> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Telnet Port Should Not Be Open

### More Info:

Determines if TCP port 23 for Telnet is open to the public.

### Risk Level

Medium

### Address

Security

### Compliance Standards

SOC2, GDPR, ISO27001, HIPAA, HITRUST, NISTCSF, PCIDSS, FedRAMP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "Telnet Port Should Not Be Open" for GCP using GCP console, please follow the below steps:

        1. Login to your GCP console.
        2. Navigate to the GCP project which has the instance with the open Telnet port.
        3. Click on the hamburger menu on the top left corner of the console and select "Compute Engine" under the "Compute" section.
        4. From the list of instances, select the instance with the open Telnet port.
        5. Click on the "Edit" button at the top of the page.
        6. Scroll down to the "Firewall" section and click on "Management, disks, networking, SSH keys".
        7. Under the "Firewall" section, click on "default-allow-internal".
        8. Scroll down to the "Protocols and ports" section and uncheck the "tcp:23" option.
        9. Click on the "Save" button at the bottom of the page.

        By following the above steps, you have successfully remediated the misconfiguration of "Telnet Port Should Not Be Open" for GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Telnet Port Should Not Be Open" misconfiguration on GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell in the GCP Console.

        2. Run the following command to list all the instances in the project:

        ```bash theme={null}
        gcloud compute instances list
        ```

        3. Identify the instance that has the telnet port open.

        4. Connect to the instance using SSH:

        ```bash theme={null}
        gcloud compute ssh [INSTANCE_NAME] --zone [ZONE]
        ```

        5. Once connected to the instance, run the following command to check if telnet is installed:

        ```bash theme={null}
        which telnet
        ```

        6. If telnet is installed, run the following command to uninstall it:

        ```bash theme={null}
        sudo apt-get remove telnet
        ```

        7. If telnet is not installed, run the following command to check if the telnet port is open:

        ```bash theme={null}
        sudo netstat -tuln | grep 23
        ```

        8. If the telnet port is open, edit the firewall rules for the instance to close the telnet port:

        ```bash theme={null}
        gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --remove-ports=23 --direction=INGRESS
        ```

        9. Verify that the telnet port is closed by running the following command:

        ```bash theme={null}
        sudo netstat -tuln | grep 23
        ```

        10. Exit the SSH session by typing `exit`.

        11. Repeat steps 4-10 for any other instances that have the telnet port open.

        By following the above steps, you can remediate the "Telnet Port Should Not Be Open" misconfiguration on GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Telnet Port Should Not Be Open misconfiguration in GCP using Python, you can follow these steps:

        1. Connect to the GCP project using the Python client library.

        ```python theme={null}
        from google.cloud import compute_v1

        compute_client = compute_v1.InstancesClient()
        project = "your-project-id"
        zone = "your-zone"
        instance_name = "your-instance-name"
        instance = compute_client.get(project=project, zone=zone, instance=instance_name)
        ```

        2. Check if the Telnet port is open by looking at the instance's firewall rules.

        ```python theme={null}
        firewall_rules = compute_client.list_firewall_policies(project=project, zone=zone)
        for rule in firewall_rules:
            if rule.allowed[0].ports == ['23']:
                print(f"Firewall rule {rule.name} allows Telnet traffic.")
        ```

        3. If there is a firewall rule that allows Telnet traffic, delete it.

        ```python theme={null}
        for rule in firewall_rules:
            if rule.allowed[0].ports == ['23']:
                operation = compute_client.delete_firewall_policy(project=project, firewall_policy=rule.name)
                operation.result()
                print(f"Firewall rule {rule.name} deleted.")
        ```

        4. Confirm that the Telnet port is no longer open by checking the instance's firewall rules again.

        ```python theme={null}
        firewall_rules = compute_client.list_firewall_policies(project=project, zone=zone)
        for rule in firewall_rules:
            if rule.allowed[0].ports == ['23']:
                print(f"Firewall rule {rule.name} still allows Telnet traffic.")
        ```

        By following these steps, you can remediate the Telnet Port Should Not Be Open misconfiguration for a GCP instance using Python.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/vpc/docs/using-firewalls](https://cloud.google.com/vpc/docs/using-firewalls)