A Ton of "Authentication failed for AuthFail Recv Req REGISTER" Messages in Activity Logs

[TaylorStevens23]

Our activity log is showing the following message over and over again every few minutes and I would like some suggestions on how to better protect our system.

"Authentication failed for AuthFail Recv Req REGISTER from {random IP}"

always attempting to login as a random extension and fails to login with the following reason.

"Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings"

The IP address that the requests are coming from repeat a few times then a new IP address attempts to access and the same message appears in the activity log. Then the IP address and extension attempting to authenticate changes but the message stays the same. I am assuming this is someone trying to authenticate to our system maliciously because the IPs are often outside of the US in countries we do not operate in or with.

I would really appreciate any suggestions on what issue I may be having here and what I can do to resolve it.

• 3CX Version, Professional Annual 16.0.9
• Server OS, Debian 10
• Is the 3CX Server Hosted and where? On Prem
• Provisioning Method: Local
• Trunk Provider or Gateway Make/Mode: 123net
• Are custom Phone Templates being used: YES

Thanks!

 

[cobaltit]

The internet is a scary place. As long as you are using 3CX defaults for extension authentication information and have enabled the 3CX global black list you can ignore.

https://www.3cx.com/docs/voip-secur...ional built,more resilient to network attacks.

 

[TaylorStevens23]

The internet is a scary place. As long as you are using 3CX defaults for extension authentication information and have enabled the 3CX global black list you can ignore.

https://www.3cx.com/docs/voip-security/#:~:text=3CX also provides additional built,more resilient to network attacks.

Thank you for the feedback and the link to the article.

We actually do not have the 3CX Global Blacklist enabled but after reading about it this week it is something I am planning to enable. Are there any concerns I should have about turning this on? Has anyone had any unexpected issues with the global blacklist?

 

[YiannisH_3CX]

The only issues we had with the global blacklist is that some provider IPs were blacklisted incorrectly but those were resolved in less than 24 hours. Its definitely a very powerful tool and it helps protect your system from known malicious IPs.

 

[TaylorStevens23]

The only issues we had with the global blacklist is that some provider IPs were blacklisted incorrectly but those were resolved in less than 24 hours. Its definitely a very powerful tool and it helps protect your system from known malicious IPs.

Okay good to know.

When you say they were resolved in less than 24 hours, did they resolve on their own or did you have to do something on your end for the incorrectly blacklisted IPs?

 

[YiannisH_3CX]

It was reported to us and we removed them from our end

 

[cobaltit]

Also, if you whitelist any IPs you care about (such as your provider) then that will override the blacklist so if an 'oops' happens on the blacklist you won't be affected.