Back to Checks
aws

EC2 instance does not allow ingress from the Internet to TCP ports 88, 464, 749, or 750 (Kerberos)

ec2_instance_port_kerberos_exposed_to_internet
Service: ec2Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Instance

EC2 instances whose security groups allow public inbound TCP access to Kerberos ports 88, 464, 749, or 750 (authentication, password change, admin).

Rules permitting 0.0.0.0/0 or ::/0 are treated as Internet-exposed.

Prowler logoProwlerprowler-provider-aws

Risk

Public Kerberos exposure risks CIA:

  • Password spraying/AS-REP roasting against accounts
  • Unauthorized password changes on 464
  • Realm/user enumeration and DoS of KDC/services

Stolen tickets enable lateral movement and privilege escalation in Active Directory or the Kerberos realm.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_instance_port_kerberos_exposed_to_internet

Recommendation

Restrict Kerberos ports to trusted sources only.

  • Prefer private connectivity (VPN, peering) over public exposure
  • Place KDCs/services in private subnets without public IPs
  • Apply least privilege with narrowly scoped security group rules and NACLs
  • Add defense-in-depth: host firewalls and monitor authentication activity

Remediation

CLI

aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --ip-permissions '[{"IpProtocol":"tcp","FromPort":88,"ToPort":88,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":464,"ToPort":464,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":749,"ToPort":749,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]},{"IpProtocol":"tcp","FromPort":750,"ToPort":750,"IpRanges":[{"CidrIp":"0.0.0.0/0"}],"Ipv6Ranges":[{"CidrIpv6":"::/0"}]}]'

Terraform

# Terraform: restrict Kerberos ports from Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 88
    to_port     = 88
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: not 0.0.0.0/0; restrict to trusted CIDR
  }

  ingress {
    from_port   = 464
    to_port     = 464
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: blocks Internet exposure
  }

  ingress {
    from_port   = 749
    to_port     = 749
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: blocks Internet exposure
  }

  ingress {
    from_port   = 750
    to_port     = 750
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # CRITICAL: blocks Internet exposure
  }
}

NativeIaC

# CloudFormation: restrict Kerberos ports from Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict Kerberos ports
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 88
          ToPort: 88
          CidrIp: 10.0.0.0/8  # CRITICAL: not 0.0.0.0/0; restrict access to trusted CIDR
        - IpProtocol: tcp
          FromPort: 464
          ToPort: 464
          CidrIp: 10.0.0.0/8  # CRITICAL: blocks Internet exposure
        - IpProtocol: tcp
          FromPort: 749
          ToPort: 749
          CidrIp: 10.0.0.0/8  # CRITICAL: blocks Internet exposure
        - IpProtocol: tcp
          FromPort: 750
          ToPort: 750
          CidrIp: 10.0.0.0/8  # CRITICAL: blocks Internet exposure

Other

1In the AWS console, go to EC2 > Security Groups
2Select the security group attached to the affected instance
3Edit inbound rules
4Remove any rule allowing TCP ports 88, 464, 749, or 750 from 0.0.0.0/0 or ::/0
5If access is required, re-add these ports only from trusted CIDR(s) (e.g., your internal network)
6Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.instance import get_instance_public_status
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class ec2_instance_port_kerberos_exposed_to_internet(Check):
    # EC2 Instances with Kerberos ports open to the Internet will be flagged as FAIL with a severity of medium if the instance has no public IP, high if the instance has a public IP but is in a private subnet, and critical if the instance has a public IP and is in a public subnet.
    def execute(self):
        findings = []
        check_ports = [88, 464, 749, 750]
        for instance in ec2_client.instances:
            report = Check_Report_AWS(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"Instance {instance.id} does not have Kerberos ports open to the Internet."
            is_open_port = False
            if instance.security_groups:
                for sg in ec2_client.security_groups.values():
                    if sg.id in instance.security_groups:
                        for ingress_rule in sg.ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", check_ports, any_address=True
                            ):
                                # The port is open, now check if the instance is in a public subnet with a public IP
                                report.status = "FAIL"
                                (
                                    report.status_extended,
                                    report.check_metadata.Severity,
                                ) = get_instance_public_status(
                                    vpc_client.vpc_subnets, instance, "Kerberos"
                                )
                                is_open_port = True
                                break
                        if is_open_port:
                            break
            findings.append(report)
        return findings

References