documentation_complete: true


title: 'Disable Printer Browsing Entirely if Possible'

description: |-
    By default, CUPS listens on the network for printer list
    broadcasts on UDP port 631. This functionality is called printer browsing.
    To disable printer browsing entirely, edit the CUPS configuration
    file, located at <tt>/etc/cups/cupsd.conf</tt>, to include the following:
    <pre>Browsing Off
    BrowseAllow none</pre>

rationale: |-
    The CUPS print service can be configured to broadcast a list of
    available printers to the network. Other systems on the network, also running
    the CUPS print service, can be configured to listen to these broadcasts and add
    and configure these printers for immediate use. By disabling this browsing
    capability, the system will no longer generate or receive such broadcasts.

severity: unknown

references:
    cis-csc: 11,14,3,9
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.02,DSS05.05,DSS06.06
    isa-62443-2009: 4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.9.1.2
    nist: CM-7(a),CM-7(b),CM-6(a)
    nist-csf: PR.IP-1,PR.PT-3

ocil_clause: 'printer browsing is not disabled'

ocil: |-
    To verify that CUPS printer browsing is disabled, run the following command:
    <pre>$ sudo grep "Browsing\|BrowseAllow" /etc/cups/cupsd.conf</pre>
    The output should return the following:
    <pre>Browsing Off
    BrowseAllow none</pre>
