Increase both BrowseInterval and BrowseTimeout in the same ratio to avoid situations in which printers disappear from the browsing list. Optional: Change the polling interval and timeout to limit the number of browsing cycles: For further details, see the parameter description and examples in the nf(5) man page. You can filter by different field names, negate the filter, and match the exact values. For example, to filter for queues whose name contain sales_, add: Optional: Configure a filter to limit which printers are shown in the local CUPS service. To enforce encryption for the entire CUPS server, add Encryption Required to all directives in the /etc/cups/nf file, for example:Īdd BrowsePoll parameters for each remote CUPS server you want to poll:īrowsePoll remote_cups_ BrowsePoll 192.0.2.100:1631Īppend : to the hostname or IP address if the remote CUPS server listens on a port different from 631. Therefore, you do not need to set strict permissions on the server certificate file.īy default, CUPS enforces encrypted connections only if a task requires authentication, for example when performing administrative tasks on the /admin page in the web interface. # chmod 600 /etc/cups/ssl/ īecause certificates are part of the communication between a client and the server before they establish a secure connection, any client can retrieve the certificates without authentication. Set secure permissions on the private key that enable only the root user to read this file: If you use an alias, you must name the files. # mv /root/server.crt /etc/cups/ssl/ ĬUPS requires that you name the private key. Store the private key and server certificate in the /etc/cups/ssl/ directory, for example: In this case, use the alternative name instead of the FQDN in the rest of the procedure. If the CN or SAN fields in the server certificate contains an alias that is different from the server’s FQDN, add the ServerAlias parameter to the /etc/cups/nf file: Optional: Display the CN and SAN fields of the certificate: Optional: Display the FQDN of the server:

Remove the self-signed certificate and private key:

If you run CUPS on a host with multiple interfaces, consider limiting the access to the required networks.Įdit the /etc/cups/nf file, and add the following setting to disable the automatic creation of self-signed certificates: # firewall-cmd -permanent -add-port=631/tcp If you run the firewalld service and want to configure remote access to CUPS, open the CUPS port in firewalld: Optional: Configure IP addresses and ranges that are allowed to access the configuration and log files in the web interface: With these settings, only the hosts with the IP addresses 192.0.2.:db8:1::22 can access the administration services. In the directive, configure which IP addresses and ranges can access the CUPS administration services:Īllow from 192.0.2.15/32 Allow from /128 Do not configure CUPS to listen on interfaces that allow access from untrustworthy networks, such as the internet.Ĭonfigure which IP ranges can access the service by allowing the respective IP ranges in the directive:Īllow from 192.0.2.0/24 Allow from /32

Print queues