Uninstall CUPS Package
Ensures the CUPS printing service is not installed on systems that do not need to print.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If the system does not need to print or accept print jobs from other systems, CUPS should be removed to reduce the potential attack surface.
What Pavois checks
Pavois verifies that the cups package is absent via the package manager. Removing the package eliminates the listening print daemon entirely, which is stronger than merely stopping the service (a stopped service can be re-enabled, and a present binary still carries CVEs).
describe package('cups') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s cups, which should report package 'cups' is not installed. Confirm no print daemon is listening with ss -tlnp | grep 631 (no output expected).
Inspect & investigate
Confirm removal with dpkg -l cups; while present, CUPS activity is logged under /var/log/cups/ and reachable via journalctl -u cups.
Remediation
Pavois's harden plan removes the cups package (resource package, action remove) and is applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | cups |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing CUPS disables all local and network printing. Before applying, confirm the host is not a print server and that no user or application depends on local printing, desktops and workstations often do. On dedicated servers there is no impact beyond closing TCP/631.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.11 | direct | per OS, see the benchmark table | high |
| NIST | CM-7(a), CM-7(b), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.