External phonebook.xml security

[Kris G.]

Presently there is no security on the publically accessible phonebook.xml that is published from within 3CX, so anyone with the URL can pull the full extension list of any instance; I'm looking for a way to IP-restrict this with the inbuilt Nginx server; has anyone done this?

 

[SweetAction]

3CX has taken an approach of security via obscurity. You need to know the random provision string to access this file (as well as the provisioning files that contain sip credentials and more).

You could IP restrict it with nginx, but it might be easier to just IP restrict the entire http(s) port instead and that would leave your install in a supported state.

 

[Kris G.]

Good call - thank you for confirming.