{"description": "By default, CUPS listens on the network for printer list\nbroadcasts on UDP port 631. This functionality is called printer browsing.\nTo disable printer browsing entirely, edit the CUPS configuration\nfile, located at <tt>/etc/cups/cupsd.conf</tt>, to include the following:\n<pre>Browsing Off\nBrowseAllow none</pre>", "rationale": "The CUPS print service can be configured to broadcast a list of\navailable printers to the network. Other systems on the network, also running\nthe CUPS print service, can be configured to listen to these broadcasts and add\nand configure these printers for immediate use. By disabling this browsing\ncapability, the system will no longer generate or receive such broadcasts.", "severity": "unknown", "references": {"cis-csc": ["11", "14", "3", "9"], "cobit5": ["BAI10.01", "BAI10.02", "BAI10.03", "BAI10.05", "DSS05.02", "DSS05.05", "DSS06.06"], "isa-62443-2009": ["4.3.3.5.1", "4.3.3.5.2", "4.3.3.5.3", "4.3.3.5.4", "4.3.3.5.5", "4.3.3.5.6", "4.3.3.5.7", "4.3.3.5.8", "4.3.3.6.1", "4.3.3.6.2", "4.3.3.6.3", "4.3.3.6.4", "4.3.3.6.5", "4.3.3.6.6", "4.3.3.6.7", "4.3.3.6.8", "4.3.3.6.9", "4.3.3.7.1", "4.3.3.7.2", "4.3.3.7.3", "4.3.3.7.4", "4.3.4.3.2", "4.3.4.3.3"], "isa-62443-2013": ["SR 1.1", "SR 1.10", "SR 1.11", "SR 1.12", "SR 1.13", "SR 1.2", "SR 1.3", "SR 1.4", "SR 1.5", "SR 1.6", "SR 1.7", "SR 1.8", "SR 1.9", "SR 2.1", "SR 2.2", "SR 2.3", "SR 2.4", "SR 2.5", "SR 2.6", "SR 2.7", "SR 7.6"], "iso27001-2013": ["A.12.1.2", "A.12.5.1", "A.12.6.2", "A.14.2.2", "A.14.2.3", "A.14.2.4", "A.9.1.2"], "nist": ["CM-7(a)", "CM-7(b)", "CM-6(a)"], "nist-csf": ["PR.IP-1", "PR.PT-3"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "printer browsing is not disabled", "ocil": "To verify that CUPS printer browsing is disabled, run the following command:\n<pre>$ sudo grep \"Browsing\\|BrowseAllow\" /etc/cups/cupsd.conf</pre>\nThe output should return the following:\n<pre>Browsing Off\nBrowseAllow none</pre>", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": [], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Disable Printer Browsing Entirely if Possible", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/printing/configure_printing/cups_disable_browsing/rule.yml", "template": null}