Check ID: ec2_instance_port_kerberos_exposed_to_internet
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2Instance
What this check verifies
EC2 instances whose security groups allow public inbound TCP access to Kerberos ports 88, 464, 749, or 750 (authentication, password change, admin).
Rules permitting 0.0.0.0/0 or ::/0 are treated as Internet-exposed.
Risk
Public Kerberos exposure risks CIA:
- Password spraying/AS-REP roasting against accounts
- Unauthorized password changes on
464
- Realm/user enumeration and DoS of KDC/services
Stolen tickets enable lateral movement and privilege escalation in Active Directory or the Kerberos realm.
Recommendation
Restrict Kerberos ports to trusted sources only.
- Prefer private connectivity (VPN, peering) over public exposure
- Place KDCs/services in private subnets without public IPs
- Apply least privilege with narrowly scoped security group rules and NACLs
- Add defense-in-depth: host firewalls and monitor authentication activity
CLI
Terraform
Native IaC
Dashboard steps
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":88,"ToPort":88,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":464,"ToPort":464,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":749,"ToPort":749,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":750,"ToPort":750,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'
# Terraform: restrict Kerberos ports from Internet
resource "aws_security_group" "<example_resource_name>" {
name = "<example_resource_name>"
vpc_id = "<example_resource_id>"
ingress {
from_port = 88
to_port = 88
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"] # CRITICAL: not 0.0.0.0/0; restrict to trusted CIDR
}
ingress {
from_port = 464
to_port = 464
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"] # CRITICAL: blocks Internet exposure
}
ingress {
from_port = 749
to_port = 749
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"] # CRITICAL: blocks Internet exposure
}
ingress {
from_port = 750
to_port = 750
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"] # CRITICAL: blocks Internet exposure
}
}
# CloudFormation: restrict Kerberos ports from Internet
Resources:
<example_resource_name>:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Restrict Kerberos ports
VpcId: <example_resource_id>
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 88
ToPort: 88
CidrIp: 10.0.0.0/8 # CRITICAL: not 0.0.0.0/0; restrict access to trusted CIDR
- IpProtocol: tcp
FromPort: 464
ToPort: 464
CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure
- IpProtocol: tcp
FromPort: 749
ToPort: 749
CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure
- IpProtocol: tcp
FromPort: 750
ToPort: 750
CidrIp: 10.0.0.0/8 # CRITICAL: blocks Internet exposure
- In the AWS console, go to EC2 > Security Groups
- Select the security group attached to the affected instance
- Edit inbound rules
- Remove any rule allowing TCP ports 88, 464, 749, or 750 from 0.0.0.0/0 or ::/0
- If access is required, re-add these ports only from trusted CIDR(s) (e.g., your internal network)
- Save rules
References
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_port_kerberos_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks
