Internet Printing Protocol port 631

[Sandy Pond]

Hi,

I noticed default firewall rules setup by system-config-securitylevel, a
port is opened to Internet Printing Protocol port 631 allowing UDP
connections.  Rule;

-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

Points;

1.  You need to add a rule to accept 631 on TCP as well.  Otherwise, IPP
printing will not work.

2.  I think that system-config-printer should not default open port 631
at all, but instead, should have an IPP check box instead (like the
other check boxes for SSH, WWW, etc).

Anyone at Red Hat interested in a patch to system-config-securitylevel,
to add a IPP check box?  I'd also add a box for 224.0.0.251:5353
(Rendezvous) which is also default open.  The default for Rendezvous can
be open if you like, but the patch would allow you to close it, for
instance, on an external interface.

Regards :)

[Ignacio Vazquez-Abrams]

On Fri, 2005-03-11 at 19:30 -0500, Sandy Pond wrote:
>  1.  You need to add a rule to accept 631 on TCP as well.  Otherwise,
> IPP
>  printing will not work.
>  
>  2.  I think that system-config-printer should not default open port 631
>  at all, but instead, should have an IPP check box instead (like the
>  other check boxes for SSH, WWW, etc).
>  
>  Anyone at Red Hat interested in a patch to system-config-securitylevel,
>  to add a IPP check box?  I'd also add a box for 224.0.0.251:5353
>  (Rendezvous) which is also default open. 
http://bugzilla.redhat.com/

-- 
Ignacio Vazquez-Abrams <ivazquez(a)ivazquez.net&gt;
http://fedora.ivazquez.net/

[Tim Waugh]

On Fri, Mar 11, 2005 at 09:04:12PM -0500, Ignacio Vazquez-Abrams wrote:

>  On Fri, 2005-03-11 at 19:30 -0500, Sandy Pond wrote:
>  > 1.  You need to add a rule to accept 631 on TCP as well.  Otherwise, IPP
>  > printing will not work.
>  > 
>  > 2.  I think that system-config-printer should not default open port 631
>  > at all, but instead, should have an IPP check box instead (like the
>  > other check boxes for SSH, WWW, etc).
>  > 
>  > Anyone at Red Hat interested in a patch to system-config-securitylevel,
>  > to add a IPP check box?  I'd also add a box for 224.0.0.251:5353
>  > (Rendezvous) which is also default open.
>  
>  http://bugzilla.redhat.com/ 
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=90946#c17

Tim.
*/