Disable username / password authentication for web interface (not admin)

[Wills]

We have google authentication enabled for all our users, and as such I'd like to disable the unused username and password authentication for our web interface (found at https://server.domain:5001/webclient/#/login) in order to improve our security posture. Is this possible? If so, how can I do it (preferably without using a reverse proxy and mod_rewrite)

 

[Ruben GM]

I have similar request with 365 SSO. Being able to disable user/password will be a security improvement, even if it is to be set at user level, we should be able to disable it for every user with SSO, or to limit user/password to a list of Internal IP range (if the user also has a physical phone).
User and password login doesn't even allow to add MFA.

This needs to improve.

 

[Ruben GM]

AFAIK this is not currently possible. I’d also like to see functionality added to disable the standard authentication to the web client when SSO is enabled - even simply removing the username and password fields from the login page would be a welcomed change. I have set up SSO and the workaround I have implemented is reset all user’s web client passwords and not provide them with the new one. I have also edited the welcome email template to remove the code that would include the password in the email and added text to inform users to click the Google/M365 button to sign in. This way new users are unaware of what the password is and the user can’t obtain the password with the “resend credentials” function.

The passwords 3CX generates are complex enough that they wouldn’t be susceptible to dictionary attacks, brute force, password spraying, or showing up in databases of compromised passwords. With the right security settings for blacklisting an attacker’s IP would be blocked almost immediately and for ~31 years! This is the closest you’re going to get, currently, to effectively disabling standard authentication.

Thanks for sharing,

We have had an intrusion with user and password in our system. We are not sure how it was done, maybe they discovered an email or plain text credentials in a file of an old user, but it happened. Our security is set to block IPs with only 2 bad passwords... so I think it is high, but attacker also use tons of IP addresses nowadays.
I understand that the user and password is used in the QR code to connect from Android or IOS, not even sure about the browser integrated application, so I imagine you don't use those applications.
I think with your settings, physical phones are still receiving the user / password credentials.

 

[SweetAction]

The QR Code doesn't have the user/password - one of the reasons that's a separate box under regenerate creds and why it used to be impossible to kick out an old mobile app without deleting the entire extension.

I actually asked once how they generate the QR code special text but got no answer. https://www.3cx.com/community/threads/v18-desktop-app-mass-deployment-option.83541/#post-395151

 

[SweetAction]

Regenerating the "SIP ID and Authentication Passwords" should kick out mobile apps.

It will not. The app will re-provision itself upon load with new creds.
https://www.3cx.com/community/threads/user-extension-regenerate.78460/post-360486

(the above post is no longer accurate as an option to reset that link (from the QR Code) is now in 3CX)