From 9fb0f21becad96ac8046c7055ecfb6e2a1b14c05 Mon Sep 17 00:00:00 2001 From: Denis Chevalier Date: Thu, 6 Aug 2026 14:37:26 +0200 Subject: finish cups fix --- etc.bash | 4 + etc/cups/cupsd.conf | 208 ++++++++++++++++++++++++ etc/systemd/system/cups.service.d/override.conf | 3 +- 3 files changed, 214 insertions(+), 1 deletion(-) create mode 100644 etc/cups/cupsd.conf diff --git a/etc.bash b/etc.bash index 41ce6f2..2795e22 100755 --- a/etc.bash +++ b/etc.bash @@ -48,3 +48,7 @@ sudo cp -v ./etc/systemd/system/fail2ban.service.d/override.conf /etc/systemd/sy echo "==> Applying cups.service hardening..." sudo cp -v ./etc/systemd/system/cups.service.d/override.conf /etc/systemd/system/cups.service.d/ + +sudo mkdir -p /var/log/cups +sudo chown root:lp /var/log/cups +sudo chmod 755 /var/log/cups diff --git a/etc/cups/cupsd.conf b/etc/cups/cupsd.conf new file mode 100644 index 0000000..6a08eb8 --- /dev/null +++ b/etc/cups/cupsd.conf @@ -0,0 +1,208 @@ +# +# Configuration file for the CUPS scheduler. See "man cupsd.conf" for a +# complete description of this file. +# + +# Log general information in error_log - change "warn" to "debug" +# for troubleshooting... +LogLevel warn +ErrorLog syslog +AccessLog syslog +PageLog syslog +#PageLogFormat + +# Specifies the maximum size of the log files before they are rotated. The value "0" disables log rotation. +MaxLogSize 0 + +# Default error policy for printers +ErrorPolicy stop-printer + +# Only listen for connections from the local machine. +Listen localhost:631 +Listen /run/cups/cups.sock + +# Show shared printers on the local network. +Browsing Yes +BrowseLocalProtocols dnssd + +# Default authentication type, when authentication is required... +DefaultAuthType Basic + +# Web interface setting... +WebInterface Yes + +# Timeout after cupsd exits if idle (applied only if cupsd runs on-demand - with -l) +IdleExitTimeout 60 + +# Restrict access to the server... + + Order allow,deny + + +# Restrict access to the admin pages... + + AuthType Default + Require user @SYSTEM + Order allow,deny + + +# Restrict access to configuration files... + + AuthType Default + Require user @SYSTEM + Order allow,deny + + +# Restrict access to log files... + + AuthType Default + Require user @SYSTEM + Order allow,deny + + +# Set the default printer/job policies... + + # Job/subscription privacy... + JobPrivateAccess default + JobPrivateValues default + SubscriptionPrivateAccess default + SubscriptionPrivateValues default + + # Job-related operations must be done by the owner or an administrator... + + Order deny,allow + + + + Require user @OWNER @SYSTEM + Order deny,allow + + + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + # All administration operations require an administrator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # All printer operations require a printer operator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # Only the owner or an administrator can cancel or authenticate a job... + + Require user @OWNER @SYSTEM + Order deny,allow + + + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + + Order deny,allow + + + +# Set the authenticated printer/job policies... + + # Job/subscription privacy... + JobPrivateAccess default + JobPrivateValues default + SubscriptionPrivateAccess default + SubscriptionPrivateValues default + + # Job-related operations must be done by the owner or an administrator... + + AuthType Default + Order deny,allow + + + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + # All administration operations require an administrator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # All printer operations require a printer operator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # Only the owner or an administrator can cancel or authenticate a job... + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + + Order deny,allow + + + +# Set the kerberized printer/job policies... + + # Job/subscription privacy... + JobPrivateAccess default + JobPrivateValues default + SubscriptionPrivateAccess default + SubscriptionPrivateValues default + + # Job-related operations must be done by the owner or an administrator... + + AuthType Negotiate + Order deny,allow + + + + AuthType Negotiate + Require user @OWNER @SYSTEM + Order deny,allow + + + # All administration operations require an administrator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # All printer operations require a printer operator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # Only the owner or an administrator can cancel or authenticate a job... + + AuthType Negotiate + Require user @OWNER @SYSTEM + Order deny,allow + + + + Order deny,allow + + diff --git a/etc/systemd/system/cups.service.d/override.conf b/etc/systemd/system/cups.service.d/override.conf index d12b406..d8bc314 100644 --- a/etc/systemd/system/cups.service.d/override.conf +++ b/etc/systemd/system/cups.service.d/override.conf @@ -2,7 +2,8 @@ NoNewPrivileges=yes ProtectSystem=strict ProtectHome=yes -ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups +ReadWritePaths=/var/log/cups /var/spool/cups /var/cache/cups /var/run/cups /etc/cups +LogsDirectory=cups PrivateTmp=yes ProtectKernelTunables=yes ProtectKernelModules=yes -- cgit