# Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23

- Source: https://support.icompaas.com/support/solutions/articles/62000229539-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-telnet-port-23
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description****:**  
AWS security groups control the traffic that is allowed to flow into and out of your AWS resources. By default, security groups allow all traffic from anywhere. This means that anyone on the internet could connect to your resources using Telnet, which is a protocol that is often used for remote administration.

**Rationale:**  
Allowing ingress from 0.0.0.0/0 or ::/0 to Telnet port 23 is a security risk. This is because it allows anyone on the internet to connect to your resources using Telnet. This could allow attackers to gain unauthorized access to your systems.

**Impact:**  
If ingress from 0.0.0.0/0 or ::/0 to Telnet port 23 is allowed, then anyone on the internet could connect to your resources using Telnet. This could allow attackers to gain unauthorized access to your systems. This could lead to data breaches, financial losses, or even system downtime.

**Default Value:**  
By default, security groups allow all traffic from anywhere. This means that ingress from 0.0.0.0/0 or ::/0 to Telnet port 23 is allowed by default.

**Pre-requisites**:

-   You must have an AWS account and be logged in to the AWS Management Console.

  

**Remediation Steps:**

1.  Sign in to the AWS Management Console.
2.  Go to the AWS EC2 console.
3.  Click **Security Groups** in the left navigation pane.
4.  Select the security group that you want to modify.
5.  On the **Inbound Rules** tab, remove any rules that allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.
6.  Click **Save**.

  

**Test Plan:**

1.  Verify that the security group no longer allows ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.
2.  Try to connect to the resource using Telnet from an external machine.
3.  If you are unable to connect, then the security group has been modified correctly.

**Implementation Plan:**

1.  Create a policy that requires all security groups to deny ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.
2.  Implement the policy by modifying all security groups that allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.
3.  Monitor the status of the policy to ensure that no security groups allow ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.

**AWS CLI Process:**

1.  Run the following command to deny ingress from 0.0.0.0/0 or ::/0 to Telnet port 23:

aws ec2 revoke-security-group-ingress --group-id my-security-group-id --protocol tcp --port 23 --cidr 0.0.0.0/0

**Using AWS GUI:**

1.  Go to the AWS EC2 console.
2.  Click **Security Groups** in the left navigation pane.
3.  Select the security group that you want to modify.
4.  On the **Inbound Rules** tab, click **Add Rule**.
5.  In the **Type** drop-down list, select **Custom TCP Rule**.
6.  In the **Protocol** field, enter **TCP**.
7.  In the **Port Range** field, enter **23**.
8.  In the **Source** field, select **Custom CIDR**.
9.  In the **CIDR** field, enter **0.0.0.0/0**.
10.  Click **Add**.

**Backout Plan:**

1.  If you accidentally deny ingress to a security group that should not be denied, you can allow ingress by following the same steps as above, but selecting **Allow** instead of **Deny** in the **Type** drop-down list.
2.  You can also roll back the policy that requires all security groups to deny ingress from 0.0.0.0/0 or ::/0 to Telnet port 23.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.