Detections
Analytics

2.1.11 Ensure print server services are not in use

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Common Unix Print System (CUPS) provides the ability to print to both local and network printers. A system running CUPS can also accept print jobs from remote systems and print them to local printers. It also provides a web based remote administration capability.

If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be removed to reduce the potential attack surface.

Solution

Run the following commands to stop cups.socket and cups.service, and remove the cups package:

 # systemctl stop cups.socket cups.service
 # apt purge cups

 - OR -

 - IF - the cups package is required as a dependency:

Run the following commands to stop and mask the cups.socket and cups.service :

 # systemctl stop cups.socket cups.service
 # systemctl mask cups.socket cups.service

Impact:

Removing the cups package, or disabling cups.socket and/or cups.service will prevent printing from the system, a common task for workstation systems.

There may be packages that are dependent on the cups package. If the cups package is removed, these dependent packages will be removed as well. Before removing the cups package, review any dependent packages to determine if they are required on the system.

 - IF - a dependent package is required: stop and mask cups.socket and cups.service leaving the cups package installed.

See Also

https://workbench.cisecurity.org/benchmarks/18959

Item Details

References: CSCv7|9.2

Plugin: Unix

Control ID: 41ec28c1f39e16e029a94320a1302535bc44ae2e8060f19df60afbcf6bed1cf2