VPC security group rules should not permit ingress from ‘0.0.0.0/0’ to TCP port 23 (Telnet)¶
Description¶
Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. AWS recommends that no security group allows unrestricted ingress access to port 23. Removing unfettered connectivity to remote console services reduces a server’s exposure to risk.
Remediation Steps¶
AWS Console¶
Navigate to VPC.
In the left navigation pane, click Security Groups.
Remove any rules that include port 23 and have a source of 0.0.0.0/0.
Click Save.
AWS CLI¶
List all security groups with an ingress rule of 0.0.0.0/0:
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values='0.0.0.0/0' --query "SecurityGroups[*].{Name:GroupName,ID:GroupId}"
Remove the inbound rule(s) that permits unrestricted ingress to port 23:
aws ec2 revoke-security-group-ingress --region <region> --group-name <group_name> --protocol <protocol> --port 23 --cidr 0.0.0.0/0
Optionally add a more restrictive ingress rule to the selected Security Group:
aws ec2 authorize-security-group-ingress --region <region> --group-name <group_name> --protocol <protocol> --port 23 --cidr <cidr_block>
Terraform¶
Ensure that an aws_security_group
ingress
block does NOT contain both of the following:A
0.0.0.0/0
in thecidr_blocks
field23
is within the port range defined fromfrom_port
toto_port
, ORfrom_port
andto_port
are both set to0
Example Configuration¶
resource "aws_security_group" "example" {
ingress {
cidr_blocks = [10.0.0.0/16]
from_port = 23
to_port = 23
# other required fields here
}
}