🛡️ Google GCE Network allows unrestricted Telnet traffic🟢
- Contextual name: 🛡️ GCE Network allows unrestricted Telnet traffic🟢
- ID:
/ce/ca/google/vpc/network-telnet-access - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Logic
Description
Description
This policy identifies Google GCE Networks that have Firewall Rules allowing unrestricted incoming traffic (
0.0.0.0/0) from the internet to the Telnet portTCP/23.In GCP, Firewall Rules are defined at the VPC Network level. Each rule either allows or denies traffic based on its configuration. These configurations specify the type of traffic (e.g., protocols and ports) and the source or destination (e.g., IP addresses, subnets, and instances).
Rationale
Telnet is an obsolete and insecure remote access protocol. It transmits all information, including usernames and passwords, in plaintext, making it highly susceptible to eavesdropping. Any attacker on the same network can intercept credentials and session data. Exposing a Telnet service to the public internet makes it a frequent target for automated scanning and attacks. Secure alternatives, such as SSH, have largely replaced Telnet for remote administration.
Impact
All Telnet connections from outside of the network to the concerned VPC(s) can be blocked. If remote Telnet access is required for legitimate business purposes, firewall rules should explicitly whitelist trusted source IP addresses to limit exposure.
... see more
Remediation
Remediation
From Google Cloud Console
- Go to
VPC Network.- Go to the
Firewall Rules.- Click the
Firewall Ruleto be modified.- Click
Edit.- Modify
Source IP rangesto specificIP.- Click
Save.From Google Cloud CLI
Identify Firewall Rules Allowing Public Access
gcloud compute networks get-effective-firewalls default \
--format="table(NAME, DIRECTION, IP_RANGES)" \
--filter="IP_RANGES:0.0.0.0/0 AND DIRECTION:INGRESS"Restrict the Source Range
Once you have identified the firewall rules, update each one to restrict access to trusted CIDR ranges:
gcloud compute firewall-rules update {{firewall-rule-name}} \
--source-ranges={{cidr-range1}},{{cidr-range2}}