3CXClient logged in with new Password, but I didn't enter it

[Biber]

Hi,

I created new passwords for all users in our 3CX. I entered the password to the phones, but not to the 3CX Phones.
After restarting the 3CXPhone, it logged in without having the new password!

Why it can log in?

Thanks in advance

Biber

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

Hi Biber,
This is due to reprovisioning of the 3cxphone on restart.

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

Hi,

ok, that's what I already thought, but somebody has stolen an account of us (he knows the credetials), so we are not able to change the credentials to lock him out! If he uses a 3CX Client he can restart the Client and he is online without the new password!


IMHO this provisioning is a very unsecure feature (or I don't understand it at all)

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

In that case you can disable this specific extension so that no more calling is possible through it or delete it completely from the phone system, the provisioning file associated will be also deleted.

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

Hi,

Thanks for the fast response.
Here our problem:
Someone had the credentials to the 3CX Server Manager, so he has access to all extensions with passwords. What can I do to ensure that he can't login with any credentials. We already changed all passwords, but it seems that is not enough.

In normal secure systems it's enough to change the password, I've never heard of system, which issued a new password, if it has changed. Or is it a little bit like ".ssh/authorisized_keys". If it is so, I must only delete the "key" on the server.

Thanks in advance

Biber

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

The management console is protected by an admin account, you can change login and password at any time through your settings.
Also, check which extension have admin permissions through their Options tab and disable those access if necessary.

You must renew also your trunks passwords if they could have been compromised.

Other than that your windows machine might aswell be compromised, so run an AV scan and ensure all windows updates are installed, check also which ports are opened and what apps listening on them, and restrict what is reachable from the outside through firewall/router.

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

Of course I changed the login and password, I have renew all extension passwords, and that's the problem:

I changed the password, and I can still connect after restarting the 3CX WinClient without the new Password.

If the "Hacker" uses the 3CX Client (with my credentials), my extension-renew is useless! I must be sure, that the hacker can't use 3CX without the new credentials.

I already checked the Windows-Server, and it's ok.

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

Then delete extension and recreate it, this will renew the provisioning file associated by renewing its file name, therefore the new credentials will not be available anymore to the other person which will still be running with old provisioning file name.

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

I must configure the whole 3CX-Server once more? You can't be serious!

I only want to change credentials

Is it possible to delete the provisioning file without recreating the whole extension?
Or can I disable 3CX Phone Client provisioning?

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

You can click "Disallow use of 3CXPhone" under this extensions properties / 3CXPhone tab.

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

I tried it, but It doesn't work.
I disabled the use of the 3CXPhone, and after restarting the 3CXPhone, the 3CXPhone shows me a Dialog that the use is disabled, but after clicking [OK] I can use the phone without limits

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

Which version/service pack of 3CX Phone System and of the 3cxphone (see Settings/Advanced/About) are you running please ?

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

I installed 3CX 12.5 on the Server, where I can see the exact version?

The 3CXPhone is running on version 12.5.44178.0

 

[Pierre_3CX]

Re: 3CXClient logged in with new Password, but I didn't ente

Ok just made the test, in fact the disallow use of 3cxphone will prevent access to the web api services (presences, etc..) only, you will need to delete the extension and recreate it so that provisioning file is renamed, no alternative here - just tested this and it works as expected, the 3cxphone gives now on "Registration Failed, Invalid Password" and can't reprovision.

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

Ok,

thanks for your help.

I've tested it to, and it worked. The solution is not perfect but it is a solution, and after doing it, I can be mostly sure, the the other one can't login on any extension.

Thanks

Biber

 

[Biber]

Re: 3CXClient logged in with new Password, but I didn't ente

Ok,

thanks for your help.

I've tested it to, and it worked. The solution is not perfect but it is a solution, and after doing it, I can be mostly sure, the the other one can't login on any extension.

Thanks

Biber