Skip to main content

🛡️ AWS EC2 Security Group allows unrestricted Telnet traffic🟢

  • Contextual name: 🛡️ Security Group allows unrestricted Telnet traffic🟢
  • ID: /ce/ca/aws/ec2/security-group-allows-unrestricted-telnet-traffic
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

Verify that Telnet traffic to AWS EC2 instances is restricted. The Telnet protocol, operating on port 23, should not be open to all IP ranges (0.0.0.0/0) due to its lack of encryption and inherent security vulnerabilities.

Rationale​

Telnet transmits data, including credentials, in plaintext, making it highly susceptible to interception and exploitation by malicious actors. Allowing unrestricted Telnet access exposes instances to potential unauthorized access, data compromise, and increased vulnerability to man-in-the-middle attacks. By restricting Telnet traffic to trusted sources, you mitigate these risks and improve the overall security posture of your AWS environment. It's also encouraged to adopt secure alternatives, such as SSH, which provide encrypted communication.

Impact​

Requires configuration adjustments to ensure legitimate traffic is not disrupted.

Audit​

This policy marks an EC2 Security Group as INCOMPLIANT if it contains a rule that meets all the following conditions:

  • The Direction is set to Inbound.

... see more

Remediation​

Open File

Remediation​

From Command Line​

  1. Run the following command to remove or modify the unrestricted rule for Telnet access:

    aws ec2 revoke-security-group-ingress \
        --region {{region-name}} \
        --group-id {{security-group-id}} \
        --protocol {{protocol}} \
        --port 23 \
        --cidr {{0.0.0.0/0 or ::/0}}
    • Optionally, run the authorize-security-group-ingress command to create a new rule, specifying a trusted CIDR range instead of 0.0.0.0/0.

  2. Confirm the changes by describing the security group again and ensuring the unrestricted access rule has been removed or appropriately restricted:

    aws ec2 describe-security-groups \
        --region {{region-name}} \
        --group-ids {{security-group-id}} \
        --query 'SecurityGroups[*].IpPermissions[?FromPort==`23`].{CIDR:IpRanges[*].CidrIp,Port:FromPort}'

  3. Conduct tests to verify functionality of applications dependent on Telnet to ensure they are unaffected by the changes.

  4. Where possible, migrate services using Telnet to secure alternatives like SSH. Update configurations to use SSH and disable Telnet services.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.19] Security groups should not allow unrestricted access to ports with high risk10no data
💼 Cloudaware Framework → 💼 Network Exposure137no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)239112no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1168no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP High Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)22no data
💼 FedRAMP High Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)31833no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10888no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 FedRAMP High Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)23no data
💼 FedRAMP High Security Controls → 💼 SC-7(21) Isolation of System Components (H)37no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)29no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)49no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)194no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)68no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H)22no data
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)333no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)772no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)49no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)23no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events182no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained89no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected196no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected167no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected197no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage129no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3276131no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows4268no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2(2) Baseline Configuration _ Automation Support for Accuracy and Currency22no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-7 Least Functionality923no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29898no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services49no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception823no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic37no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components37no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components37no data