cups-files.conf(5)

🌸 NAME 🌸

cups-files.conf — the file-and-directory config file for cups, bestie 💖

---

✨ DESCRIPTION ✨

Okay so cups-files.conf is the glow-up file that tells the CUPS scheduler, cupsd(8), where all its files and directories live. It usually chills in the /etc/cups directory, like that's its home base 🏠

Every line in this file is one of three things: a configuration directive, a blank line, or a comment. Directives are typically a name plus zero or more values, all separated by whitespace. And get this — the directive name AND its values are case-insensitive, so live your truth, capitalize however you want. Comment lines start with the # character 💅

🌈 DIRECTIVES 🌈

These are the directives cupsd(8) understands, no cap:

• AccessLog
• AccessLog filename
• AccessLog stderr
• AccessLog syslog — Defines the access log filename. If you leave the filename blank, access log generation gets disabled, periodt. The value "stderr" sends log entries to the standard error file when the scheduler is running in the foreground, or to the system log daemon when it's running in the background. The value "syslog" sends log entries to the system log daemon. You can slip the server name into filenames using the string "%s", like this:

AccessLog /var/log/cups/%s-access_log

The default is "/var/log/cups/access_log".

• CacheDir directory — Specifies the directory for long-lived temporary (cache) files. The default is "/var/spool/cups/cache" or "/var/cache/cups" depending on the platform.
• ConfigFilePerm mode — Specifies the permissions for all configuration files that the scheduler writes. The default is "0644" on macOS and "0640" on all other operating systems.

Note: the permissions for the printers.conf file are currently masked to only allow access from the scheduler user (typically root). This happens because printer device URIs sometimes contain sensitive authentication info that should not be generally known on the system. There is no way to disable this security feature. It's giving locked-down and honestly, slay 🫶

• CreateSelfSignedCerts yes
• CreateSelfSignedCerts no — Specifies whether the scheduler automatically creates self-signed certificates for client connections using TLS. The default is yes.
• DataDir path — Specifies the directory where data files can be found. The default is usually "/usr/share/cups".
• DocumentRoot directory — Specifies the root directory for the CUPS web interface content. The default is usually "/usr/share/doc/cups".
• ErrorLog
• ErrorLog filename
• ErrorLog stderr
• ErrorLog syslog — Defines the error log filename. If you leave the filename blank, error log generation gets disabled. The value "stderr" sends log entries to the standard error file when the scheduler is running in the foreground, or to the system log daemon when it's running in the background. The value "syslog" sends log entries to the system log daemon. Server name goes in filenames with the string "%s", like:

ErrorLog /var/log/cups/%s-error_log

The default is "/var/log/cups/error_log".

• FatalErrors none
• FatalErrors all -kind [ ... -kind ]
• FatalErrors kind [ ... kind ] — Specifies which errors are fatal, meaning they make the scheduler exit 😭 The default is "config". The kind strings are:
  • none — No errors are fatal.
  • all — All of the errors below are fatal.
  • browse — Browsing initialization errors are fatal, for example failed connections to the DNS-SD daemon.
  • config — Configuration file syntax errors are fatal.
  • listen — Listen or Port errors are fatal, except for IPv6 failures on the loopback or "any" addresses.
  • log — Log file creation or write errors are fatal.
  • permissions — Bad startup file permissions are fatal, for example shared TLS certificate and key files with world-read permissions.
• Group group-name-or-number — Specifies the group name or ID that will be used when executing external programs. The default group is operating system specific but is usually "lp" or "nobody".
• LogFileGroup group-name-or-number — Specifies the group name or ID that will be used for log files. The default group is operating system specific but is usually "lp" or "nobody".
• LogFilePerm mode — Specifies the permissions of all log files that the scheduler writes. The default is "0644".
• PageLog [ filename ]
• PageLog stderr
• PageLog syslog — Defines the page log filename. The value "stderr" sends log entries to the standard error file when the scheduler is running in the foreground, or to the system log daemon when it's running in the background. The value "syslog" sends log entries to the system log daemon. Leaving the filename blank disables page log generation. Server name goes in filenames with the string "%s", like:

PageLog /var/log/cups/%s-page_log

The default is "/var/log/cups/page_log".

• PassEnv variable [ ... variable ] — Passes the specified environment variable(s) to child processes. Note: the standard CUPS filter and backend environment variables cannot be overridden using this directive.
• PeerCred off
• PeerCred on
• PeerCred root-only — Specifies whether peer credentials are used for authorization when communicating over the UNIX domain socket. When on, the peer credentials of any user are accepted for authorization. The value off disables peer credentials entirely, while root-only allows peer credentials only for the root user. Note: for security reasons, the on setting is reduced to root-only for authorization of PUT requests.
• RemoteRoot username — Specifies the username that gets associated with unauthenticated accesses by clients claiming to be the root user. The default is "remroot".
• RequestRoot directory — Specifies the directory that contains print jobs and other HTTP request data. The default is "/var/spool/cups".
• Sandboxing relaxed
• Sandboxing strict — Specifies the level of security sandboxing applied to print filters, backends, and other child processes of the scheduler. The default is "strict". This directive is currently only used/supported on macOS.
• ServerBin directory — Specifies the directory containing the backends, CGI programs, filters, helper programs, notifiers, and port monitors. The default is "/usr/lib/cups" or "/usr/libexec/cups" depending on the platform.
• ServerKeychain path — Specifies the location of TLS certificates and private keys. The default is "/Library/Keychains/System.keychain" on macOS and "/etc/cups/ssl" on all other operating systems. macOS uses its keychain database to store certificates and keys, while other platforms use separate files in the specified directory — *.crt for PEM-encoded certificates and *.key for PEM-encoded private keys.
• ServerRoot directory — Specifies the directory containing the server configuration files. The default is "/etc/cups".
• SetEnv variable value — Set the specified environment variable to be passed to child processes. Note: the standard CUPS filter and backend environment variables cannot be overridden using this directive.
• StateDir directory — Specifies the directory to use for PID and local certificate files. The default is "/var/run/cups" or "/etc/cups" depending on the platform.
• StripUserDomain Yes
• StripUserDomain No — Specifies whether to remove the domain from the user name during local user authentication (e.g., "user@example.com" –> "user"). This practice can be beneficial for maintaining compatibility with older versions of Kerberos. However, enabling this option can have negative consequences 😬 It may result in confusion between domain and local users with identical names, potentially leading to incorrect assignment of user permissions and unintentional permission escalation, thus creating a security risk. Therefore, it's advisable to avoid using this option in most cases.
• SyncOnClose Yes
• SyncOnClose No — Specifies whether the scheduler calls fsync(2) after writing configuration or state files.
• SystemGroup group-name [ ... group-name ] — Specifies the group(s) to use for @SYSTEM group authentication. The default contains "admin", "lpadmin", "root", "sys", and/or "system".
• TempDir directory — Specifies the directory where short-term temporary files are stored. The default is "/var/spool/cups/tmp".
• User username — Specifies the user name or ID used when running external programs. The default is "lp".

---

💀 DEPRECATED DIRECTIVES 💀

These directives are deprecated and will be removed from a future version of CUPS. They're giving aging out of relevance energy, so don't get too attached 🥲

• FileDevice Yes
• FileDevice No — Specifies whether the file pseudo-device can be used for new printer queues. The URI "file:///dev/null" is always allowed. File devices cannot be used with "raw" print queues — a PPD file is required. The specified file is overwritten for every print job. Writing to directories is not supported.
• Printcap filename — Specifies a file that is filled with a list of local print queues.
• PrintcapFormat bsd
• PrintcapFormat plist
• PrintcapFormat solaris — Specifies the format to use for the Printcap file. "bsd" is the historical LPD printcap file format. "plist" is the Apple plist file format. "solaris" is the historical Solaris LPD printcap file format.

---

🌟 NOTES 🌟

The scheduler MUST be restarted manually after you make changes to the cups-files.conf file. No shortcuts, bestie. On Linux this is typically done using the systemctl(8) command, while on macOS the launchctl(8) command is used instead.

---

🦋 SEE ALSO 🦋

classes.conf(5), cups(1), cupsd(8), cupsd.conf(5), mime.convs(5), mime.types(5), printers.conf(5), subscriptions.conf(5), CUPS Online Help (http://localhost:631/help)

---

👑 COPYRIGHT 👑

Copyright © 2020-2025 by OpenPrinting.

---

And that's the whole vibe check, bestie — this page is cups-files.conf(5) from the CUPS crew, dated 2025-10-08. Go restart that scheduler and live your main character life 💖✨🎀