Ensure unused and insecure network protocols are disabled (Telnet, FTP, SNMPv1/v2c, legacy print services)

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking / Network Settings > Protocols (HP: Networking > Other Settings / Mgmt. Protocols; Xerox: Connectivity > Setup): Telnet, FTP (printing and firmware), TFTP, SNMPv1/v2c, LPD, AppleTalk, IPX/SPX, WS-Discovery/WSD Print, SLP and other unused services must be OFF. Keep only the required print path (IPPS preferred). Confirm externally from an admin host with a port listing of the device (tcp/21, 23, 69, 515, 9100 closed unless justified; udp/161 v1/v2c rejected).

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

EWS: disable Telnet, FTP, TFTP, SNMPv1/v2c, LPD, WSD, SLP, AppleTalk/IPX and any unused print protocol; restrict raw port 9100 or disable PJL file system/device-control commands. Apply via fleet configuration templates.