray waiting for the wrong person to pick it up, and the sixty per cent of jobs that are sent twice or regretted are never printed at all.
The hold queue
One queue per site. It is a normal raw or IPP target, so workstations need no software beyond a printer definition pointing at the unit.
| Protocols accepted | Raw 9100 and IPP 631. Both feed the same queue. |
|---|---|
| Driver | The driver of the most capable device in the pool, installed on workstations as usual. The unit does not convert between page description languages. |
| Pools | Devices are grouped into a pool; a job may be released on any device in its pool. |
| At rest | Job data is encrypted on the unit with a key generated at first boot and held only there. A stolen unit yields nothing; a replaced unit loses the queue. |
| Accounting | Released jobs are recorded against the user and the device: pages, colour, duplex, size. |
mluctl release enable
mluctl release pool add "HQ floor 2" --devices 10.20.4.31,10.20.4.32,10.20.4.35
mluctl release pool list
mluctl queue list --user <login>Identifying the user
Three methods, and they can run together. Whichever is used, the identity must match the owner recorded on the job, which comes from the workstation.
| Method | Needs | Notes |
|---|---|---|
| PIN at the device panel | Nothing extra | Simplest. Four to eight digits, set by the user on the release page, stored hashed. |
| Card at a reader | A reader attached to the device | Fastest in practice. The first card tap is bound to an account once, using a one-time PIN. |
| Release page | A browser on any device | The fallback, and what you use while training a floor. |
Where a directory is configured, accounts and card numbers are looked up there; otherwise the unit keeps its own list of users. Mixed setups work, and a local account always wins over a directory account with the same name, so that a broken directory cannot lock the floor out of its printing.
Retention and limits
| Setting | Default | Maximum | Why |
|---|---|---|---|
| Hold time | 24 h | 72 h | Longer and the queue fills with jobs nobody will collect. |
| Job size | 200 MB | 1 GB | A single badly generated PDF can be larger than the day’s entire print volume. |
| Queue size | 8 GB (MLU-1) | 60 GB (MLU-1P) | Beyond this, the oldest jobs are dropped and alert MLU-401 is raised. |
| Jobs per user | 40 | 200 | Catches a loop on a workstation before it fills the disk. |
| Re-print after release | allowed for 2 h | 24 h | Convenient, and the second copy is still accounted for. |
mluctl release limits show
mluctl release limits set --hold 48h --max-job 400MB --max-user-jobs 60Releasing at a different device
Any device in the same pool, any time, with no action from an administrator. Across pools it needs a deliberate move, because the driver may not match the target.
- Check what the job needs: mluctl queue show <job-id> lists page description language, colour, size and finishing.
- Move it: mluctl queue move <job-id> --pool "HQ floor 3".
- If the target pool cannot do what the job asks — A3 on an A4-only pool, stapling on a device with no finisher — the move is refused with a reason rather than silently degraded.
When the unit is unavailable
The failure mode is visible and boring: workstations queue locally, because the target is not answering, and nothing prints until the unit is back. Jobs already held are still there afterwards, as long as the unit itself is the one that comes back.
- Planned maintenance. mluctl release drain stops accepting new jobs, keeps existing ones releasable, and empties the queue naturally over a couple of hours.
- Unplanned outage. Point the floor at a direct printer queue as a fallback. Every site should have one defined and disabled, ready to be enabled — building it during an outage takes an hour nobody has.
- Unit replaced. Held jobs are gone, permanently, because the key was on the old unit. Say so on the floor early; people re-send within minutes and the incident ends there.