What runs on port 23
TCP port 23 is Telnet (RFC 854), a remote terminal protocol from the early days of the internet. A Telnet server gives you a login prompt and a shell, much like SSH, but nothing is encrypted: the username, the password and every command you type travel in clear text. It also has no way to prove the server's identity, so a machine in the middle can pose as the server.
SSH on port 22 replaced Telnet for remote administration decades ago.
Where you still find it
- Routers, switches and network gear, especially older or cheap models with a Telnet management interface enabled by default.
- IoT devices: cameras, DVRs and embedded boards. The Mirai botnet spread largely by logging in to such devices over Telnet with factory default passwords.
- Legacy systems in industrial or banking environments that predate SSH.
- Serial console servers that expose each port over Telnet.
If a scan shows port 23 open on a server you run, someone either installed a Telnet daemon on purpose or a device on your network forwards it.
Should it be open to the internet?
No. There is no safe way to expose Telnet publicly. Disable the service, and if a device cannot do without it, keep it on an isolated management network or behind a VPN.
# Debian/Ubuntu: remove the server package if installed
sudo apt remove telnetd inetutils-telnetd
# Block the port in the firewall in any case
sudo ufw deny 23/tcp
# iptables
iptables -A INPUT -p tcp --dport 23 -j DROP
On a router or IoT device, look for "Telnet" in the management settings and switch it off, enable SSH if offered, and change the default password. If the setting is missing, check for a firmware update, and make sure port 23 is not forwarded on your internet router.
See what is listening
sudo ss -tlnp 'sport = :23'
sudo lsof -i :23
Telnet servers are often started by inetd or xinetd rather than as their own service, so the process name you see may be the super-server. Look in /etc/inetd.conf or /etc/xinetd.d/ for a telnet entry.
The telnet client is still useful
The telnet command (the client) is harmless and handy for testing whether a TCP port answers and for speaking simple text protocols by hand:
telnet mail.example.com 25
If you see a banner such as 220 mail.example.com ESMTP, the port is open. Many systems no longer install the client by default; nc -zv mail.example.com 25 does the same reachability test, and openssl s_client -connect example.com:443 does it for TLS ports.
Security notes
- Assume any password used over Telnet is exposed, and change it if it was used anywhere else.
- Port 2323 is a common alternative Telnet port on IoT devices and is scanned just as heavily; check it too with
nc -zv host 2323. - Clear-text cousins: FTP on 21, POP3 on 110 and IMAP on 143 without STARTTLS have the same problem with passwords.
Related ports
- Port 22 (SSH): the encrypted replacement.
- Port 21 (FTP): clear-text file transfer from the same era.
- Port 3389 (RDP): remote desktop, another login service that should not face the internet.
To make sure Telnet is not reachable on your server from outside, run the Port Scanner against it.