After a bunch of grueling research and banging my paws against computers, I managed to set it up in a way that I have my scanner plugged into my server running a saned that I can access from other sane installations on the network.

This post¹ was rather helpful in that regard, but it is quite old and a lot doesn’t apply anymore so I think my setup bears explaining for a current Debian 13 ’trixie’ that is running both on my server and my desktop computer.

Server setup

Ensure scanners work on your server

First make sure that you have sane-utils installed and make sure that your scanner is correctly set up on your server. Unfortunately this depends a bit on the scanner you have. For me this meant downloading my scanner’s drivers from the manufacturer and installing those. After adding my user ada to the scanner group

sudo usermod -a -G scanner ada

the scanner was available and capable of scanning on my server.

You can check if sane is capable of finding your scanner with scanimage -L. If you have chafa installed you can scan a page and view it by running

scanimage --format=jpeg | chafa

Or you can redirect the output of scanimage to a file and view the result by some other means. If you are having trouble accessing the scanner, remember that you should be in the scanner group² for access to the scanner.

Configuring saned

Once you have ensured that your scanner does in fact work, it is time to configure saned. How you do this depends on if your server has a firewall or not and how your network is layed out. For simplicity I will assume that you have a firewall on your server and that your network is a normal home network and that you only intend to access the scanner through a static IPv4 subnet like 192.168.1.0/24.

The file /etc/sane.d/saned.conf needs to have an entry for each host name, IP address or IP subnet that is allowed access to the scanner. For my home network, I entered

192.168.1.0/24

This allows all hosts on my network access over IPv4. Additionally, since I have a firewall on my server, I added

data_portrange = 10000 - 10100

to /etc/sane.d/saned.conf to define the range of ports that saned should use for transferring image data. Later we will add this range to our firewall rules.

The result looks something like

data_portrange = 10000 - 10100
192.168.1.0/24

Next start and enable saned.socket

systemctl enable --now saned.socket

A note on IPv6

Note that since I didn’t add any IPv6 addresses or subnets in the config, saned will refuse connections from those. This also means that you can’t use mDNS hostnames or other local hostnames that resolve to IPv6 addresses as they will probably prioritise IPv6. Since most people on IPv6 in their home networks don’t have a static IP prefix and your router probably also has a firewall the easiest is to append [::]/0 here. Realistically this also means that computers from the far reaches of internet would be able to communicate with your scanner, if your router’s firewall doesn’t disallow that. So make sure that that can’t happen.

Firewall config

Since I also have a firewall (ufw) running, I need to allow sane to talk to other devices on the network. If you don’t have this you can skip this step.

sudo ufw allow saned
sudo ufw allow 10000:10100/tcp

Debian saned.service quirks

Now you might be confused because you thought you could just start saned.service directly. This service is actually masked:

$ systemctl status saned
○ saned.service
     Loaded: masked (Reason: Unit saned.service is masked.)
     Active: inactive (dead)

And you might find yourself, like me, confused at how a masked service is even supposed to be started by socket-activation (i.e. through saned.socket). After some initial confusion about this, I noticed that the service that systemd starts on saned.socket is not as I initially believed saned.service but rather the template unit saned@.service:

$ systemctl cat saned@.service
# /usr/lib/systemd/system/saned@.service
[Unit]
Description=Scanner Service
Requires=saned.socket

[Service]
ExecStart=/usr/sbin/saned
User=saned
Group=saned
StandardInput=null
StandardOutput=append:/var/log/saned.log
StandardError=append:/var/log/saned.log
Environment=SANE_CONFIG_DIR=/etc/sane.d
# Environment=SANE_CONFIG_DIR=/etc/sane.d SANE_DEBUG_DLL=255

[Install]
Also=saned.socket

Anyhow I thought this was worth mentioning in case you need a drop-in file or something for saned somewhere as it caused me a bit of confusion.

Client setup

Now after you have configured saned to allow access to your client machines, set up firewall rules for saned and started/activated the saned.socket, all you need to do is edit /etc/sane.d/net.conf and add the server’s IP address³ here

connection_timeout = 60
192.168.1.2

Now you should be able to see the scanners from that host using scanimage -L, provided that your local user is in the scanner group. You can use any sane frontend software like xsane, simple-scan and similar to scan from your scanner now.

Caveats

I have been using this to scan a lot of documents lately and generally this works well for my setup. There are some things to note however:

• I want to set up sane-airscan at some point to avoid having to edit /etc/sane.d/net.conf directly. I think this probably involves talking to avahi in some fashion and I haven’t been too eager to do that yet.
• Unfortunately I can’t use my scanner’s transparency unit this way and can’t scan film negatives or slides over the network. Maybe there is a way around this, but I haven’t found it yet.

Happy scanning!