TMA-PRINTER-UNUSED-PROTOCOLS

Ensure unused and insecure network protocols are disabled (Telnet, FTP, SNMPv1/v2c, legacy print services)

높음레벨 1수동 검토printer

설명

Print devices enable many services by default. Telnet and FTP send credentials in clear text, SNMPv1/v2c use guessable community strings, and legacy services (LPD, raw 9100 with PJL file system access, WS-Discovery, AppleTalk/Bonjour, IPX, TFTP) widen the attack surface.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking / Network Settings > Protocols (HP: Networking > Other Settings / Mgmt. Protocols; Xerox: Connectivity > Setup): Telnet, FTP (printing and firmware), TFTP, SNMPv1/v2c, LPD, AppleTalk, IPX/SPX, WS-Discovery/WSD Print, SLP and other unused services must be OFF. Keep only the required print path (IPPS preferred). Confirm externally from an admin host with a port listing of the device (tcp/21, 23, 69, 515, 9100 closed unless justified; udp/161 v1/v2c rejected).

조치 방법

조치 방식: 가이드 또는 인프라 패치

EWS: disable Telnet, FTP, TFTP, SNMPv1/v2c, LPD, WSD, SLP, AppleTalk/IPX and any unused print protocol; restrict raw port 9100 or disable PJL file system/device-control commands. Apply via fleet configuration templates.

속성

운영 체제: 모두
태그: printernetworkattack-surface
참고 자료: CIS Multi-Function Device Benchmark v1.0.0 - Disable unused protocols and services (verify section number for your release)