documentation_complete: true

prodtype: rhel7

title: 'Disable Print Server Capabilities'

description: |-
    To prevent remote users from potentially connecting to and using
    locally configured printers, disable the CUPS print server sharing
    capabilities. To do so, limit how the server will listen for print jobs by
    removing the more generic port directive from /etc/cups/cupsd.conf:
    <pre>Port 631</pre>
    and replacing it with the <tt>Listen</tt> directive:
    <pre>Listen localhost:631</pre>
    This will prevent remote users from printing to locally configured printers
    while still allowing local users on the system to print normally.

rationale: |-
    By default, locally configured printers will not be shared over the
    network, but if this functionality has somehow been enabled, these
    recommendations will disable it again. Be sure to disable outgoing printer list
    broadcasts, or remote users will still be able to see the locally configured
    printers, even if they cannot actually print to them. To limit print serving to
    a particular set of users, use the Policy directive.

severity: unknown

identifiers:
    cce@rhel7: 80284-3

references:
    nist: CM-7
