<Group id="printing">
<title>Print Support</title>
<description>The Common Unix Printing System (CUPS) service provides both local
and network printing support. A system running the CUPS service can accept
print jobs from other systems, process them, and send them to the appropriate
printer. It also provides an interface for remote administration through a web
browser. The CUPS service is installed and activated by default. The project
homepage and more detailed documentation are available at http://www.cups.org.
<br /><br /> </description>

<Rule id="service_cups_disabled">
<title>Disable the CUPS Service</title>
<description>
<service-disable-macro service="cups" />
</description>
<ocil><service-disable-check-macro service="cups" /></ocil>
<rationale>Turn off unneeded services to reduce attack surface.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="service_cups_disabled" />
<ref nist="CM-7" />
</Rule>


<Group id="configure_printing">
<title>Configure the CUPS Service if Necessary</title>
<description>CUPS provides the ability to easily share local printers with
other machines over the network. It does this by allowing machines to share
lists of available printers. Additionally, each machine that runs the CUPS
service can potentially act as a print server. Whenever possible, the printer
sharing and print server capabilities of CUPS should be limited or disabled.
The following recommendations should demonstrate how to do just that.
</description>

<Rule id="cups_disable_browsing">
<title>Disable Printer Browsing Entirely if Possible</title>
<description>By default, CUPS listens on the network for printer list
broadcasts on UDP port 631. This functionality is called printer browsing.
To disable printer browsing entirely, edit the CUPS configuration
file, located at <tt>/etc/cups/cupsd.conf</tt>, to include the following:
<pre>Browsing Off</pre>
</description>
<rationale>The CUPS print service can be configured to broadcast a list of
available printers to the network. Other machines on the network, also running
the CUPS print service, can be configured to listen to these broadcasts and add
and configure these printers for immediate use. By disabling this browsing
capability, the machine will no longer generate or receive such broadcasts.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="cups_disable_browsing" />
<ref nist="CM-7" />
</Rule>

<Rule id="cups_disable_printserver">
<title>Disable Print Server Capabilities</title>
<description>To prevent remote users from potentially connecting to and using
locally configured printers, disable the CUPS print server sharing
capabilities. To do so, limit how the server will listen for print jobs by
removing the more generic port directive from /etc/cups/cupsd.conf:
<pre>Port 631</pre>
and replacing it with the <tt>Listen</tt> directive:
<pre>Listen localhost:631</pre>
This will prevent remote users from printing to locally configured printers
while still allowing local users on the machine to print normally.
</description>
<rationale>By default, locally configured printers will not be shared over the
network, but if this functionality has somehow been enabled, these
recommendations will disable it again. Be sure to disable outgoing printer list
broadcasts, or remote users will still be able to see the locally configured
printers, even if they cannot actually print to them. To limit print serving to
a particular set of users, use the Policy directive.
</rationale>
<ident cce="RHEL7-CCE-TBD" />
<oval id="cups_disable_printserver" />
<ref nist="CM-7" />
</Rule>
</Group>

</Group>
