HP Imaging and Printing Security Center 2.0 - Securing the HP Imaging & Printing Security Center

2
REMOTE ACCESS TO WEB SERVICE
The HP Imaging & Printing Security Center web service allows remote access to everyone who
is a member of the local Administrators group on the computer on which it is installed. The HP
Imaging & Printing Security Center installation program creates a local group named HPIPSC
on the computer where the service is installed. The HP Imaging & Printing Security Center
service allows any user who is a member of this group to remotely access the HP Imaging &
Printing Security Center web service. The port that the web service listens on must be opened
in your firewall. See the following section for details.
FIREWALL CONFIGURATION FOR REMOTE ACCESS
If a firewall is installed on the computer on which the HP Imaging & Printing Security Center
service runs, and it will be accessed from the user interface on a remote computer, the
firewall must be set to allow access to the service. The HP Imaging & Printing Security Center
service listens on port 8002, which must be opened in the firewall to allow remote access to
the service. If you do not want to allow remote access to the HP Imaging & Printing Security
Center web service, then you can block port 8002 with a firewall.
SERVICE SECURITY
The HP Imaging & Printing Security Center service is a Windows Service and is displayed when
you run the Service administration tool. The IPSC service exposes a web service that currently
allows access via TCP/IP only (not HTTP) and runs as the NT AUTHORITY\NETWORK SERVICE
low privilege user account. Because of this, everything that is operationally required by the
IPSC service must also be provided access to the NETWORK SERVICE account. During HP
Imaging & Printing Security Center installation, by default this account is configured to have
directory/files access to the installed directories/files. It is possible to change the account that
the service runs as, but you must also ensure that this account has access to the web services
URL and access to the database. Use the following two sections if you need to change the
account.
RESERVE URLs FOR SERVICE USER ACCOUNT
If the HP Imaging & Printing Security Center service runs as a non-administrator account, then
the URL must be reserved for this account. The HP Imaging & Printing Security Center
installation process manages this by default for the NT AUTHORITY\NETWORK SERVICE. If you
run the HP Imaging & Printing Security Center service as a different non-administrator
account, then open a command prompt and run the following command:
netsh http add urlacl url= http://+:8002/LocksmithService/ user=”<User Account Name>”