Disable the CUPS Service
Disables and stops the CUPS printing service to remove unneeded network attack surface on non-print hosts.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
CUPS is the Common UNIX Printing System daemon, which listens on a network port (TCP 631) and historically has had remotely exploitable vulnerabilities (e.g. the 2024 cups-browsed RCE chain). On servers that do not provide printing, CUPS is unnecessary attack surface. Disabling it follows the principle of least functionality, turn off unneeded services to reduce the system's exposure.
What Pavois checks
Pavois queries systemd for the effective state of cups.service (systemctl is-enabled / is-active). CUPS is commonly socket-activated via cups.socket, so a config-file scan of /etc/cups/cupsd.conf would miss that the daemon can be launched on demand, the live systemd state is what reveals whether port 631 can be served.
describe service('cups.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Confirm the service and its socket are off:
systemctl is-enabled cups.service cups.socket
systemctl is-active cups.service cups.socket
Expect disabled/masked and inactive. Confirm nothing listens on 631: ss -lntp | grep 631 should return nothing.
Inspect & investigate
Inspect the unit with systemctl status cups.service and journalctl -u cups. Print/job activity is also under /var/log/cups/. Confirm the listening socket is gone with ss -lntp 'sport = :631'. Package presence: dpkg -s cups or rpm -q cups.
Remediation
Pavois's harden plan acts on the service resource named cups: it runs disable (no start at boot) then stop (not running now). Applied with pavois harden apply. Note: if cups.socket is present, ensure it too is disabled/masked so socket activation cannot revive the daemon.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | cups |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration risk: a running CUPS daemon exposes a network port with a poor vulnerability history on hosts that do not need printing. Precautions: disabling CUPS removes all local and network printing capability for this host, do not apply it on print servers or workstations that must print. Confirm no users or applications depend on local printing before applying. There is no login or lockout impact.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.11 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.