Page 2 of 2 FirstFirst 12
Results 11 to 20 of 20

Thread: tcp Ports 53 and 631

  1. #11
    Join Date
    Mar 2019
    Beans
    215

    Re: tcp Ports 53 and 631

    OK

    So the idea is that CUPS is useful if you are on a local network? Other people on your local network can print out files that you send them, to give but one practical example?

    However, I'd still like to hear more about why various websites warn about liabilities associated with CUPS and port 631 (which is why I started this thread). Even if chances are slim.

    What are the security risks, including in cases when you are not on a local network?

  2. #12
    Join Date
    May 2010
    Beans
    3,320

    Re: tcp Ports 53 and 631

    If you don't use a service and it is listening then it is offering you no benefit and exposes your system (in some way) to attack. This is part of basic hardening. I believe the CUPS packages are part of the "ubuntu-desktop" meta-package which is probably why they are being reinstalled occasionally.

  3. #13
    Join Date
    May 2024
    Beans
    Hidden!

    Re: tcp Ports 53 and 631

    Quote Originally Posted by bhubunt View Post
    OK

    So the idea is that CUPS is useful if you are on a local network? Other people on your local network can print out files that you send them, to give but one practical example?

    However, I'd still like to hear more about why various websites warn about liabilities associated with CUPS and port 631 (which is why I started this thread). Even if chances are slim.

    What are the security risks, including in cases when you are not on a local network?
    What "websites"? There's a lot of FUDD lore out there, and this eminances a familiar odor.

    The reality is if CUPS was such a risk, it would not be enabled by default on millions of installations.

    Relax and find something else to worry about.

  4. #14
    Join Date
    Nov 2007
    Location
    London, England
    Beans
    7,721

    Re: tcp Ports 53 and 631

    It is possible to reconfigure the cups print spooler process to listen for external connections instead of just local processes (listen on 0.0.0.0 instead of 172.0.0.1). This allows other computers to send prints to your printers, read printer properties, ink levels, print queue properties etc. If you wanted other 'puters to be able to do that, you might want to limit which addresses can do that even though the service is password protected.

    On top of that, any service that outside folk can connect to just might have a vulnerability that can be abused to hijack your computer.

  5. #15
    Join Date
    Mar 2019
    Beans
    215

    Re: tcp Ports 53 and 631

    Thanks for the heads up and your explanation that a listening service like CUPS, unused, might expose one's system to an attack.


    Quote Originally Posted by ActionParsnip View Post
    If you don't use a service and it is listening then it is offering you no benefit and exposes your system (in some way) to attack. This is part of basic hardening. I believe the CUPS packages are part of the "ubuntu-desktop" meta-package which is probably why they are being reinstalled occasionally.

  6. #16
    Join Date
    Mar 2019
    Beans
    215

    Re: tcp Ports 53 and 631

    [
    Quote Originally Posted by The Cog View Post
    On top of that, any service that outside folk can connect to just might have a vulnerability that can be abused to hijack your computer.

    Thanks for this helpful addition to ActionParsnip's comment about unused services like CUPS posing a potential security risk.

    I have no intention of using CUPS now or in the future -- my system is a personal Lenovo laptop that is not part of a network of computers. Any rare printing I do is for personal use, on paper, on a Brother printer.

    I just entered the disable-cups command that Rubi1200 suggested in a post above.

    Can you or someone else explain to me if the return output looks right?

    What does "multi-user.target.wants" stand for?

    And does this mean that cups won't be coming back, not even through an ubuntu update?

    Code:
     sudo systemctl disable cups
    [sudo] password for XXX: 
    Synchronizing state of cups.service with SysV service script with /lib/systemd/systemd-sysv-install.
    Executing: /lib/systemd/systemd-sysv-install disable cups
    Removed /etc/systemd/system/multi-user.target.wants/cups.service.
    Removed /etc/systemd/system/multi-user.target.wants/cups.path.
    Removed /etc/systemd/system/sockets.target.wants/cups.socket.
    Removed /etc/systemd/system/printer.target.wants/cups.service.
    Last edited by bhubunt; May 18th, 2024 at 08:29 AM.

  7. #17
    Join Date
    Nov 2007
    Location
    London, England
    Beans
    7,721

    Re: tcp Ports 53 and 631

    Yes, that disabled the cups service. Which was not accessible over the network anyway. If you can't print to a local printer or to pdf files any more, you know why.

    What about cups-browsed, the one that is accessible across the network? Did you disable that or is it still listening?

  8. #18
    Join Date
    Mar 2019
    Beans
    215

    Re: tcp Ports 53 and 631

    Quote Originally Posted by The Cog View Post
    Yes, that disabled the cups service. Which was not accessible over the network anyway. If you can't print to a local printer or to pdf files any more, you know why.

    What about cups-browsed, the one that is accessible across the network? Did you disable that or is it still listening?
    Thanks for the reply.

    For future reference:

    If I change my mind and want to enable CUPS again at boot startup, what is the command line?

    I disabled cups-browsed

    Code:
     Synchronizing state of cups-browsed.service with SysV service script with /lib/systemd/systemd-sysv-install.
    Executing: /lib/systemd/systemd-sysv-install disable cups-browsed
    Removed /etc/systemd/system/multi-user.target.wants/cups-browsed.service.
    Last edited by bhubunt; May 18th, 2024 at 08:53 AM.

  9. #19
    Join Date
    Mar 2010
    Location
    /home
    Beans
    9,521
    Distro
    Xubuntu

    Re: tcp Ports 53 and 631

    If you change your mind and want to enable CUPS at boot this is the command:

    Code:
    sudo systemctl enable cups
    Can I suggest something?

    Keep a text document with a list of commands you used with enable and disable parameters. Good as a handy reference tool.

  10. #20
    Join Date
    May 2024
    Beans
    Hidden!

    Re: tcp Ports 53 and 631

    Six months later ... WHY WON'T MY BROWSER SAVE PAGES TO PDF?!

Page 2 of 2 FirstFirst 12

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •