Telnet Port Should Not Be Open

More Info:

Determines if TCP port 23 for Telnet is open to the public.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• FedRAMP
• GDPR
• HIPAA
• HITRUST CSF
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of "Telnet Port Should Not Be Open" for GCP using GCP console, please follow the below steps:

1. Login to your GCP console.
2. Navigate to the GCP project which has the instance with the open Telnet port.
3. Click on the hamburger menu on the top left corner of the console and select "Compute Engine" under the "Compute" section.
4. From the list of instances, select the instance with the open Telnet port.
5. Click on the "Edit" button at the top of the page.
6. Scroll down to the "Firewall" section and click on "Management, disks, networking, SSH keys".
7. Under the "Firewall" section, click on "default-allow-internal".
8. Scroll down to the "Protocols and ports" section and uncheck the "tcp:23" option.
9. Click on the "Save" button at the bottom of the page.

By following the above steps, you have successfully remediated the misconfiguration of "Telnet Port Should Not Be Open" for GCP using GCP console.

Using CLI

To remediate the "Telnet Port Should Not Be Open" misconfiguration on GCP using GCP CLI, follow these steps:

1. Open the Cloud Shell in the GCP Console.

2. Run the following command to list all the instances in the project:

gcloud compute instances list

3. Identify the instance that has the telnet port open.

4. Connect to the instance using SSH:

gcloud compute ssh [INSTANCE_NAME] --zone [ZONE]

5. Once connected to the instance, run the following command to check if telnet is installed:

which telnet

6. If telnet is installed, run the following command to uninstall it:

sudo apt-get remove telnet

7. If telnet is not installed, run the following command to check if the telnet port is open:

sudo netstat -tuln | grep 23

8. If the telnet port is open, edit the firewall rules for the instance to close the telnet port:

gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --remove-ports=23 --direction=INGRESS

9. Verify that the telnet port is closed by running the following command:

sudo netstat -tuln | grep 23

10. Exit the SSH session by typing exit.

11. Repeat steps 4-10 for any other instances that have the telnet port open.

By following the above steps, you can remediate the "Telnet Port Should Not Be Open" misconfiguration on GCP using GCP CLI.

Using Python

To remediate the Telnet Port Should Not Be Open misconfiguration in GCP using Python, you can follow these steps:

1. Connect to the GCP project using the Python client library.

from google.cloud import compute_v1

compute_client = compute_v1.InstancesClient()
project = "your-project-id"
zone = "your-zone"
instance_name = "your-instance-name"
instance = compute_client.get(project=project, zone=zone, instance=instance_name)

2. Check if the Telnet port is open by looking at the instance's firewall rules.

firewall_rules = compute_client.list_firewall_policies(project=project, zone=zone)
for rule in firewall_rules:
    if rule.allowed[0].ports == ['23']:
        print(f"Firewall rule {rule.name} allows Telnet traffic.")

3. If there is a firewall rule that allows Telnet traffic, delete it.

for rule in firewall_rules:
    if rule.allowed[0].ports == ['23']:
        operation = compute_client.delete_firewall_policy(project=project, firewall_policy=rule.name)
        operation.result()
        print(f"Firewall rule {rule.name} deleted.")

4. Confirm that the Telnet port is no longer open by checking the instance's firewall rules again.

firewall_rules = compute_client.list_firewall_policies(project=project, zone=zone)
for rule in firewall_rules:
    if rule.allowed[0].ports == ['23']:
        print(f"Firewall rule {rule.name} still allows Telnet traffic.")

By following these steps, you can remediate the Telnet Port Should Not Be Open misconfiguration for a GCP instance using Python.

Using Terraform

resource "google_compute_firewall" "telnet_restricted" {
  name    = "telnet-restricted"
  network = google_compute_network.VPC_NETWORK_RESOURCE_NAME.self_link
  project = "GCP_PROJECT_ID"

  direction = "INGRESS"
  priority  = 1000

  # Restrict Telnet (TCP/23) to known IP addresses only (NO 0.0.0.0/0 here)
  source_ranges = [
    "KNOWN_TRUSTED_CIDR_1", # e.g. "203.0.113.10/32"
    "KNOWN_TRUSTED_CIDR_2",
  ]

  allow {
    protocol = "tcp"
    ports    = ["23"]
  }

  target_tags = ["TELNET_TARGET_TAG"] # replace with instance tag(s) that should accept Telnet
}

Substitute:

• VPC_NETWORK_RESOURCE_NAME with your google_compute_network resource name.
• GCP_PROJECT_ID with your project ID.
• KNOWN_TRUSTED_CIDR_1 / KNOWN_TRUSTED_CIDR_2 with your allowed IP ranges.
• TELNET_TARGET_TAG with the network tag used by instances that must receive Telnet (or remove target_tags if you intentionally apply to all instances on the network).

This change is in-place; it should not force replacement of the firewall rule, only an update to source_ranges.

Verification: terraform plan should show the existing google_compute_firewall rule’s source_ranges changing from ["0.0.0.0/0"] (or similarly broad ranges) to the specified KNOWN_TRUSTED_CIDR_* values, with no -/+ replacement indicator for the resource.

Additional Reading:

• https://cloud.google.com/vpc/docs/using-firewalls