A PaperCut NG or MF Application Server sits between your directory, every print queue and every multifunction device, so the way you configure it decides who can administer printing and what reaches the network. The server holds directory sync settings, external database credentials, device connections and web services integrations, and its admin web interface controls them all. This guide shows PaperCut administrators, infrastructure engineers and security teams how to harden a PaperCut NG/MF deployment using the settings PaperCut documents: admin access and rights, web interface exposure, SSO, integration credentials, Secure Print Release, logging and updates. Everything here is a customer-side setting under a shared responsibility model.
This is an independent guide from NHI Mgmt Group, based on PaperCut's public documentation as of November 2026. It is not sponsored or reviewed by PaperCut. Product features change, so confirm settings against PaperCut's current documentation.
Key takeaways
- Named admins, not the shared admin account. PaperCut recommends giving each administrator a unique account and managing rights under Options, Admin Rights, rather than sharing the built-in admin login.
- Restrict who can reach the server. Options, Advanced, Security lets you allow-list the addresses that may use admin login, devices, Site Servers, secondary print servers, XML Web Service callers and Mobile Client proxies.
- HTTPS with a CA-signed certificate everywhere. Replace the self-signed certificate, force HTTPS, enable HSTS and set secure cookie flags in server.properties, then test every component.
- The server file system is sensitive. PaperCut stores items such as external database credentials on disk, so local administrator rights on the host are effectively PaperCut admin rights.
- Review audit logs and stay current. Check Logs, Audit Logs regularly and apply PaperCut security updates promptly from its security bulletins.
How identity and access work in PaperCut NG/MF
PaperCut has several identity planes, and each needs its own control:
| Identity | Where it lives | Hardening focus |
|---|---|---|
| End users | Synced from a directory such as Active Directory, Google Workspace, LDAP or Microsoft Entra ID | Directory sync over a protected channel (PaperCut documents LDAP over SSL), SSO for web access, authentication at devices |
| Administrators | Built-in admin account plus users or groups granted admin rights | Unique named admins, least privilege rights, SSO for the admin web interface, IP allow-listing for admin login |
| Internal users | PaperCut's own user store, when enabled | PaperCut states internal passwords are stored BCrypt hashed and salted; keep internal users to the cases that need them |
| Servers and devices | Site Servers, secondary print servers, MFDs, Mobile Client proxies | IP allow-listing, HTTPS with valid certificates, SNMPv3 where devices support it |
| Integrations | XML Web Services callers and their authentication token, scripts | Token treated as a secret, localhost or allow-listed callers only, script controls in security.properties |
The admin and integration rows are machine and privileged identities in practice. If you track service accounts and secrets elsewhere, add the PaperCut ones to the same inventory. See the Least Privilege Techniques Guide.
Admin roles and privileged access
PaperCut supports admin access at different levels: system administrators can reach every feature, while office staff can be limited to reports or subsets such as Shared Account management. Access can be granted through security groups in your directory.
- Unique accounts: grant admin rights to named users or directory groups under Options, Admin Rights, and stop day-to-day use of the shared built-in admin account. Keep its password in your privileged access vault for break-glass use (our recommendation).
- Least privilege: give help desk and finance staff only the rights they need, such as reports or shared accounts, rather than full system administration.
- Group-based grants: use directory groups so that leavers and movers lose PaperCut admin rights through normal identity lifecycle processes.
- Admin login allow-list: restrict admin login to admin workstations or a management network in Options, Advanced, Security. The field accepts ranges or comma-separated lists.
- Session controls: PaperCut's manual documents changing the web session inactivity timeout and CSRF validation properties; set the timeout to match your admin session policy.
- Host access: limit local administrator rights on the PaperCut server and audit them regularly, because PaperCut keeps sensitive data such as external database credentials on the file system.
Single sign-on and MFA
PaperCut NG/MF documents SAML 2.0 single sign-on with Microsoft Entra ID, Google Workspace, Okta and generic SAML 2.0 providers, plus direct Sign in with Microsoft Entra ID and Google Workspace options. PaperCut lists the Admin web interface and Print Deploy among the interfaces that support SSO. Routing admin and user web logins through your identity provider lets you apply its MFA and conditional access policies to PaperCut, which is our recommended way to add MFA to PaperCut web access. Keep one break-glass admin path documented and tested. See the Identity Provider and SSO Security Guide.
Web interface exposure and transport security
PaperCut's "Secure your PaperCut NG/MF server" article sets out a baseline for the Application Server's web interface:
| Setting | Where | Notes from PaperCut's docs |
|---|---|---|
| CA-signed certificate | Application Server certificate store | Replace the preinstalled self-signed certificate; document the steps and set a renewal reminder. |
| Force HTTPS | "Forcing use of HTTPS/SSL only" | Inherited by Site Servers when forced on the primary; install valid certificates there too or devices may fail to connect. |
| HSTS | Web server security settings | PaperCut added HSTS support in version 17.1. |
| TLS ciphers and protocols | SSL cipher configuration | Disable older ciphers and protocols, then test older copiers, whose firmware may not support newer settings. |
| Secure cookies | [app-dir]/server/server.properties | Add server.cookies.force-http-only=Y and server.cookies.force-secure=Y, then restart the Application Server service. The session cookie is already Secure and HttpOnly over HTTPS. |
| Login autocomplete | Advanced config key auth.web-login.autocomplete | Set to N; new installs already default to N. |
| Host header override | "Override the Host header for redirects" | Stops redirects revealing the server's internal hostname or IP; users must then use the hostname on the certificate. |
| Firewall | Host or network firewall | Allow only the ports PaperCut lists as required for your components. |
PaperCut also describes enabling ports 80 and 443 so users do not type port 9192; it presents this as a usability change, so pair it with forced HTTPS. Do not publish the admin interface to the internet: keep it on internal networks and use the admin login allow-list (our recommendation). Print Deploy has its own certificate, cipher and protocol settings, documented in PaperCut's "Enhance Print Deploy Security" article. See the Machine Identity, PKI and Certificate Lifecycle Guide for certificate renewal discipline.
Integrations, API tokens and service accounts
- XML Web Services API: PaperCut states that by default the API accepts calls only from localhost (127.0.0.1) and still requires an authentication token; calls without the token are rejected. Add other callers to the XML Web Service allow-list in Options, Advanced, Security only when an integration needs it.
- Treat the token as a secret: store the web services authentication token in a secrets manager, limit who can read it, and rotate it when an integration owner leaves (our recommendation). See the Cloud Secrets Managers Guide.
- Scripting controls: PaperCut documents a security.properties file that governs print and device scripting, custom user sync and card conversion scripts. Enable only the scripting features you use and restrict who can edit scripts.
- Directory service account: the account PaperCut uses to read your directory should be read-only and scoped to the users and groups PaperCut needs. Use LDAP over SSL, which PaperCut documents.
- External database credentials: these live on the server's file system, so protect the host and limit who can read the application directory.
- Devices: restrict device and Site Server connections by IP, and where your devices support it use SNMPv3, which PaperCut documents switching to.
- System Health interface: PaperCut documents an authorisation key for the System Health interface used by monitoring tools; keep it in the same secrets store as the web services token.
Secure Print Release
With Secure Print Release, a user must authenticate at the device before a held job prints, so documents do not sit in output trays. PaperCut's manual covers device authentication methods, Release Stations, Find-Me printing, release with load balancing and securing jobs while they wait to be printed. Hardening points:
- Hold sensitive queues: put queues used by HR, finance, legal and executive teams on hold/release so jobs need a user to release them (our recommendation, applied to all queues where practical).
- Strong device authentication: prefer card plus PIN or SSO-linked identity at devices over username and password typed on a panel; choose from the methods PaperCut lists for your device type.
- Protect waiting jobs: follow PaperCut's guidance on securing print jobs while they wait, and, as our recommendation, configure held jobs to be deleted after a set time so abandoned documents do not wait indefinitely.
- Prevent release to faulty devices: PaperCut documents preventing release when a printer is in error, which avoids jobs printing unattended later.
Logging and detection
PaperCut recommends reviewing Logs, Audit Logs regularly. Forward the logs you can to your SIEM and watch for:
| Signal | Why it matters | Suggested response (ours) |
|---|---|---|
| Changes to Admin Rights or new admin groups | Privilege change in the print system | Confirm against a change ticket |
| Admin logins from outside the allow-listed range or at unusual times | Possible misuse of admin credentials | Verify with the admin; reset credentials if unexplained |
| Changes to scripts, security.properties or server.properties | Changes to code or security settings on the server | Compare with the approved baseline |
| Edits to the Options, Advanced, Security allow-lists | Wider network exposure | Review the business reason |
| New web services callers or token changes | New integration access | Check the integration register |
| Local administrator group changes on the host | Access to credentials on disk | Alert and review the same day |
Useful metrics (ours): number of people with full system admin rights; share of admin logins through SSO; days since the last audit log review; days to apply a PaperCut security update after release; certificates within 30 days of expiry. See the CIS Control 8 Audit Log Management Guide.
Hardening baseline and rollout
- Inventory: list the Application Server, Site Servers, secondary print servers, devices, integrations and every account with admin rights.
- Identity first: create named admin accounts or groups, set least privilege rights, configure SSO for the admin web interface, and vault the built-in admin password.
- Transport: install CA-signed certificates on every server, then force HTTPS, enable HSTS and set the secure cookie keys. Do this in a change window.
- Exposure: set the Options, Advanced, Security allow-lists and the host firewall, and confirm the admin interface is internal only.
- Integrations: register each web services caller, store tokens in a secrets manager, and review scripting settings in security.properties.
- Test: PaperCut advises checking that secondary servers, Site Servers, Direct Print Monitor workstations and web services integrations still communicate, and testing older devices after TLS or HTTPS changes.
- Roll back: keep copies of server.properties and other changed files, note previous cipher settings, and revert one change at a time if devices stop connecting. PaperCut notes that temporarily disabling the firewall can help isolate a fault; re-enable it straight after.
- Maintain: apply PaperCut and operating system updates promptly, and follow PaperCut's security bulletins.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|
| Named admins and least privilege | AC-2, AC-6 | PR.AA-05 |
| SSO and authentication | IA-2 | PR.AA-01 |
| Allow-lists and access enforcement | AC-3 | PR.AA-05 |
| Audit log review | AU-2, AU-6, AU-12 | PR.PS-04, DE.CM-03 |
| Credentials on disk and tokens | SC-28, SC-12 | PR.DS-01 |
Common misconfigurations
- Shared admin login: several people use the built-in admin account, so the audit log cannot show who made a change. Move to named admins.
- Self-signed certificate left in place: users learn to click through warnings and HSTS cannot be used. Install a CA-signed certificate.
- Open allow-lists: admin login, device and web services allow-lists left wide. Narrow them to known ranges.
- Token in a script file: the web services token copied into scripts on several hosts. Move it to a secrets manager.
- Broad host access: many people hold local administrator rights on the PaperCut server, which exposes stored credentials. Reduce and audit.
- Untested TLS changes: ciphers tightened without testing older devices, then reverted under pressure. Test in a change window with a rollback plan.
Practitioner checklist
- Give every administrator a named account or group and vault the built-in admin password.
- Set admin rights to least privilege under Options, Admin Rights.
- Route admin web logins through SAML SSO with IdP MFA.
- Allow-list admin login, devices, Site Servers and web services callers in Options, Advanced, Security.
- Install CA-signed certificates, force HTTPS, enable HSTS and set the secure cookie keys.
- Store the web services token and System Health key in a secrets manager.
- Use hold/release with device authentication for sensitive queues.
- Limit and audit local administrator rights on the PaperCut host.
- Review Logs, Audit Logs regularly and forward events to your SIEM.
- Apply PaperCut security updates promptly from its security bulletins.
Standards and references
- PaperCut: Secure your PaperCut NG/MF server
- PaperCut: Tell me about PaperCut's security
- PaperCut NG/MF manual: Single sign-on
- PaperCut NG/MF manual: Secure Print Release
- PaperCut NG/MF manual: Secure configuration (security.properties)
- PaperCut: Security bulletins
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Identity Provider and SSO Security Guide · Least Privilege Techniques Guide · Machine Identity, PKI and Certificate Lifecycle Guide · CIS Control 8 Audit Log Management Guide