diff --git a/config/cups/cupsd.conf b/config/cups/cupsd.conf
new file mode 100644
index 000000000..fc2817111
--- /dev/null
+++ b/config/cups/cupsd.conf
@@ -0,0 +1,71 @@
+#
+#   IPFire configuration file for the Common UNIX Printing System (CUPS)
+#   scheduler.  See "man cupsd.conf" for a complete description of this
+#   file.
+#
+
+# Log general information in error_log - change "info" to "debug" for
+# troubleshooting...
+LogLevel info
+
+# Administrator user group...
+SystemGroup sys root
+
+# Only listen for connections from the local machine.
+Listen 631
+Listen /var/run/cups/cups.sock
+
+# Show shared printers on the local network.
+Browsing On
+BrowseOrder allow,deny
+BrowseAllow @LOCAL
+
+# Default authentication type, when authentication is required...
+DefaultAuthType Basic
+
+# Restrict access to the server...
+<Location />
+  Order allow,deny
+  Allow from All
+</Location>
+
+# Restrict access to the admin pages...
+<Location /admin>
+  Encryption Required
+  Order allow,deny
+  Allow from All
+</Location>
+
+# Restrict access to configuration files...
+<Location /admin/conf>
+  AuthType Basic
+  Require user @SYSTEM
+  Order allow,deny
+  Allow from All
+</Location>
+
+# Set the default printer/job policies...
+<Policy default>
+  # Job-related operations must be done by the owner or an adminstrator...
+  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job>
+    Require user @OWNER @SYSTEM
+    Order deny,allow
+  </Limit>
+
+  # All administration operations require an adminstrator to authenticate...
+  <Limit Pause-Printer Resume-Printer Set-Printer-Attributes Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Add-Printer CUPS-Delete-Printer CUPS-Add-Class CUPS-Delete-Class CUPS-Accept-Jobs CUPS-Reject-Jobs CUPS-Set-Default>
+    AuthType Basic
+    Require user @SYSTEM
+    Order deny,allow
+  </Limit>
+
+  # Only the owner or an administrator can cancel or authenticate a job...
+  <Limit Cancel-Job CUPS-Authenticate-Job>
+    Require user @OWNER @SYSTEM
+    Order deny,allow
+  </Limit>
+
+  <Limit All>
+    Order deny,allow
+  </Limit>
+</Policy>
diff --git a/lfs/cups b/lfs/cups
index e2ef01ffb..f6864f16a 100644
--- a/lfs/cups
+++ b/lfs/cups
@@ -83,5 +83,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && make install
 	cd $(DIR_APP) && ln -v -sf /usr/bin/smbspool /usr/lib/cups/backend/smb
 	install -v -m 754 $(DIR_SRC)/src/initscripts/init.d/cups /etc/rc.d/init.d
+	cp -fv $(DIR_SRC)/config/cups/cupsd.conf /var/ipfire/cups/
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)