# 主配置文件
/etc/cups/cupsd.conf          # 服务配置
/etc/cups/cups-files.conf     # 文件和权限配置

# SSL/TLS 证书
/etc/cups/ssl/                # 证书目录
/etc/cups/ssl/server.crt      # 服务器证书
/etc/cups/ssl/server.key      # 服务器私钥

# 认证文件
/etc/cups/passwd              # CUPS 用户密码文件

# 日志文件
/var/log/cups/access_log      # 访问日志
/var/log/cups/error_log       # 错误日志
/var/log/cups/page_log        # 页面日志

# PAM 配置
/etc/pam.d/cups               # PAM 认证配置

# /etc/cups/cupsd.conf

# 设置默认认证类型
DefaultAuthType Basic

# 管理界面使用 Basic 认证
<Location /admin>
  AuthType Basic
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
</Location>

# 配置文件访问
<Location /admin/conf>
  AuthType Basic
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
</Location>

# 日志文件访问
<Location /admin/log>
  AuthType Basic
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
</Location>

# /etc/cups/cupsd.conf

# 使用 Digest 认证
DefaultAuthType Digest

# 配置管理界面
<Location /admin>
  AuthType Digest
  Require user @SYSTEM
</Location>

# 创建 Digest 用户
sudo htdigest /etc/cups/passwd "CUPS" username

# /etc/cups/cupsd.conf

# 使用 Kerberos 认证
DefaultAuthType Negotiate

# 配置 Kerberos
# 需要 Kerberos 基础设施

# /etc/krb5.conf 配置
[realms]
  EXAMPLE.COM = {
    kdc = kdc.example.com
    admin_server = kdc.example.com
  }

# 导入 CUPS 服务主体
sudo kadmin -p admin -q "addprinc -randkey HTTP/cups.example.com"
sudo kadmin -p admin -q "ktadd -k /etc/cups/krb5.keytab HTTP/cups.example.com"

# 配置 cupsd.conf
# ServerName cups.example.com
# DefaultAuthType Negotiate

# /etc/cups/cupsd.conf

# 使用客户端证书认证
DefaultAuthType ClientCertificate

# 配置证书验证
SSLOptions Ciphers=HIGH:!aNULL:!MD5
SSLOptions MinTLS1.2

# 要求客户端证书
<Location /admin>
  AuthType ClientCertificate
  Require user @SYSTEM
</Location>

# 客户端配置
# 生成客户端证书
openssl req -new -x509 -days 365 \
  -keyout client.key -out client.crt

# 转换为 PKCS#12 格式
openssl pkcs12 -export -in client.crt -inkey client.key \
  -out client.p12

# 在浏览器中导入 client.p12

# CUPS 可以使用 PAM 进行认证
# /etc/pam.d/cups

# 标准 Unix 认证
@include common-auth
@include common-account

# LDAP 认证
# auth    required    pam_ldap.so
# account required    pam_ldap.so

# Active Directory 认证
# auth    required    pam_winbind.so
# account required    pam_winbind.so

# 重启 CUPS 使 PAM 配置生效
sudo systemctl restart cups

# /etc/cups/cupsd.conf TLS 配置

# 服务器证书
ServerCertificate /etc/cups/ssl/server.crt

# 服务器私钥
ServerKey /etc/cups/ssl/server.key

# 默认加密策略
DefaultEncryption IfRequested    # 按需加密
# DefaultEncryption Required     # 强制加密
# DefaultEncryption Never        # 不加密

# TLS 选项
SSLOptions MinTLS1.2             # 最低 TLS 1.2
SSLOptions Ciphers=HIGH:!aNULL:!MD5  # 强密码套件

# 步骤 1: 生成 CA 密钥
sudo openssl genrsa -out /etc/cups/ssl/ca.key 4096

# 步骤 2: 生成 CA 证书
sudo openssl req -new -x509 -days 3650 \
  -key /etc/cups/ssl/ca.key \
  -out /etc/cups/ssl/ca.crt \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=CUPS CA"

# 步骤 3: 生成服务器密钥
sudo openssl genrsa -out /etc/cups/ssl/server.key 2048

# 步骤 4: 生成证书签名请求
sudo openssl req -new \
  -key /etc/cups/ssl/server.key \
  -out /etc/cups/ssl/server.csr \
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Company/CN=cups.example.com"

# 步骤 5: 使用 CA 签署服务器证书
sudo openssl x509 -req -days 365 \
  -in /etc/cups/ssl/server.csr \
  -CA /etc/cups/ssl/ca.crt \
  -CAkey /etc/cups/ssl/ca.key \
  -CAcreateserial \
  -out /etc/cups/ssl/server.crt

# 步骤 6: 设置证书权限
sudo chmod 600 /etc/cups/ssl/server.key
sudo chmod 644 /etc/cups/ssl/server.crt
sudo chown root:lp /etc/cups/ssl/server.*

# 安装 Certbot
sudo apt install -y certbot

# 申请证书（假设域名 cups.example.com）
sudo certbot certonly --standalone -d cups.example.com

# 证书文件位置
# /etc/letsencrypt/live/cups.example.com/fullchain.pem
# /etc/letsencrypt/live/cups.example.com/privkey.pem

# 配置 CUPS 使用 Let's Encrypt 证书
sudo vim /etc/cups/cupsd.conf

# ServerCertificate /etc/letsencrypt/live/cups.example.com/fullchain.pem
# ServerKey /etc/letsencrypt/live/cups.example.com/privkey.pem

# 创建证书更新钩子
sudo tee /etc/letsencrypt/renewal-hooks/post/cups.sh << 'EOF'
#!/bin/bash
systemctl restart cups
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/cups.sh

# /etc/cups/cupsd.conf

# 强制 TLS 1.2 以上
SSLOptions MinTLS1.2

# 禁用不安全的密码套件
SSLOptions Ciphers=HIGH:!aNULL:!MD5:!RC4

# 启用 HSTS（HTTP 严格传输安全）
Header always set Strict-Transport-Security "max-age=31536000"

# 配置 SSL 会话缓存
SSLOptions NoSessionCache

# 配置 OCSP 装订
# SSLOptions Stapling

# /etc/cups/cupsd.conf 访问控制指令

# Order - 控制 Allow/Deny 评估顺序
# Order allow,deny   - 先评估 Allow，再评估 Deny
# Order deny,allow   - 先评估 Deny，再评估 Allow

# Allow - 允许访问
# Allow all
# Allow localhost
# Allow 192.168.1.0/24
# Allow 10.0.0.0/8
# Allow @IF(eth0)
# Allow @LOCAL

# Deny - 拒绝访问
# Deny all
# Deny 192.168.1.50
# Deny 10.0.0.0/8

# Require - 要求认证
# Require user username
# Require user @groupname
# Require valid-user

# /etc/cups/cupsd.conf

# 根路径 - 允许本地访问
<Location />
  Order allow,deny
  Allow localhost
  Allow @LOCAL
</Location>

# 管理界面 - 需要认证
<Location /admin>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
  Allow 192.168.1.0/24
</Location>

# 配置文件 - 仅本地管理
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
</Location>

# 日志文件 - 仅本地管理
<Location /admin/log>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
</Location>

# 打印机列表 - 允许网络浏览
<Location /printers>
  Order allow,deny
  Allow localhost
  Allow 192.168.1.0/24
</Location>

# 特定打印机 - 限制访问
<Printer secret-printer>
  AuthType Default
  Require user john mary bob
  Order allow,deny
  Allow localhost
  Allow 192.168.1.100
</Printer>

# 使用 iptables 实现 IP 过滤
# 允许特定 IP 访问 CUPS
sudo iptables -A INPUT -p tcp --dport 631 -s 192.168.1.100 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 631 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 631 -j DROP

# 使用 ufw
sudo ufw allow from 192.168.1.0/24 to any port 631
sudo ufw allow from 10.0.0.0/8 to any port 631
sudo ufw deny 631

# 使用 firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port protocol="tcp" port="631" accept'
sudo firewall-cmd --reload

# 限制特定操作
<Location /admin/classes>
  AuthType Default
  Require user @SYSTEM
  # 只有管理员可以管理打印机组
</Location>

# 限制打印机管理
<Printer myprinter>
  # 允许所有人打印
  AuthType Default
  Order allow,deny
  Allow all
  
  # 限制管理操作
  # 通过 cupsctl 或 lpadmin 配置
</Printer>

# 使用 Policy 限制操作
<Policy default>
  # 允许所有操作
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default
  
  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  
  <Limit Send-URI>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  
  <Limit CUPS-Authenticate-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  
  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

# /etc/cups/cupsd.conf

# 日志级别
LogLevel info
# 可选值: none, emerg, alert, crit, error, warn, notice, info, debug, debug2

# 访问日志
AccessLog /var/log/cups/access_log
AccessLogFormat "%h %u %t \"%r\" %s %b \"%{Referer}i\" \"%{User-Agent}i\""

# 错误日志
ErrorLog /var/log/cups/error_log

# 页面日志
PageLog /var/log/cups/page_log

# 最大日志大小 (MB)
MaxLogSize 1m

# 日志轮转
# 使用 logrotate

# 默认访问日志格式
# %h - 客户端 IP
# %u - 用户名
# %t - 时间戳
# %r - 请求行
# %s - 状态码
# %b - 响应大小
# %{Referer}i - 引用页
# %{User-Agent}i - 用户代理

# 查看访问日志
tail -f /var/log/cups/access_log

# 输出示例:
# 192.168.1.100 - john [10/May/2026:09:00:00 +0800] "POST /printers/myprinter HTTP/1.1" 200 1234
# 192.168.1.101 - - [10/May/2026:09:05:00 +0800] "GET / HTTP/1.1" 200 5678

# 页面日志记录每次打印的详细信息
# 格式: printer user job-id date time total num-sheets job-billing job-originating-host-name

# 查看页面日志
tail -f /var/log/cups/page_log

# 输出示例:
# myprinter john 1 10/May/2026:09:00:00 +0800 1 1 - 192.168.1.100
# myprinter mary 2 10/May/2026:09:05:00 +0800 2 2 - 192.168.1.101

#!/bin/bash
# /usr/local/bin/cups-log-analyzer
# CUPS 日志分析脚本

ACCESS_LOG="/var/log/cups/access_log"
PAGE_LOG="/var/log/cups/page_log"
ERROR_LOG="/var/log/cups/error_log"

echo "=== CUPS 日志分析报告 ==="
echo "生成时间: $(date)"
echo ""

# 1. 访问统计
echo "1. 访问统计"
echo "-------------------"
echo "总访问次数: $(wc -l < $ACCESS_LOG)"
echo "唯一 IP 数: $(awk '{print $1}' $ACCESS_LOG | sort -u | wc -l)"
echo ""

# 2. 用户打印统计
echo "2. 用户打印统计（Top 10）"
echo "-------------------"
awk '{print $2}' $PAGE_LOG | sort | uniq -c | sort -rn | head -10
echo ""

# 3. 打印机使用统计
echo "3. 打印机使用统计"
echo "-------------------"
awk '{print $1}' $PAGE_LOG | sort | uniq -c | sort -rn
echo ""

# 4. 每日打印量
echo "4. 每日打印量（最近 7 天）"
echo "-------------------"
awk -F'[:/]' '{print $1"/"$2"/"$3}' $PAGE_LOG | sort | uniq -c | tail -7
echo ""

# 5. 错误统计
echo "5. 最近错误（Top 10）"
echo "-------------------"
grep -i "error" $ERROR_LOG | tail -10
echo ""

# 6. 安全事件
echo "6. 安全事件"
echo "-------------------"
grep -i "401\|403\|denied\|unauthorized" $ACCESS_LOG | tail -10
echo ""

# /etc/logrotate.d/cups

/var/log/cups/access_log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root lp
    postrotate
        /usr/sbin/cupsd -h 2>/dev/null || true
    endscript
}

/var/log/cups/error_log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root lp
    postrotate
        /usr/sbin/cupsd -h 2>/dev/null || true
    endscript
}

/var/log/cups/page_log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root lp
    postrotate
        /usr/sbin/cupsd -h 2>/dev/null || true
    endscript
}

# 查看 SELinux 状态
getenforce

# 查看 CUPS 相关的 SELinux 策略
getsebool -a | grep cups
# cupsd_disable_trans --> off
# cupsd_use_usb --> off
# cupsd_exec_mem --> off

# 启用必要的 SELinux 布尔值
sudo setsebool -P cupsd_disable_trans on
sudo setsebool -P cupsd_use_usb on

# 如果遇到 SELinux 拒绝，查看审计日志
sudo ausearch -m avc -ts recent | grep cups

# 生成自定义 SELinux 策略
sudo audit2allow -a -M cups_custom
sudo semodule -i cups_custom.pp

# 查看 AppArmor 状态
sudo aa-status

# 查看 CUPS AppArmor 配置
cat /etc/apparmor.d/usr.sbin.cupsd

# 重新加载 AppArmor 配置
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.cupsd

# 如果遇到 AppArmor 拒绝
sudo aa-logprof

# 将 CUPS 配置为 complain 模式（调试）
sudo aa-complain /etc/apparmor.d/usr.sbin.cupsd

# 恢复 enforce 模式
sudo aa-enforce /etc/apparmor.d/usr.sbin.cupsd

# 检查 CUPS 文件权限
ls -la /etc/cups/
ls -la /var/log/cups/
ls -la /var/spool/cups/
ls -la /usr/lib/cups/backend/

# 正确的权限设置
# /etc/cups/              755 root:lp
# /etc/cups/cupsd.conf    640 root:lp
# /etc/cups/cups-files.conf 640 root:lp
# /etc/cups/printers.conf  640 root:lp
# /etc/cups/ppd/           755 root:lp
# /var/log/cups/           755 root:lp
# /var/spool/cups/         700 root:lp
# /usr/lib/cups/backend/   755 root:root

#!/bin/bash
# /usr/local/bin/fix-cups-permissions
# 修复 CUPS 文件权限

echo "=== 修复 CUPS 文件权限 ==="

# 停止 CUPS 服务
sudo systemctl stop cups

# 修复配置文件权限
sudo chown -R root:lp /etc/cups/
sudo chmod 640 /etc/cups/cupsd.conf
sudo chmod 640 /etc/cups/cups-files.conf
sudo chmod 640 /etc/cups/printers.conf
sudo chmod 640 /etc/cups/classes.conf
sudo chmod 755 /etc/cups/ppd/
sudo chmod 644 /etc/cups/ppd/*.ppd

# 修复日志目录权限
sudo chown -R root:lp /var/log/cups/
sudo chmod 755 /var/log/cups/
sudo chmod 640 /var/log/cups/*

# 修复打印队列权限
sudo chown -R root:lp /var/spool/cups/
sudo chmod 700 /var/spool/cups/

# 修复缓存目录权限
sudo chown -R root:lp /var/cache/cups/
sudo chmod 755 /var/cache/cups/

# 修复后端权限
sudo chown -R root:root /usr/lib/cups/backend/
sudo chmod 755 /usr/lib/cups/backend/*
sudo chmod 700 /usr/lib/cups/backend/usb

# 启动 CUPS 服务
sudo systemctl start cups

echo "=== 权限修复完成 ==="

# /usr/local/bin/cups-security-check
#!/bin/bash

echo "=== CUPS 安全检查清单 ==="
echo ""

# 1. 检查 CUPS 版本
echo "1. CUPS 版本检查"
cups-config --version
echo ""

# 2. 检查监听地址
echo "2. 监听地址检查"
netstat -tlnp | grep cupsd
# 应该只监听 localhost 或特定 IP，而不是 0.0.0.0
echo ""

# 3. 检查 TLS 配置
echo "3. TLS 配置检查"
grep -E "ServerCertificate|ServerKey|DefaultEncryption" /etc/cups/cupsd.conf
echo ""

# 4. 检查认证类型
echo "4. 认证类型检查"
grep "DefaultAuthType" /etc/cups/cupsd.conf
echo ""

# 5. 检查访问控制
echo "5. 访问控制检查"
grep -A 5 "Location /admin" /etc/cups/cupsd.conf
echo ""

# 6. 检查文件权限
echo "6. 文件权限检查"
ls -la /etc/cups/cupsd.conf
ls -la /var/log/cups/
ls -la /var/spool/cups/
echo ""

# 7. 检查 SELinux/AppArmor
echo "7. MAC 检查"
if command -v getenforce &> /dev/null; then
    echo "SELinux: $(getenforce)"
fi
if command -v aa-status &> /dev/null; then
    echo "AppArmor: $(aa-status | head -1)"
fi
echo ""

# 8. 检查防火墙
echo "8. 防火墙检查"
if command -v ufw &> /dev/null; then
    sudo ufw status | grep 631
fi
echo ""

# 9. 检查日志配置
echo "9. 日志配置检查"
grep -E "LogLevel|AccessLog|ErrorLog|PageLog" /etc/cups/cupsd.conf
echo ""

echo "=== 检查完成 ==="

# 步骤 1: 更新 CUPS
sudo apt update && sudo apt upgrade -y cups

# 步骤 2: 配置 TLS
# （参考 9.3 节）

# 步骤 3: 配置强认证
# （参考 9.2 节）

# 步骤 4: 限制网络访问
# （参考 9.4 节）

# 步骤 5: 启用审计日志
# （参考 9.5 节）

# 步骤 6: 配置 SELinux/AppArmor
# （参考 9.6 节）

# 步骤 7: 修复文件权限
# （参考 9.7 节）

# 步骤 8: 定期安全检查
# 添加到 cron
echo "0 2 * * 0 /usr/local/bin/cups-security-check > /var/log/cups/security-check.log 2>&1" | sudo tee -a /etc/crontab

# 需求：企业环境安全打印

# 1. 强制 TLS 加密
DefaultEncryption Required
ServerCertificate /etc/cups/ssl/server.crt
ServerKey /etc/cups/ssl/server.key
SSLOptions MinTLS1.2

# 2. LDAP 认证
DefaultAuthType Negotiate
# 或
AuthLDAPURL ldap://ldap.example.com/ou=people,dc=example,dc=example?uid

# 3. IP 白名单
<Location />
  Order deny,allow
  Deny all
  Allow 192.168.1.0/24
  Allow 10.0.0.0/8
</Location>

# 4. 审计日志
LogLevel info
AccessLog /var/log/cups/access_log
PageLog /var/log/cups/page_log

# 需求：满足等保/ISO27001 等合规要求

# 1. 审计日志完整
# 记录所有访问和打印操作

# 2. 日志保留
# 配置 logrotate 保留 180 天日志

# 3. 定期安全检查
# 配置自动化安全扫描

# 4. 访问控制
# 实施最小权限原则

# 5. 加密传输
# 强制 TLS 1.2+

# 6. 认证机制
# 使用强认证（证书或 Kerberos）

# 需求：访客只能使用特定打印机

# 创建访客专用打印机
sudo lpadmin -p Guest-Printer -E \
  -v socket://192.168.1.200:9100 \
  -u allow:guest

# 配置访客打印机限制
<Printer Guest-Printer>
  AuthType Default
  Require user guest
  Order allow,deny
  Allow 192.168.1.0/24
</Printer>

# 设置打印配额
# 使用 CUPS 配额机制
sudo lpadmin -p Guest-Printer \
  -o job-quota-period=86400 \
  -o job-quota-pages=20