Cardinal Sin of an ITAdmin - Locked out of WebUI on AWS

[IanJSaul]

Aloha,

This one seems a bit odd, and I've dug through the forums and associated info - hopefully someone can lend some advice.

Typically we host on DigitalOcean, but they were having an odd issue with Twilio, and forced us to set up one client on AWS. This was ~6 months ago, no issues since.

I've logged into the system countless times before, but we do run a VERY tight security setup, especially after the recent security incident @ 3CX.

Around the time of last login, I may have locked things down a bit too much, meaning to a singular dynamic IP from home, and not a range for our office (my only guess as to what caused this issue).

Now when hitting the WebUI, I immediately get:


What I've tried:

• Logging in with the right password (it has not changed since last login - I'm the only one with it) - no go. (I've now confirmed the pass is correct, via the backup XML check)
• Using a VPN and whitelisting that IP in our AWS firewall - no go.
• Multiple logins with various wrong passwords, hoping to get the "reset your password" option - no go.
• SSH Tunneling into the system, forwarding local port 55,000 to 5,001, hitting it via HTTPS - go=no.
• Downloading a backup from the server via SSH - so I have a great recent restore point - worked.

I haven't found any wealth of information on how to disable the 3CX internal firewall, or update/edit the config files for where the whitelisted IPs may be. This is normally how I'd resolve this, cut the system off from internet access anywhere other than our management IP, drop the internal firewall, fix the issue, bring internal fw up, drop external firewall.

System is Linux Debian.

I'm tempted to update the IP list within the XML file, and restore that backup file from CLI.

I wish there was a straightforward way to simply edit the whitelist IPs outside of the WebUI.

Any other ideas, outside of a ticket with 3CX?

Cheers, -Ian

 

[Evolute IT]

Try connecting via SSH and create an SSH tunnel for the HTTP port (80 or 5000) so that you can access the local IP for the UI. IPs in the RFC range for private networks is whitelisted by default, and using the tunnel should make it so that your machine accesses it locally. Kinda like a VPN.

 

[IanJSaul]

Thanks for your reply, and for offering a solution.

I tried that above:

• SSH Tunneling into the system, forwarding local port 55,000 to 5,001, hitting it via HTTPS - go=no.

I was surprised it didn't work, but came up with the same error message as logging in on the ext IP.

 

[JohnS_3CX]

Hi @IanJSaul

There is no straightforward way to do this, and arguably there shouldn't be since it defeats the purpose.

But since you do have SSH access, I would recommend to open a ticket with 3CX Support to get help removing the console restrictions.

 

[SweetAction]

Editing the XML and re-uploading won't work as the checksum won't match...

SSH tunneling is the way to go here and it's not possible to block RFC1918 range, so there must be something wrong with your tunneling setup.

 

[IanJSaul]

After re-testing SSH Tunneling with Putty (as opposed to MobaXTerm) - I've managed to get in - thanks for encouraging me to try it again.

Not sure how the first tunnel was wrong, as it brought up the WebUI prompt correctly, via my loopback.

I've now corrected the IP blocks, and have restored normal access.

Thanks, everyone!

If others find this in the future, here is a link to the original post containing more info about this:
https://www.3cx.com/community/threads/whitelist-locks-me-out-of-management-webfront.82688/

 

[SweetAction]

After re-testing SSH Tunneling with Putty (as opposed to MobaXTerm) - I've managed to get in - thanks for encouraging me to try it again.

Not sure how the first tunnel was wrong, as it brought up the WebUI prompt correctly, via my loopback.

I've now corrected the IP blocks, and have restored normal access.

Thanks, everyone!

If others find this in the future, here is a link to the original post containing more info about this:
https://www.3cx.com/community/threads/whitelist-locks-me-out-of-management-webfront.82688/

Hey, that's my post

Glad it helped you