3CX Anti Hijack

Status
Not open for further replies.

TotallyVoIP

Joined
Jul 2, 2010
Messages
77
Reaction score
0
Is there a log within 3CX of black listed IP's that can be checked, or a phase to search in the main log file?
I have been having some issues with a VOIP trunk and need to be certain that the Anti-Hijack / blacklist rules did not add to the issue, but can't see anywhere that might give me the information.

Ideally within the the control panel there should be the ability to see current and previous blacklisted IP's with some stat's about when they where blacklisted last, how many times they have been blacklisted, which rule cause the blacklist entry, what extension/3CX attribute they were targeting, what rate of packets they were using (per second?) and how many packets/attempts they have made that failed ... basically some useful diagnositc info to help then choose from a drop down list to specify them as "Safe"(white list them), "Unsafe" (Permanently blacklist them), "Use Caution" to apply normal Anti-hijack settings.

An email alert to a predefined address to warn of a black list entry/hack attempt would be pretty useful, in light of the financial damage they can do.

The ability to change these settings, ie what you thought was a "attach" was in fact a new server/IP from a little used provider, so you want to change them from "Unsafe" to "Safe" or vice versa.

From the ongoing reports of hacking I think anything that can stregthen the 3CX environment

I guess this has turned into a feature request, but the initial question still stands, is there anywhere I can look for past blacklist entries within my install?

thanks
 
Hi,

You can find this log in the 3CXPhonesystem.log and/or the 3CXPhonesystem.trace.log files.
Almost all the information you are asking for is specified in those logs.
 
OK, found the log files, this poses a few other questions
1. how long do the log files run for before rolling off? (is it time, size, no of lines, never?)
2. Does 3CX restart/PC reboot cleat the logs?
3. What am I looking for for a "hijack" or black list event? Is there a key word?

No withstanding the fact that the entries might be in the log somewhere, I still think bringing a summary and window dedicated to this now VERY important and possibly very expensive area issue should be SERIOUSLY considered, managing these events and having manual control over the permanent black list/white list is going to be key to a safe install.

thanks
 
Status
Not open for further replies.

Forum statistics

Threads
111,875
Messages
589,515
Members
164,724
Latest member
StratisFear