Host Access: restricting which hosts may send print jobs to RPM
RPM Remote Print Manager® (“RPM”) listens on the network for print jobs. Host Access is the setting that controls which machines are allowed to send them.
This page is written for two different readers who need opposite answers, so it is worth saying at the top which one you are.
- If your print jobs are not arriving, Host Access is almost certainly not the cause and turning it on will not help. It restricts; it does not enable. See step 9 of sending print jobs to RPM for the short version.
- If you are reviewing RPM for a security assessment, this is the access control on the listening service, and the rest of this page is for you.
What it does
Host Access is an address-based access control list applied to inbound print requests. As of RPM 6.2.0.600 (2026-04-05) it offers three modes:
| Mode | Behaviour |
|---|---|
| Allow all hosts | Any host may submit print jobs. This is the default |
| Allow all except those listed | A deny list. Everything is accepted except the hosts you name |
| Deny all except those listed | An allow list, or default-deny. Only the hosts you name may submit jobs |
Earlier versions offered only a single on/off toggle, so if you are looking at documentation or a screenshot showing one checkbox, that predates 6.2.0.600.
Hosts can be given as:
- an individual IP address
- a hostname
- a wildcard, such as
*.example.com - a CIDR range, such as
192.168.1.0/24
CIDR support arrived with the three modes in 6.2.0.600. The settings are under Configure / Security Settings in the RPM user interface.
The default is permissive, deliberately
Out of the box, RPM accepts print requests from any host that can reach it. That is worth stating plainly rather than leaving a reviewer to discover it.
The reason is that RPM’s job is to receive print jobs from hosts it was not told about in advance — that is what makes it useful in front of a mainframe, an AS/400 or a fleet of UNIX servers whose addresses change. A print server that refused unknown senders by default would fail its primary function on installation, and the failure would look like a network problem.
If your environment calls for a closed default, Deny all except those listed is the mode to use, and it is worth configuring on its own merits rather than as a stopgap.
What it is not
Being specific about the boundary is more useful than overstating the control.
- It is not authentication. Host Access filters on network address, not identity. Nothing in the LPR/LPD protocol carries a credential to check — RFC 1179 documents practice from an era that did not contemplate one — so address filtering is the control that is actually available at this layer.
- It is not encryption. Print data on port 515 or port 9100 is not encrypted in transit, whatever Host Access is set to.
- It does not defend against a spoofed source address. An allow list raises the effort required; it is not a cryptographic boundary.
What it does give you is a boundary that belongs to RPM itself, applied at the application layer, which is a different and complementary thing from a firewall rule.
Use it alongside a firewall, not instead of one
A network firewall stops unwanted traffic before it reaches the RPM host, which is the better place to stop it. Host Access still earns its place:
- it applies if the RPM host is moved to a different network segment
- it applies if someone else changes the firewall rule
- it applies to traffic that originates inside the perimeter, which is where a vulnerability scanner usually lives — see what to do when a client host sends the wrong input
Host Access changes are logged, so a restriction that takes effect is visible in the log rather than silent.
Related secure defaults
Host Access is one of several defaults tightened in recent releases. In 6.2.0.590 (2025-06-18):
- automatic queue creation was disabled by default, so a probe can no longer cause RPM to create queues (previously a common source of alarming-looking queue names — see how to prevent queue names appearing)
- RPM’s internal RPC, used by the user interface, was given a firewall exception that permits local connections only
- no UDP firewall exception is created at all
Further reading
- How to secure your RPM print server
- Sending print jobs to RPM, step by step — including why Host Access is not the fix for jobs that do not arrive
- Client host sending the wrong input to the LPD port
- Securing Firebird 2.5