Check for Unrestricted Telnet Access

More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP port 23.

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• FedRAMP
• GDPR
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate “Unrestricted Telnet Access” misconfiguration in Azure using Azure console:

1. Open the Azure portal and log in to your account.
2. Navigate to the “Security Center” from the left-hand side menu.
3. Click on the “Security Center” blade and then click on “Security Alerts” from the left-hand side menu.
4. Search for the alert related to “Unrestricted Telnet Access”.
5. Click on the alert to get more details about the misconfiguration.
6. Click on “Remediate” button to start the remediation process.
7. In the remediation window, select the “Apply to subscription” option.
8. Click on “Remediate” again to start the remediation process.

Once the remediation process is completed, the “Unrestricted Telnet Access” misconfiguration will be remediated in Azure.

Note: You can also use Azure PowerShell or Azure CLI to remediate this misconfiguration.

Using CLI

To remediate the misconfiguration of unrestricted Telnet access in Azure using Azure CLI, follow these steps:

1. Open Azure CLI and login to your Azure account using the following command:

   az login
   

2. Once you are logged in, set the correct subscription using the following command:

   az account set --subscription <subscription_id>
   

3. Next, find the network security group (NSG) that is associated with the virtual machine (VM) that has unrestricted Telnet access. You can do this by running the following command:

   az network nsg list --query "[?contains(defaultSecurityRules[].destinationPortRange, '23')].{Name:name, ResourceGroup:resourceGroup}"
   

   This command will list all the NSGs that have a default security rule allowing traffic on port 23 (Telnet).

4. Once you have identified the NSG, you can update the default security rule to deny Telnet traffic using the following command:

   az network nsg rule update --name "AllowTelnet" --nsg-name <nsg_name> --resource-group <resource_group_name> --access Deny --protocol Tcp --direction Inbound --priority 1000 --destination-port-range 23
   

   This command will update the default security rule in the NSG to deny Telnet traffic on port 23.

5. Finally, verify that the default security rule has been updated by running the following command:

   az network nsg show --name <nsg_name> --resource-group <resource_group_name>
   

   This command will show the details of the NSG, including the updated default security rule.

By following these steps, you can remediate the misconfiguration of unrestricted Telnet access in Azure using Azure CLI.

Using Python

To remediate Unrestricted Telnet Access in Azure using Python, you can follow these steps:

1. Install the Azure SDK for Python using the following command:

pip install azure

2. Use the following Python script to remediate the issue:

from azure.mgmt.network import NetworkManagementClient
from azure.common.credentials import ServicePrincipalCredentials

# Fill in your Azure credentials
subscription_id = 'your-subscription-id'
client_id = 'your-client-id'
secret = 'your-client-secret'
tenant = 'your-tenant-id'

# Fill in the name of the resource group and the network security group
resource_group_name = 'your-resource-group-name'
network_security_group_name = 'your-network-security-group-name'

# Create the credentials object
credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=secret,
    tenant=tenant
)

# Create the network management client object
network_client = NetworkManagementClient(credentials, subscription_id)

# Get the network security group
network_security_group = network_client.network_security_groups.get(
    resource_group_name,
    network_security_group_name
)

# Remove the inbound rule for telnet
telnet_rule = next((r for r in network_security_group.security_rules if r.name == 'AllowTelnet'), None)
if telnet_rule:
    network_security_group.security_rules.remove(telnet_rule)

# Update the network security group
network_client.network_security_groups.create_or_update(
    resource_group_name,
    network_security_group_name,
    network_security_group
)

print('Telnet rule removed successfully.')

3. Replace the placeholders in the script with your Azure credentials, resource group name, and network security group name.

4. Run the script using the following command:

python remediate_telnet.py

This will remove the inbound rule for telnet in the specified network security group, thus remediating the Unrestricted Telnet Access issue.

Using Terraform

resource "azurerm_network_security_group" "TELNET_SEC_GROUP" {
  name                = "TELNET_SEC_GROUP"
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name

  # other existing security_rules can stay here (or use standalone azurerm_network_security_rule resources)
}

# Replace any existing rule that allows TCP/23 from 0.0.0.0/0 with a deny,
# or scope it to the minimum required source instead of "*".
resource "azurerm_network_security_rule" "deny_telnet_from_internet" {
  name                        = "deny-telnet-from-internet"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "23"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.TELNET_SEC_GROUP.name
}

If you currently have an azurerm_network_security_rule that allows Tcp on port 23 from * or 0.0.0.0/0, remove or update that rule so it no longer permits unrestricted inbound Telnet.

This change does not force replacement of the NSG, but it will immediately block new inbound Telnet connections once applied.

Verification: terraform plan should show the existing allow rule on port 23 being removed or changed, and/or this new deny_telnet_from_internet rule being added.