I installed Mepis Linux on a friend's computer the other day. It's Debian-based. It came with Guarddog which I configured. She's on a stand-alone computer using a cable broadband connection. No servers, she just needs a connection to the internet for surfing, receiving mail and minor downloading. She's using Cups for her local parallel port printer.

I blocked the IPP protocol in Guarddog but it still leaves the IPP port 631 open, according to the GRC ShieldsUP scan. She doesn't need remote Cups access. I don't want to disable Cups because she needs it to print. What can we do?

This is her first experience with Linux. She lives in a different city and anything you suggest, I'm going to have to talk her through it over the phone, so I hope the solution is simple. I feel really bad leaving her computer vulnerable like this. She asked me for Linux and I just didn't have much time to tweak it after installing.

Thanks!
Siri Amrit

Configure cupsd to run on localhost (grep Listen cupsd.conf). If paranoid (and why not?) additionally configure Iptables to only accept traffic for the IPP port from localhost. I don't know if Cups is compatible with libwrap, if it is, then you could additionally configure /etc/hosts.allow (you *did* "echo ALL: ALL > /etc/hosts.deny" anyway, right?).

Thanks, unSpawn. Get ready to flame me.

>Configure cupsd to run on localhost (grep Listen cupsd.conf)

What will that command show or do? I tried the command here and don't have that file on my system. She's in New Mexico and has no experience with Linux, commandline or Vi. I'm in Arizona using Slackware, not Debian-based Mepis. I have to walk her through things over the phone and that's hard if I can't see what she sees. Is there a way she could open and edit the Cups file using Kwrite? Perhaps she could send me the file and I could see how to change it to make it run on localhost? I don't even know where the Cups file would be...

I can't configure her IPtables, and doubt if she can, either. I wouldn't know how even if I was there.

>you *did* "echo ALL: ALL > /etc/hosts.deny" anyway, right?

No, I didn't. I don't even know what that means or does. Can you please elucidate?

Thanks!
Siri Amrit

Getting the file from her would be good, unless some userfriendly tool (re)configured it for her. Wanna get prepared: D/L Debian's Cups package, unpack and peruse the contents. Conf should live around /etc/cups/ or so, the line by default being commented out, reads something like "# Listen 631". Make it read "Listen 127.0.0.1:631", send file, make her restart Cups.

Same drill for the firewall I guess, but let's do one thing at a time.

Thank you!

Siri Amrit