Re: Limiting attack surface for Debian sshd

[Michel Verdier <mv524@free.fr>]

On 2025-04-15, Lee wrote:

> If I turn the cups service back on I can print:
>
> $ sudo systemctl start cups.service
>
> $ lp -d Canon_MG3600_series check-for-updates.sh
> request id is Canon_MG3600_series-4 (1 file(s))

cupsd should listen on ports but only on localhost:

# ss -nltup | grep cups
tcp   LISTEN 0      0          127.0.0.1:631        0.0.0.0:*    users:(("cupsd",pid=30001,fd=8))                             
tcp   LISTEN 0      0              [::1]:631              *:*    users:(("cupsd",pid=30001,fd=7))

If this is not the case you should put in /etc/cups/cupsd.conf
Listen localhost:631
Listen /run/cups/cups.sock