# Ensure print server services are not in use

Necessity: The Common Unix Printing System (CUPS) is a network service that listens on TCP port 631, creating an additional attack vector. Servers that do not have a specific requirement to function as a print server should have this service disabled or uninstalled to reduce the system's attack surface. Disabling it mitigates risks associated with potential vulnerabilities in the printing protocol stack and adheres to the security principle of least functionality.

Auditing and Remediation: The audit script verifies the current status of the 'cups' systemd service to determine if it is active or configured to start on boot. The remediation script disables the service, which stops the running process and prevents it from starting automatically in the future, effectively closing the associated network port.

Recommended State Rationale:
- Basic: ['disabled', 'not installed'] - Disabling the CUPS service is the fundamental step to secure a non-print server. This prevents the service from running, which is a sufficient mitigation for most environments.
- Moderate: ['disabled', 'not installed'] - The recommendation remains the same as Basic because the primary risk is an active network service. Disabling the service effectively neutralizes this immediate risk.
- Strict: ['not installed'] - The most secure configuration is to completely remove the 'cups' package. This ensures the service cannot be accidentally or maliciously started and removes all associated files from the system, providing the smallest possible attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled', 'not installed']` |
| **Moderate** | `['disabled', 'not installed']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the status of the 'cups' service. The script should use 'systemctl is-enabled cups' to determine if the service is enabled. If the service is not installed, the check should reflect this. The script must only output the resulting status string (e.g., 'disabled', 'enabled', 'masked', or 'not installed') with no additional text or formatting.

## Remediation Script Working

bash script that accepts a single positional command-line argument to set the desired state of the 'cups' service. If the argument is 'disabled', the script must use 'systemctl disable --now cups' to stop and disable the service. The script must output 'true' on success and 'false' if the operation fails or the service is not installed.

