# Ensure print server services are not in use

Necessity: The Common UNIX Printing System (CUPS) is a service that enables a system to act as a print server. If the system is not intended to be a print server, this service is unnecessary and increases the system's attack surface. CUPS opens network ports (typically TCP port 631) to listen for print jobs, which could be exploited by attackers if vulnerabilities exist in the service. Disabling or removing unnecessary services is a fundamental security principle known as least functionality, which reduces the overall risk of compromise.

Auditing and Remediation: The audit script verifies the status of the 'cups' service. It first checks if the CUPS package is installed. If so, it uses 'systemctl' to determine if the service is enabled to start at boot. The remediation script disables the service, preventing it from starting automatically, and also stops the currently running instance. This effectively removes the service from an active state without uninstalling the package.

Recommended State Rationale:
- Basic: Recommends that the service is either 'disabled' or 'Not Installed'. Disabling the service is the minimum acceptable state for a system not requiring print functionality, as it prevents the service from running and exposing network ports.
- Moderate: This state is identical to Basic. For a binary service state (either required or not), disabling it is the primary and sufficient mitigation if the package must remain on the system for dependency reasons.
- Strict: Recommends 'Not Installed'. This is the most secure configuration as it involves completely removing the CUPS package from the system. This eliminates the risk of the service being accidentally started and removes all associated binaries and libraries, preventing the exploitation of any potential file-based vulnerabilities, even when the service is inactive.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled', 'Not Installed']` |
| **Moderate** | `['disabled', 'Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'cups' service. If the service package is not installed, the script should output 'Not Installed'. If the package is installed, the script must use 'systemctl is-enabled cups.service' to determine if the service is enabled. The script must only return the resulting status (e.g., 'disabled', 'enabled') without any additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument for the desired state, which should be 'disabled'. The script must use the 'systemctl --now disable cups.service' command to stop and disable the CUPS printing service. The script must return 'true' on successful execution or 'false' if the operation fails.

