Ensure unused and insecure network protocols are disabled (Telnet, FTP, SNMPv1/v2c, legacy print services)

高等級 1人工審核printer

說明

Print devices enable many services by default. Telnet and FTP send credentials in clear text, SNMPv1/v2c use guessable community strings, and legacy services (LPD, raw 9100 with PJL file system access, WS-Discovery, AppleTalk/Bonjour, IPX, TFTP) widen the attack surface.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking / Network Settings > Protocols (HP: Networking > Other Settings / Mgmt. Protocols; Xerox: Connectivity > Setup): Telnet, FTP (printing and firmware), TFTP, SNMPv1/v2c, LPD, AppleTalk, IPX/SPX, WS-Discovery/WSD Print, SLP and other unused services must be OFF. Keep only the required print path (IPPS preferred). Confirm externally from an admin host with a port listing of the device (tcp/21, 23, 69, 515, 9100 closed unless justified; udp/161 v1/v2c rejected).

修補方式

修補方法: 操作指南或基礎設施修補檔

EWS: disable Telnet, FTP, TFTP, SNMPv1/v2c, LPD, WSD, SLP, AppleTalk/IPX and any unused print protocol; restrict raw port 9100 or disable PJL file system/device-control commands. Apply via fleet configuration templates.

屬性

作業系統: 不限
標籤: printernetworkattack-surface
參考資料: CIS Multi-Function Device Benchmark v1.0.0 - Disable unused protocols and services (verify section number for your release)