Printer Assessment vs Platform Architecture

Two sides of security: what you inspect on printers, and how PrintMarshal governs itself.

A tool that connects to network printers with SNMP and HTTP credentials must be explicit about both printer security assessment (evaluating fleet exposure) and its own platform security architecture (how credentials, sessions, and device writes are protected).

Part I · Target Fleet

Printer Security Assessment

What operators investigate across discovered network printers:

14-item Baseline policy & 17-item security check catalog
Live TCP port probes (21, 23, 80, 443, 515, 631, 9100) and TLS handshakes
Explicit pass, fail, and unknown scoring without false greens
Certificate expiry tracking & SCEP / EST / ACME DNS-01 enrollment
Management-path lockout protection & 4-stage credential rotation

Part II · Self-Hosted Server

Platform Security Architecture

How PrintMarshal protects credentials, access, transport, and device writes:

Read-only default discovery/polling & purpose-bound credentials (read / write / both)
AES-256-GCM encryption at rest (PM_SECRET_KEY) & write-only secret APIs
RBAC (admin / operator / viewer), OIDC + PKCE, LDAP, and CSRF enforcement
Dry-run default on writes, >10-device confirmation, and read-back verification
IPP TLS Trust-on-First-Use (TOFU) pinning & RFC 5424 Syslog/CEF audit stream

Part I · Printer Security Assessment

How PrintMarshal evaluates printer security posture.

Assessments combine driver-reported configuration settings with active TCP and TLS network probes (`internal/security/`), producing a transparent per-device and fleet-wide compliance record.

✓ Assessment Engine Implemented ✓ Port & TLS Probes Implemented

1. Policy evaluation & the unknown-evidence rule

PrintMarshal seeds a built-in 14-item Baseline policy on first startup and provides a visual policy editor covering 17 security keys across protocols, TLS, certificates, and credentials.

Three distinct item outcomes: Each rule evaluates to pass, fail, or unknown.
Why unknown is never scored as a pass: Standard Printer-MIB and IPP attributes do not expose every security setting (for example, whether an admin password is set or whether WSD/SLP/LLMNR are enabled). PrintMarshal records those items as unknown and excludes them from the weighted score denominator:
```
score = 100 × sum(weight of passed items) / sum(weight of passed + failed items)
```
Management-path lockout guard: Policy rules that disable SNMPv1/v2c (managementPath: "snmp") or plain HTTP (managementPath: "http") are flagged in the UI. During remediation, the engine refuses to disable a protocol if it is the last verified management path to the printer.

Security Compliance view showing fleet summary, management-path warning banner, and By policy item table.

Focused view of the By policy item table.

✓ Probe & CA Enrollment Implemented ⬚ Device Install requires CertManager

2. Certificate inventory & CA enrollment

During assessments, PrintMarshal probes TLS on ports 443 and 631, recording negotiated TLS versions, cipher suites, and leaf certificate metadata (subject, issuer, SANs, key type, self-signed status, SHA-256 fingerprint, and notAfter expiry).

Expiry alerts: Automatically raises alerts at 30, 14, and 7 days before expiry (and critical alerts on expired certificates).
CA enrollment protocols: Generates an RSA-2048 or ECDSA-P256 keypair and CSR inside PrintMarshal and enrolls against configured CA profiles using SCEP, EST (/.well-known/est/simpleenroll), or ACME DNS-01 (two-step manual DNS TXT record creation).
Private key protection: Issued private keys are encrypted at rest with AES-256-GCM and are never downloadable through the API.

Enrollment vs Installation boundary: Enrolling a certificate stores the issued certificate and encrypted key in PrintMarshal. Installing that certificate onto a printer requires a driver implementing CertManager (CapInstallCert). No shipped real-vendor driver implements CertManager today, and automatic renewal is not implemented.

✓ 4-Stage State Machine Implemented ⬚ Device Write requires SecurityWriter

3. Staged credential rotation

Rotating a printer's admin password, SNMPv2c write community, or SNMPv3 passphrase risks stranding the device if the server and printer fall out of sync. PrintMarshal uses a 4-stage rotation state machine (internal/security/rotation.go):

1. staged: Encrypts and stores the pending credential alongside the current active credential in PrintMarshal.
2. device_written: Writes the new secret to the printer via the device's SecurityWriter driver.
3. verified: Performs a live read-back using the newly written credential to prove the printer accepted it.
4. committed (or rolled_back): Promotes the pending credential only after verification succeeds; if verification fails, the stored credential rolls back automatically.

Driver boundary: Executing step 2 against a printer requires a driver with SecurityWriter (CapWriteSecurity). No shipped real-vendor driver implements SecurityWriter today.

Part II · Platform Security Architecture

How PrintMarshal secures credentials, sessions, and network operations.

PrintMarshal is designed to run inside your management network as a single self-hosted binary with zero external cloud dependencies.

Credential vault & purpose bindingAES-256-GCM

All stored device credentials (SNMPv1/v2c communities, SNMPv3 auth/priv keys, HTTP Basic/Bearer secrets, CA profile secrets, and issued certificate private keys) are encrypted at rest using AES-256-GCM with a 32-byte key (PM_SECRET_KEY).

Purpose enforcement: Credentials declare read, write, or both. Read-only credentials cannot be used for configuration writes, remediation, or rotation.
Write-only API: Secret material is never returned by GET /api/credentials or written to logs/audit payloads.

Authentication & RBACOIDC / LDAP / Local

Operators sign in via local bcrypt accounts, OIDC (Authorization Code with PKCE and state validation), or LDAP bind authentication. Automation uses SHA-256 hashed pmk_… bearer tokens.

viewer: Read-only access to dashboards, devices, snapshots, and compliance results (secrets masked).
operator: Can run discovery, polls, assessments, dry-run previews, and configuration/security jobs.
admin: Full system control including users, credentials, CA profiles, auth providers, and system settings.

Session & CSRF hardeningSame-Origin

Browser sessions use a random 256-bit token stored in the pm_session cookie (HttpOnly, SameSite=Lax, and Secure when TLS is active or PM_COOKIE_SECURE=true).

CSRF protection: Every cookie-authenticated state-changing request (POST, PUT, PATCH, DELETE) validates Sec-Fetch-Site (same-origin / none) and checks the Origin header against the request Host.
Login rate limiting: /api/auth/login and /api/auth/ldap/login enforce per-IP token-bucket rate limits.

Write gates, dry-run default & read-back verification

PrintMarshal separates observation from modification at the API and job-engine level:

Dry-run by default: Configuration profile apply (POST /api/profiles/{id}/apply), ad-hoc writes, revert, policy remediation (POST /api/policies/{id}/remediate), and credential rotation default to dryRun: true unless dryRun: false is explicitly sent.
Two explicit exceptions without a preview flag: Certificate installation (POST /api/devices/{id}/certificates/{certId}/install) and print-provider queue deletion (DELETE /api/print/providers/{id}/queue/{jobId}) execute immediately when called.
Read-back verification: After a configuration write, PrintMarshal re-reads the modified settings and records verified, diverged, or unverifiable.

IPP TLS TOFU pinning & immutable audit trail

Transport and audit controls protect communications between PrintMarshal, printers, and your SIEM:

IPP TLS Trust-on-First-Use (TOFU): Because printers frequently use self-signed certificates on port 631, PrintMarshal pins the SHA-256 fingerprint of a device's IPPS leaf certificate on first connection (tls_pins). If a subsequent connection presents a different certificate, the connection is aborted and a tls_pin_mismatch alert is raised.
Audit log & SIEM export: Every state-changing action records actor, role, source IP, action, target, and diff details in the audit_log table and optionally forwards RFC 5424 Syslog or ArcSight CEF events.

Shipped Boundaries & Operational Disclosures

What operators should verify before production deployment.

In keeping with source-of-truth accuracy across the codebase and Security Wiki, keep these architectural boundaries in mind:

Area	Shipped Behavior	Operational Boundary
Real-vendor security, certificate & firmware writers	Policy remediation, credential rotation, certificate install, and firmware campaign engines are implemented.	No shipped real-vendor driver implements SecurityWriter, CertManager, or FirmwareUpdater today. Firmware delivery (fwsim) is simulator-only.
API token group scoping (groupIds)	API tokens can be restricted to specific device group IDs for device/group mutations.	Group scope is an operational guardrail, not a multi-tenant isolation boundary (summary endpoints and rule-group evaluations are not tenant-partitioned).
Single active server topology	Supports embedded SQLite (WAL) or external PostgreSQL.	Run a single active PrintMarshal process per database. In-process schedulers and job workers do not use distributed cluster leases.
SNMP trap listener authentication	Receives SNMPv1/v2c traps on UDP :1162 with optional PM_TRAP_COMMUNITIES allowlist.	SNMPv1/v2c traps are cleartext UDP packets; restrict UDP :1162 to printer VLANs and treat traps as a trigger for authenticated polling.
Certificate auto-renewal	Tracks expiry (30 / 14 / 7 days) and supports operator-initiated SCEP, EST, and ACME DNS-01 enrollment.	Background automatic certificate renewal is not implemented; operators trigger renewal from the Security or Device page.