Information in this document is subject to change without notice. The software described in this
document is furnished under a license agreement or nondisclosure agreement. The software
may be used or copied only in accordance with the terms of those agreements.
For further information regarding legal and proprietary statements, please go to:
SOFTWARE: zebra.com/informationpolicy
COPYRIGHTS: zebra.com/copyright
WARRANTY: zebra.com/warranty
END USER LICENSE AGREEMENT: zebra.com/eula
Terms of Use
Proprietary Statement
This manual contains proprietary information of Zebra Technologies Corporation and its
subsidiaries (“Zebra Technologies”). It is intended solely for the information and use of parties
operating and maintaining the equipment described herein. Such proprietary information may not
be used, reproduced, or disclosed to any other parties for any other purpose without the
express, written permission of Zebra Technologies.
Product Improvements
Continuous improvement of products is a policy of Zebra Technologies. All specifications and
designs are subject to change without notice.
Liability Disclaimer
Zebra Technologies takes steps to ensure that its published Engineering specifications and
manuals are correct; however, errors do occur. Zebra Technologies reserves the right to correct
any such errors and disclaims liability resulting therefrom.
Limitation of Liability
In no event shall Zebra Technologies or anyone else involved in the creation, production, or
delivery of the accompanying product (including hardware and software) be liable for any
damages whatsoever (including, without limitation, consequential damages including loss of
business profits, business interruption, or loss of business information) arising out of the use of,
the results of use of, or inability to use such product, even if Zebra Technologies has been
advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or
limitation of incidental or consequential damages, so the above limitation or exclusion may not
apply to you.
Publication Date
May 11, 2022
Table of Contents
Terms of Use ..............................................................................................................................2
P1099957-08ENPrintSecure Printer Administration Guide Page 4 of 90
The concept of confidentiality is to
The Concept of data integrity is to
be used to validate integrity.
Introduction
This document details how to perform Administrator-level functions on a Zebra Label or Receipt
printer. The content in this document covers both Link-OS® and ZebraLink™ printers, though
the degree to which the two types of printers can be Administered is different. To make it easy to
see where a given Administrative feature is available, the document will display the Link-OS
or ZebraLink icon to indicate if the feature is available on the printer being configured.
Overview
Administering Zebra printers might, at first, appear to be a very different task than managing
other devices, such as computers or smartphones. Fortunately, there is a well-established,
reliable model and a set of best practices that can be easily applied to minimize risks and make
the task straightforward.
The "CIA Model" provides a guiding framework when considering how to reasonably and
effectively raise the bar on risk mitigation. The model can be applied to all devices that utilize
the data protected by enterprise information systems, from the more traditional connected
solutions to other players in the connected environment, such as intelligent thermal barcode
printers. This model includes three components:
ensure that information is only
available to the people who are
authorized to access it. This protection
applies equally to data at rest, in
motion and during processing.
Confidentiality and Privacy are
sometimes used interchangeably;
however, confidentiality is normally an
extension of privacy. Data encryption
is a common method of ensuring
confidentiality as are various methods
ensure consistency, accuracy, and
trustworthiness of the data over its
entire lifecycle. It also means that
when a file is stored and then
accessed later, there will be certainty
that the data had not been directly or
indirectly altered by an unauthorized
entity while in storage. Access controls
can prevent unauthorized access and
checksums (CRC), cryptography
(Hashes) and Digital Signatures can
P1099957-08ENPrintSecure Printer Administration Guide Page 5 of 90
The Concept of availability is to
ensure that the resource is available
when the user needs it. This can
include keeping it functioning and
regularly updated to prevent attacks
that affect its stability. Some of the
responsibility for availability also relies
upon the infrastructure that the
resource is connected to and how it is
connected (Wired/Wireless/etc.).
Business critical resources need to be
available when needed, otherwise, a
plan must be in place to scale or have
a backup of the device to reduce
downtime.
Common Sense Best Practices
There are a set of Best Practices you can put in place to align your printer Administration with
the CIA concepts. By applying these common-sense Best Practices, you can reduce risk, while
still optimizing your use of thermal barcode printers.
1
2
3
4
5
6
•Start early. Plan for incoming devices, and how they will be protected.
•Use encrypted and authenticated connections. Avoid connecting devices directly
to the Internet and instead use internal networks or a firewall.
•Plan to rotate access passwords, access keys and authentication credentials.
•Defaults settings represent well-known methods to access a device. Make use of
User Interface Passwords, and admin authentication. Turn off unused services to
reduce a device's attack surface.
•Leverage a remote management system to easily update settings across a fleet of
devices. The longer devices are using out dated settings, the longer they represent
an easier target.
•Limit informaiton disclosure, and only inform those who must know when planned
updates are scheduled.
•Continuously monitor your system for lost devices. If a device has potentially been
7
8
9
10
P1099957-08ENPrintSecure Printer Administration Guide Page 6 of 90
taken out of the enterprise environment, withdraw its credentials until the device
status is determined.
•Choose devices that can be regularly updated across their long service lives to
stay current with security best practices. Verify that the update system uses a
method to ensure integrity of any updates to prevent tampering.
•Plan for device retirement by having a decommission process to remove sensitive
enterprise data, and delete device user Accounts/Credentials.
•Consider Confidentiality, Integrity, and Availability during all stages of the device's
lifecycle.
Desktop Printers
T300/T402
Desktop Printers
Desktop Printers
Mobile Printers
ZQ110
Mobile Printers
Mobile Printers
Industrial Printers
105Se
Industrial Printers
XiII through Xi4 series
Industrial Printers
Others
Others
Others
Legacy
Models
Steps to Take:
Applying these Best Practices is straightforward. The process involves four steps:
1. Census – which devices do you have?
2. Consider – which Admin capabilities do your printers have?
3. Configure – send commands to alter Admin settings
4. Confirm – validate the new settings
Census: Which Devices Do You Have?
Zebra has been making printers for over 40 years. In that time, the scope of Administrator-level
settings has grown. It is important to know which printer models you are working with to know
which Administrator controls are available. The chart below will help you place your printer
model into one of three categories:
(no admin features)
A100 series
A300 series
Bravo series
Companion
Encore series
LP/TLP series
Tiger Writer
2746 series
HT146
DA402
R402
Cameo series
MP series
QL series
PA400 series
PT400 series
PS2000-PS400 series
TR220
(limited admin features)
Link-OS®
(most admin features)
LP/TLP-Z series
LP/TLP Plus series
S300
S400
S500
S600
G series
HC100
QLPlus series
P4T series
RW Series
ZD200 series
ZD400 series
ZD500 series
ZD600 series
iMZ series (up to Link-OS 5.2)
QLn series (up to Link-OS 5.2)
ZQ300 series
ZQ500 series
ZQ600 series
ZR300 series
ZR600 series
Z60 series
Z90 series
Z100 series
Z140 series
Z200 series
TTP Kiosk printer series
Z4000/Z6000
Z4M/Z6M
ZM400/600 series
105SL series
105SL Plus series
PAX 2 through PAX5 series
ZE500 series
KR403
ZT200 series
ZT400 series
ZT500 series
ZT600 series
ZE501 series
P1099957-08ENPrintSecure Printer Administration Guide Page 7 of 90
Security
Protected Mode
OS Download Blocking
Decommissioning Mode
Services
HTTP
HTTPS
FTP
LPD
UDP
SMTP
SNMP
Raw Telnet
POP3
NTP
Communications
Auto-WLAN Cert Management
Bluetooth Mode
Bluetooth Discoverability
Bluetooth Enable
BTLE
USB Host
Ethernet
WLAN
ESSID
802.11x
RTS/CTS Protection
IP Address Allow list
IP Port
IP Alternate port
JSON port
Single connection port
TLS IP Port
TLS JSON Port
TLS Enable
Web sockets port
Asset Visibility Agent
MQTT
Applications
Data Capture
XML Printing
USB Mirror
FTP Mirror
SFTP Mirror
Zebra Basic Interpreter
APL Emulations
User Interface
Password
Consider: Which Admin Capabilities Does Your Printer Have?
Link-OS printers support a wide range of administrative commands and features.
P1099957-08ENPrintSecure Printer Administration Guide Page 8 of 90
Premade Administration Files
Zebra has created several sets of pre-made files that you can send to your printer to quickly
enable some of the most common security settings. These pre-made Admin Files were designed
and built using the commands documented in this guide. However, because different user’s
networks operate in different ways, there is no one configuration file that could address every
user’s needs.
To obtain the pre-made Admin Files, go to: https://www.zebra.com/printsecure
You should edit the files to adapt to your unique needs. As you work with the Printer
Administration Guide, you will quickly discover which commands and settings that are
appropriate for your use case. For example, if your application uses Mirror, then turning off FTP
would not make sense, since Mirror uses FTP to communicate to the printer. This example
demonstrates why it is important to consider the following pages below before sending the files.
Sending the Administration files is simple. You can send the files to any port on the printer using
our Printer Setup Utility or the legacy Z-Downloader utility.
The Printer Setup Utility can be downloaded from: www.zebra.com/setup
The legacy Z-Downloader app can be downloaded from:
The Premade Administration files come in four groups:
•Applications – Three files, which can be used to set, check settings, or default the
application settings on the printer.
•Communications – Three files, which can be used to set, check settings, or default the
communication settings on the printer.
•Services – Three files, which can be used to set, check settings, or default the services
settings on the printer.
•User interface – Two files, which can be used to set or default the user interface
settings on the printer. (Important note: Zebra recommends that to not use the sample
password shown in this file, please change it.)
Configure:
Send Commands to alter Admin settings
Confirm:
Validate the New Settings
This can be the most time-consuming portion of the process. Each Administrative capability
used will have consequences for how the printer works, what it can do, and how it will work with
other devices. Time should be taken to carefully consider which administrative features are
used, and how they may impact the use of the printer.
P1099957-08ENPrintSecure Printer Administration Guide Page 9 of 90
Commands:
In this section, each Admin capability will be detailed, along with its defaults, its range of
settings, how to activate/deactivate it, along with some notes to help you carefully consider the
use of the capability.
NOTE: Many of the Administrative capabilities are controlled using the Set-Get-Do command
language. If you are not familiar with this language, please consult the Zebra Programming
Guide, SGD Chapter for help with syntax and how to use this printer feature.
Protected Mode Commands
Protected Mode State ........................ 11
Protected Mode Allowed .................... 12
Printer OS Download Control ............. 13
Services and Networking Commands
HTTP Service 14
HTTPS Service 15
FTP Service 16
LPD Service 17
UDP Service 18
SMTP Service 19
SNMP Service 20
POP3 Mail Service 21
NTP Service 22
Time 23
Communications Commands
Bluetooth Enable ............................... 24
Bluetooth Discoverability ................... 25
Bluetooth Mode ................................. 26
USB Host .......................................... 27
Note: If this setting is set to "no", Printer OS downloads will not be possible. In this case the
allow-next-firmware-download operation can be used to allow the next firmware file to be
accepted. Please refer to the section labeled Printer OS Download Protection later in the guide
for details.
P1099957-08ENPrintSecure Printer Administration Guide Page 13 of 90
HTTP SERVICE
Supported Printer Types
Considerations: The HTTP service runs on port 80 and provides support for the printer’s
Note: Alerts with this destination will not work when this service is disabled.
Control Commands: The HTTP capability is controlled by the ip.http.enable command
Return to Command List
Services and Networking Commands
Description: This service is used to provide
HTTP access to the printer
internal web pages. It is important to note that any POST to URL capability is disabled when
this service is not enabled. The printer can still be managed by the Printer Profile Manager
Enterprise app or via direct commands when this is disabled. To limit unauthorized access
the printer should not be accessible on the public Internet. Instead, consider accessing it
through a firewall or on an internal private network only.
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.http.enable" "on"
P1099957-08ENPrintSecure Printer Administration Guide Page 14 of 90
HTTPS SERVICE
Supported Printer Types
Considerations: The HTTPS service runs on port 443 and provides support for the printer’s
internal private network only.
Control Commands: The HTTPS capability is controlled by the ip.https.enable command
Return to Command List
Services and Networking Commands
Description: This service is used to provide
HTTPS access to the printer
internal web pages utilizing a secure connection. While HTTPS provides encrypted
communication, one should still limit unauthorized access by not allowing the printer to be
accessible on the public Internet. Instead, consider accessing it through a firewall or on an
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.https.enable" "on"
Note: This command requires that a valid certificate is present on the printer.
The certificate and private key can be deployed to the device as a single file, or separate files. If
using a single file, the name of the file must be:
HTTPS_CERT.NRD
If using multiple files:
HTTPS_CERT.NRD – certificate file
HTTPS_KEY.NRD – private key file
Once TLS communication is verified and operational, it is a security best practice to disable
unencrypted forms of communicating with the printer over a network.
P1099957-08ENPrintSecure Printer Administration Guide Page 15 of 90
FTP SERVICE
Supported Printer Types
Description: This service is used to send
Do commands).
Considerations: The FTP service run on port 21 and can be used to place files on the
use it for file transfer, printing or device management.
Control Commands: The FTP capability is controlled by the "ip.ftp.enable" command
Return to Command List
Services and Networking Commands
commands or files that the printer will act upon
(this can include, CPCL, EPL, ZPL and Set-Get-
printers file system, or for printing. It is also the protocol used by the Mirror device
management features. It is not a service that is typically used for printing. As such, it’s a good
candidate to be disabled, however, it’s important to first check if your organization plans to
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.ftp.enable" "on"
Note: Only Link-OS printers can use SFTP. For further information on FTP and SFTP Mirror,
refer to the Programming Guide.
P1099957-08ENPrintSecure Printer Administration Guide Page 16 of 90
LPD SERVICE
Supported Printer Types
Description: This service is used to send print
include, CPCL, EPL, ZPL).
Considerations: The LPD service uses port 515 and is a printing protocol typically used in
and disable the appropriate port(s).
Control Commands: The LPD capability is controlled by the ip.lpd.enable command
Return to Command List
Services and Networking Commands
jobs to the printer that it will act upon (this can
Unix/Linux systems and the Mac OS environment. This can be supported on a Windows
network with the addition of software features. Check which printing technology you are using
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.lpd.enable" "on"
P1099957-08ENPrintSecure Printer Administration Guide Page 17 of 90
UDP SERVICE
Supported Printer Types
Considerations: The User Datagram Protocol (UDP) is a connectionless protocol in contrast
based communication (such as SNMP) are not affected.
Control Commands: The UDP capability is controlled by the ip.udp.enable command
Return to Command List
Services and Networking Commands
Description: The UDP socket is only used for
port defined by ip.port.
to Transmission Control Protocol (TCP) which requires a validated connection and an IP
address. The primary purpose of this service is to communicate with the printer command
language parser via UDP.
Note: Alerts with this destination will not work when this service is disabled. All other UDP
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.udp.enable" "on"
P1099957-08ENPrintSecure Printer Administration Guide Page 18 of 90
TCP SERVICE
Supported Printer Types
Description: The TCP socket is used for ports
ip.port_single_conn
Considerations: The Transmission Control Protocol (TCP) provides a reliable, ordered,
based communication (such as HTTP) are not affected.
Control Commands: The TCP capability is controlled by the ip.tcp.enable command
Return to Command List
Services and Networking Commands
defined by:
ip.port
ip.port_alternate
ip.port_json_config
error-checked, validated connection in contrast to User Datagram Protocol (UDP). The
primary purpose of this service is to communicate with the printer command language parser
via TCP.
Note: Alerts with this destination will not work when this service is disabled. All other TCP
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.smtp.enable" "on"
Note: Ensure that the other dependent settings are configured correctly when using this
capability
For further information on SMTP refer to the Programming Guide.
For example:
ip.smtp.server_addr
ip.smtp.domain
P1099957-08ENPrintSecure Printer Administration Guide Page 20 of 90
SNMP SERVICE
Supported Printer Types
Description: The Simple Network Management
standard protocol.
Considerations: The SNMP service uses UDP port 161 and allows the configuration of the
Note: Alerts with this destination will not work when this service is disabled.
Control Commands: The SNMP capability is controlled by the ip.snmp.enable command
Return to Command List
Services and Networking Commands
Protocol (SNMP) service enables the
manageability of the printer using this industry
printer and supports the issuance of SNMP trap messages. Some of the basic printer MIB is
supported as well as a private MIB that contains Zebra specific settings and configuration. By
default, this uses the public community name, if you intend to use this consider changing the
community name from the default.
P1099957-08ENPrintSecure Printer Administration Guide Page 22 of 90
NTP SERVICE
Supported Printer Types
Considerations: The NTP command will enable or disable the Network Time Protocol
host system.
Control Commands: The NTP capability is controlled by the ip.ntp.enable command
Return to Command List
Services and Networking Commands
Description: This command enables or disables
the Network Time Protocol (NTP) feature.
capability which allows the printer to synchronize with time servers. This may be important if
there are date or time fields printed on the label. Time and data can also be provided by the
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "ip.ntp.enable" "off"
Note: Ensure that the other dependent settings are configured correctly when using this
capability
For further information on NTP refer to the Programming Guide.
For example:
ip.ntp.servers
ip.ntp.log
P1099957-08ENPrintSecure Printer Administration Guide Page 23 of 90
TIME
Supported Printer Types
Description: This command sets or gets the
number of seconds since January 1st 1970.
Considerations: If NTP is unavailable, time can be set using this command. Setting time in
this way is useful for devices that exists across multiple time zones.
Control Commands: The Unix Epoch capability is controlled by the rtc.unix_timestamp
The printer responds with the current setting value, or "?" if not supported.
To reset the device to the default state:
! U1 setvar "bluetooth.discoverable" "off"
Note: The default value of this setting has changed as of Link-OS 6 and is now off by default to
improve security. Bluetooth Discovery and Pairing Mode can be activated by holding the FEED
button on the printer for 5 seconds. For further details please refer to the Link-OS 6 Release
notes.
P1099957-08ENPrintSecure Printer Administration Guide Page 26 of 90
BLUETOOTH MODE
Supported Printer Types
Description: For printers that support both
operation.
Considerations: The Bluetooth radio can be configured to work in the following mode; BTLE,
Classic or Both.
Control Commands: The Bluetooth controller mode is controlled by the
Return to Command List
Communications Commands
Bluetooth Classic and Bluetooth Low Energy
(BTLE), this command controls the mode of