Solved All Config Lost

[cgober]

Hey everyone, I recently began playing around with 3cx deployment after having been using the system at my employers place for the past year or so... and we like it.
Yesterday my test system lost all of its config from the previous week, it looked like it had been setup brand new.. all trunks, sbc's, phones and extensions had been lost.

After having provisioned 10 or so phones, I left the office for the night. When my coworker came in the next morning, he called and asked me what the password had been changed to. I hadn't changed the password. After troubleshooting for a bit, I created a backup via ssh and checked the password in the config file, which was the same password we had on file.

I then realized there was a password reset link on the front page, so we were eventually able to get back in. After logging back in though, all config had seemingly been lost.
Im less worried about the setup and more worried about teh possibility that someone is hacking in....
Looking in the activity log I see something about 'sipvicious' which is a tool for pbx penetration testing it turns out...
Could a bad actor get in using sipvicious? What else could have happened?

Thanks for any help!

 

[JohnS_3CX]

Hi,

There might be a couple of things going on here. Some examples:

1) You installed a 2nd PBX or used "Hosted by 3CX". The 2nd system will take over your FQDN so when you visit for example https://mypbx.3cx.com:5001/ you are actually redirected to a brand new PBX and are not seeing the original machine

2) 3CX Supports a Restore Schedule, and if enabled may have restored your existing PBX to a previous state, before your extensions/settings were fully set up.

 

[cgober]

Hi,

There might be a couple of things going on here. Some examples:

1) You installed a 2nd PBX or used "Hosted by 3CX". The 2nd system will take over your FQDN so when you visit for example https://mypbx.3cx.com:5001/ you are actually redirected to a brand new PBX and are not seeing the original machine

I think you may be on to something. We had originally hosted the instance with 3CX, then switched to lightsail. Is there no way for me to see what happened in the log files themselves?
And How would I find out of the FQDN is directing me to the 'old' instance?

Thank you so much for your help

 

[StefanW]

In case you have 2 instances running, you may contact our ops team to terminate the one we run for you.