Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007 Installation Manual page 466

This is the best CUPS configuration for printing over remote CUPS servers.
However, there is a risk that an attacker sends IPP broadcasts with queues and the
local daemon accesses a counterfeit queue. If it then displays the queue with the
same name as another queue on the local server, the owner of the job may believe
the job is sent to a local server, while in reality it is sent to the attacker's server.
YaST can find CUPS servers by scanning local network hosts to see if they offer the
IPP service or by listening to IPP broadcasts. This requires the firewall to allow incoming
packets on port 631/UDP (service IPP client) to pass through. This is automatically
enabled when you have configured your machine to be in the internal firewall zone.
Opening a port to configure access to remote queues in the external zone can be a secu-
rity risk because an attacker could broadcast a server that might be accepted by users.
By default, IPP broadcasts are rejected in the external zone. See
figuring the Firewall with YaST"
Alternatively, the user can detect CUPS servers by actively scanning the local network
hosts or configure all queues manually. However, this method is not recommended.
23.8.2 Changes in the CUPS Print Service
cupsd Runs as the User lp
On start-up, cupsd changes from the user root to the user lp. This provides a much
higher level of security, because the CUPS print service does not run with unrestricted
permissions, only with the permissions needed for the print service.
However, the authentication (the password check) cannot be performed via /etc/
shadow, because lp has no access to /etc/shadow. Instead, the CUPS-specific
authentication via /etc/cups/passwd.md5 must be used. For this purpose, a CUPS
administrator with the CUPS administration group sys and a CUPS password must
be entered in /etc/cups/passwd.md5. To do this, enter the following as root:
lppasswd -g sys -a CUPS-admin-name
This setting is also essential if you want to use the CUPS administration Web front-end
or the KDE printer administration tool.
When cupsd runs as lp, /etc/printcap cannot be generated, because lp is not
permitted to create files in /etc/. Therefore, cupsd generates /etc/cups/
448 Installation and Administration
(page 822) for details of firewall configuration.
Section 43.4.1, "Con-