Change password policy

[Guetzli]

After updating to the latest PBX version, we can't change any options on many (older) extensions. The reason is that any credentials are not meeting the complexity standards.
Is there any way to lower the credential policies systemwide?

Yes, i know i can simply change the credentials and reprovision my IP phone, but on my test phone this didn't work without manual changes on the IP phone directly.
And i'm pretty scared about all the mobile clients in the wilds....

 

[Alphabetic]

From the MGMT console you can go settings > Options and enable "hide change passwords for 3CX apps" then refresh your user credentials.

 

[sales@rodin]

This is a massive problem for us. Can you not force these changes on us or at least communicate them in advance. We are responsible for the security of the phone systems we manage, and you should not force these changes on us overnight.

What's worse is we have thousands of Akuvox handsets that don't support complex Auth ID's and we now have multiple customers looking for alternate phone systems (i.e. not 3CX) because it's cheaper to replace the phone system than it is to replace every handset the own.

This needs a response from 3CX and at least give us the ability in the next update to control this requirement until the manufacturers can get their handsets sorted.

 

[tecnico]

Same problem here. Siemens cordless unusable if we force complex passwords. Please remove this restriction NOW.

 

[oskarom]

Hi,

This is incredible, enforcing this kind of policy with out thinking about the consciences raises many serious flags in my books.

I ran into this as we need to change the Caller ID for all users at one of our hotels, if I'm understanding this correctly in my case we would need to reconfigure all hotel room phones to achieve this, is that really so?

3CX Please advice on this matter.

 

[eastcom]

Hi
Same problem here, we cannot make any changes to users without changing both the User ID & password to the new complexity level.
This means logging into each device one by one, as they're not provisioned by 3CX... a nightmare!
There should be an option to reduce the password complexity & leave the risk with the installer/user.

Where is the response from 3CX on this issue?

 

[eastcom]

From the MGMT console you can go settings > Options and enable "hide change passwords for 3CX apps" then refresh your user credentials.

Hi,
From what I can tell, this doesn't change anything to do with the password complexity level.
Where can the password complexity level be modified?

 

[SnakeRiverWebDevelopment]

Where can the password complexity level be modified?

It can't be changed, it is part of the system that is not editable

 

[eastcom]

It can't be changed, it is part of the system that is not editable

I think this needs to be changed to support existing systems & customers, otherwise, people will be looking for alternatives in droves

 

[SnakeRiverWebDevelopment]

I think this needs to be changed to support existing systems & customers, otherwise, people will be looking for alternatives in droves

While I sympathize with you, I think it is for the best. In todays world hackers will try to get in to anything they can. Complex passwords will help prevent this from happening, I commend the team at 3CX for making this change to help protect your PBX.

 

[Alphabetic]

I believe update 7 will allow for older phones that dont support newer ciphers to be added as "generic IP phone" which will allow for this.

 

[SweetAction]

I believe update 7 will allow for older phones that dont support newer ciphers to be added as "generic IP phone" which will allow for this.

Do you have a source for the new "generic phone" allowing non-complex passwords?

 

[Alphabetic]

Do you have a source for the new "generic phone" allowing non-complex passwords?

It was shown in the latest QA webinar.

 

[SweetAction]

Just to close the loop here, complex passwords are still needed per 3CX
https://www.3cx.com/community/threa...nd-complexity-requirements.119874/post-558527