Disable the CUPS print server and printer discovery

Description

CUPS is started by cups.service, cups.socket and cups.path; cups-browsed.service discovers network printers and adds them automatically.

The control passes when each unit is masked or not installed at all.

The socket and path units can start cupsd on their own, so they are masked too.

Rationale

The print stack parses complex documents and network announcements. Flaws in cups-browsed have allowed remote code execution by announcing a malicious printer. Servers rarely print.

Impact

The system can no longer print, and network printers are no longer discovered. Print servers and desktops that print keep CUPS: the control is only in the server and hardened desktop profiles, and can be excluded in the tailoring file.

Audit

Run systemctl is-enabled cups.service cups.socket cups.path cups-browsed.service. Each must print masked, or fail because the unit does not exist.

Automated: every check must pass. Scanners report each check by its id.

cups-browsed

Printer discovery daemon.

unit: cups-browsed.service
state: masked

cups-socket

CUPS socket activation.

unit: cups.socket
state: masked

cups-path

CUPS path activation.

unit: cups.path
state: masked

cups

CUPS scheduler.

unit: cups.service
state: masked

Remediation

Run systemctl mask --now cups-browsed.service cups.socket cups.path cups.service, or apt purge cups cups-daemon cups-browsed if nothing depends on them.

Rollback

Run systemctl unmask cups-browsed.service cups.socket cups.path cups.service then systemctl enable --now cups.service cups-browsed.service.

cups-browsed

Generated from check cups-browsed: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cups-socket

Generated from check cups-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cups-path

Generated from check cups-path: the engine writes the fix for every output, it sets the expected value and the check runs again after.

cups

Generated from check cups: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• cupsd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• cups-browsed(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle