How to Reset Passwords and Secure Admin Console

[Pierre_3CX]

We’ve put together a detailed guide on how to reset passwords and secure your admin console, covering all major steps you can take. We’ve included changing your root credentials and what to do if you’ve forgotten them. We also take you through the all important steps of setting a system owner up. Perhaps you want to reset user credentials via...

Continue reading the Original Blog Post.

 

[simsyn]

@pj3cx Thanks for sharing this important piece of information. Any plan for supporting MFA via SMS or Email for customers who don't need SSO but looking for an additional layer of security to MC or WebClient? We do have many customers who are asking for this feature but unfortunately, they don't have MS or Google SSO.

 

[Michael Henkes]

When will you stop storing passwords in cleartext in your database? (CVE-2021-45491)

 

[accentlogic]

When will you stop storing passwords in cleartext in your database? (CVE-2021-45491)

As per @Nick Galea password hashing will be addressed in Update 7a.
https://www.3cx.com/community/threads/security-incident-update-april-4-2023.120075/

 

[AWS2P]

Could it be also possible to add a "life time limitation" for example 15 min, for password received in clear text in welcome email ?

 

[daveatgower]

Action 3 - Limit Access to Management Console and Web Client Admin View by IP
https://www.3cx.com/docs/pbx-security-credentials/

This option does not exist on 3CX Hosted. Why?

 

[mOrbo]

Hello 3CX,

This feature is nice, but why do you automatically add all private IPv4 and IPv6 IP-Ranges as trusted? I never understood this.

For security reasons we Admins need to add only privileged access workstations to the access list of the admin console. In your config, the admin console is reachable from all internal clients. This is a potential security risk. Please make it possible to manage ALL IP-Addresses in this whitelist, including all private address blocks (see this for more infos of a PAW-concept):
https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices

Even better would be a possibility to bind the admin console Webserver to a second Networkadapter in a separate VLAN or at least to another port which is blocked by our perimeter firewall for all users. But this would be a lot more work for you than simply making the private IP-Blocks deletable.

Thanks!