# Ensure No Security Groups Allow Ingress from 0.0.0.0/0 or ::/0 to Telnet Port 23 - Source: https://support.icompaas.com/support/solutions/articles/62000233817-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-telnet-port-23 - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: Level 2 #### Description Telnet, which uses TCP port 23, is an outdated protocol with known vulnerabilities as it transmits data, including credentials, in plaintext. Allowing unrestricted inbound access to port 23 from the internet (0.0.0.0/0 for IPv4 or ::/0 for IPv6) exposes instances to potential attacks, including unauthorized access and data interception. Disabling public access to Telnet ensures secure configurations and reduces security risks. #### Rationale - Enhanced Security: Reduces the attack surface by preventing unauthorized access to Telnet. - Risk Mitigation: Protects against potential exploits and security vulnerabilities of Telnet. - Compliance: Aligns with modern security practices and regulatory requirements. #### Impact Pros: - Reduces the risk of unauthorized access and data breaches. - Enhances overall security posture by closing an insecure protocol. - Aligns with compliance standards and security best practices. Cons: - May disrupt legitimate Telnet-based workflows, requiring secure alternatives like SSH. - Requires configuration changes that may initially inconvenience legacy systems. #### Default Value By default, security groups can allow unrestricted access to port 23 unless explicitly configured to restrict access. #### Pre-Requisite IAM Permissions: - ec2:DescribeSecurityGroups - ec2:RevokeSecurityGroupIngress - AWS CLI installed and configured. #### Remediation Test Plan: Using AWS Console: 1. Sign in to the AWS Management Console. 2. Navigate to the EC2 Dashboard. 3. Go to the Security Groups tab. 4. Identify security groups allowing ingress to port 23 from 0.0.0.0/0 or ::/0. Using AWS CLI: Identify Ingress Rules Allowing Public Access: aws ec2 describe-security-groups --query "SecurityGroups\[\*\].IpPermissions\[?FromPort==\`23\` && (contains(IpRanges\[\].CidrIp, '0.0.0.0/0') || contains(Ipv6Ranges\[\].CidrIpv6, '::/0'))\]" Implementation Steps: Using AWS Console: 1. Sign in to the AWS Management Console. 2. Navigate to the EC2 Dashboard. 3. Go to the Security Groups tab. 4. Identify security groups with rules allowing ingress to port 23. 5. Edit the security groups: - Remove the rule allowing ingress from 0.0.0.0/0 or ::/0. - Restrict access to trusted IP ranges, or remove the rule entirely if Telnet is not required. 6. Save the changes. Using AWS CLI: Revoke Insecure Ingress Rules: aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 23 --cidr 0.0.0.0/0 aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 23 --cidr ::/0 aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 23 --cidr #### Backout Plan If revoking access to port 23 causes issues: Using AWS Console: 1. Re-enable access by adding specific ingress rules as needed. 2. Document and monitor any new rules added. Using AWS CLI: Restore Required Access: aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 23 --cidr #### References - [AWS Security Best Practices for EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) - [Telnet Vulnerabilities and Risks](https://csrc.nist.gov/glossary/term/telnet) - [AWS CLI - Security Group Rules](https://docs.aws.amazon.com/cli/latest/reference/ec2/) #### CIS Controls

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.	●	●	●
v7	9.1	Limit Exposure to External Networks – Use techniques like disabling unnecessary ingress rules.	●	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.