The hosts.lpd file (or equivalent) must not contain a "+" character.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-827	GEN003900	SV-35140r1_rule	ECCD-1 ECCD-2	Medium

Description
Having the "+" character in the hosts.lpd (or equivalent) file allows all hosts to use local system print resources.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2018-09-14

Details

Check Text ( C-34997r1_chk )
Look for the presence of a print service configuration file. The hosts.lpd file is not used on HP, only inetd.sec, hosts.equiv, and/or the system (lp) .rhosts will apply. When rlpdaemon is started via inetd, access control is provided via the fileinetd.sec to allow or prevent a host from making print requests. When rlpdaemon is started at boot via a run command file, all requests must come from one of the machines listed in the file /etc/hosts.equiv or /var/spool/lp/.rhosts. Procedure: First, determine the rlpdaemon startup method: 1) Print services started via inetd? # cat /etc/inetd.conf \| grep -v "^#" \| grep -c rlpdaemon If the above command return value is 1, check the services file. # cat /etc/services \| grep -v "^#" \| grep printer \| grep -c spooler If the above command return value is 1, check the inetd.sec file. # cat /var/adm/inetd.sec \| grep -v "^#" \| tr '\011' ' ' \| tr -s ' ' \| grep printer \| grep allow \| grep -c "\+" If the above command return value is 1, this is a finding. 2) The rlpdaemon is started as a service, and not via inetd. Verify neither the /etc/hosts.equiv nor /var/spool/lp/.rhosts contains a "+": # cat /etc/hosts.equiv \| grep -v "^#" \| grep -c "\+" # cat /var/spool/lp/.rhosts \| grep -v "^#" \| grep -c "\+" If the return value of either of the above two command(s) is 1, this is a finding. If none of the files are found, this check should be marked not a finding. Otherwise, examine the configuration file. # more Check for entries containing a "+" or "_" character. If any are found, this is a finding.

Check Text ( C-34997r1_chk )

Look for the presence of a print service configuration file. The hosts.lpd file is not used on HP, only inetd.sec, hosts.equiv, and/or the system (lp) .rhosts will apply.

When rlpdaemon is started via inetd, access control is provided via the fileinetd.sec to allow or prevent a host from making print requests.

When rlpdaemon is started at boot via a run command file, all requests must come from one of the machines listed in the file /etc/hosts.equiv or /var/spool/lp/.rhosts.

Procedure:
First, determine the rlpdaemon startup method:

1) Print services started via inetd?
# cat /etc/inetd.conf | grep -v "^#" | grep -c rlpdaemon

If the above command return value is 1, check the services file.

# cat /etc/services | grep -v "^#" | grep printer | grep -c spooler

If the above command return value is 1, check the inetd.sec file.

# cat /var/adm/inetd.sec | grep -v "^#" | tr '\011' ' ' | tr -s ' ' | grep printer | grep allow | grep -c "\+"

If the above command return value is 1, this is a finding.

2) The rlpdaemon is started as a service, and not via inetd. Verify neither the /etc/hosts.equiv nor /var/spool/lp/.rhosts contains a "+":

# cat /etc/hosts.equiv | grep -v "^#" | grep -c "\+"
# cat /var/spool/lp/.rhosts | grep -v "^#" | grep -c "\+"

If the return value of either of the above two command(s) is 1, this is a finding.

If none of the files are found, this check should be marked not a finding.

Otherwise, examine the configuration file.
# more

Check for entries containing a "+" or "_" character. If any are found, this is a finding.

Fix Text (F-30292r1_fix)
Remove the "+" entries from the hosts.lpd (or equivalent) file.