Unrestricted Telnet Access Should Not Be Allowed

Using Console

To remediate the misconfiguration of unrestricted Telnet access in AWS, you can follow the below steps:

Log in to the AWS Management Console.
Go to the EC2 Dashboard.
Click on the Security Groups option from the left navigation pane.
Select the security group that has unrestricted Telnet access.
Click on the Inbound Rules tab.
Locate the rule that allows Telnet access (port 23) and select it.
Click on the Delete button to remove the rule.
Click on the Save Rules button to save the changes.

This will remove the unrestricted Telnet access from the security group and help remediate the misconfiguration.

Using CLI

To remediate the unrestricted Telnet access in AWS using AWS CLI, follow the steps below:

Open your terminal and configure your AWS CLI with the necessary credentials.
Run the following command to list all the security groups in your AWS account:

aws ec2 describe-security-groups

Identify the security group that has unrestricted Telnet access. Look for the security group that has port 23 open to all IP addresses (0.0.0.0/0).
Note down the security group ID of the identified security group.
Run the following command to revoke the Telnet access from the identified security group:

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 23 --cidr 0.0.0.0/0

Replace <security-group-id> with the ID of the identified security group.

Verify that the Telnet access has been revoked by running the following command:

aws ec2 describe-security-groups --group-ids <security-group-id>

This should show that the Telnet access has been removed from the identified security group.By following these steps, you have successfully remediated the unrestricted Telnet access in AWS using AWS CLI.

Using Python

To remediate the unrestricted Telnet access misconfiguration in AWS using Python, you can follow the below steps:

First, you need to identify the security group(s) that have unrestricted Telnet access. You can use the following Python code to retrieve the security groups:

import boto3

ec2 = boto3.resource('ec2')

# Get all security groups
security_groups = list(ec2.security_groups.all())

# Loop through each security group
for sg in security_groups:
    # Check if Telnet access is allowed
    for rule in sg.ip_permissions:
        if rule['IpProtocol'] == 'tcp' and rule['FromPort'] == 23 and rule['ToPort'] == 23:
            print(f"Security Group {sg.group_id} allows unrestricted Telnet access")

Once you have identified the security group(s) that have unrestricted Telnet access, you can remove the Telnet rule(s) from the security group(s). You can use the following Python code to remove the Telnet rule(s):

import boto3

ec2 = boto3.resource('ec2')

# Get the security group by ID
sg = ec2.SecurityGroup('sg-0123456789abcdef')

# Revoke the Telnet access rule(s)
sg.revoke_ingress(IpProtocol='tcp', FromPort=23, ToPort=23, CidrIp='0.0.0.0/0')

In the above code, replace ‘sg-0123456789abcdef’ with the ID of the security group that you want to remediate.By following the above steps, you can remediate the unrestricted Telnet access misconfiguration in AWS using Python.

Using Terraform

resource "aws_security_group" "example" {
  name        = "EXAMPLE_SG_NAME"          # replace with your SG name
  description = "Security group without unrestricted Telnet"
  vpc_id      = "VPC_ID"                   # replace with your VPC ID

  # Example: allow SSH from a restricted CIDR (adjust as needed)
  ingress {
    description = "SSH from allowed IPv4 range"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["ALLOWED_IPV4_CIDR"]    # e.g., "203.0.113.0/24"
  }

  # Example: allow SSH from a restricted IPv6 range (optional)
  # ingress {
  #   description      = "SSH from allowed IPv6 range"
  #   from_port        = 22
  #   to_port          = 22
  #   protocol         = "tcp"
  #   ipv6_cidr_blocks = ["ALLOWED_IPV6_CIDR"]  # e.g., "2001:db8::/64"
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "EXAMPLE_SG_TAG_NAME"           # replace with your SG tag
  }
}

To remediate: remove any ingress block (or standalone aws_vpc_security_group_ingress_rule resource) that has protocol = "tcp", from_port = 23, to_port = 23 and cidr_blocks = ["0.0.0.0/0"] and/or ipv6_cidr_blocks = ["::/0"]. This is destructive for those rules: they will be permanently removed, matching the CLI revocation.terraform plan should then show the Telnet ingress rule(s) being removed from the security group (a diff removing the port 23 ingress, with no new Telnet rule added).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted Telnet Access Should Not Be Allowed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: