Section 4.11 The print Service (lpd)

---

4.11 The print Service (lpd)

The standard Linux lpd program listens on TCP port 515 for remote print job requests. Its security is patterned on the flawed R* security found in rsh and its brethren that are discussed in "The rsh, rcp, rexec, and rlogin Services" on page 198. The lpd daemon will accept jobs from systems and users specified in /etc/hosts.equiv and /etc/hosts.lpd. It is strongly recommended that the firewall block this port to all untrusted systems. A weaker alternative is to either edit /etc/services or invoke lpd with an alternate port number that crackers are less likely to detect and attack.

The port number is specified on the command line as a simple number (with no dash) when lpd is started. If network access is possible (local or remote), it is suggested to start lpd with the -l flag to cause logging of requests via syslogd. The danger level has been boosted to five for the second edition because of a huge number of compromises in early 2001 due to a Red Hat bug and crackers continuing to attack this port frequently.

---

Top