How to restrict the free downloading of call recordings.

[balandine]

Hello everyone.

I have call recording set up in my system. At the moment, the link to the call recording is accessible to anyone. It is even available over the Internet. There is no authentication when downloading the recording file. Anyone with the link can download the audio file. This creates a huge security issue for the system.

Are there any ways to restrict the ability to download call recordings? Or to restrict downloading over the Internet?

Thank you!

 

[Alejandro_3CX]

Hello Balandine, please note that only the Manager, Supervisor, Owner and System Owner roles are the one who may access the recordings in the pbx, also note that you have to give them the permission editing the user extension --- options tab --- show call recording. Extensions with other roles and with the parameter show call recordings will let them see their own recordings using the 3cx apps only.

So I wonder what do you refer with free downloading and that anyone with the link can download the audio file.

Where are you putting these recording files, because in the pbx everyone would need to authenticate and have the proper role to access the recording file.

 

[Evolute IT]

Hello everyone.

I have call recording set up in my system. At the moment, the link to the call recording is accessible to anyone. It is even available over the Internet. There is no authentication when downloading the recording file. Anyone with the link can download the audio file. This creates a huge security issue for the system.

Are there any ways to restrict the ability to download call recordings? Or to restrict downloading over the Internet?

Thank you!

Do you mean the long download URL? If so, that has a token in it that can't be guessed and the link is valid a few seconds.

If you use the one from the CRM integration, that one is valid only 90-days by default.

 

[balandine]

@ConceptsWeb is right. I am talking about long links that I receive in emails, like these: https://fqdn/recording/TOKEN. I receive these links in notifications via email when a call is completed. They are also present in the CRM integration.

The links that are sent to the email seem to be valid for about a week. Because I can still download files from links that were created this current week. But those from last week are no longer working.

As far as I understand, it is not possible to restrict access using 3cx configurations, am i right?

 

[Evolute IT]

@ConceptsWeb is right. I am talking about long links that I receive in emails, like these: https://fqdn/recording/TOKEN. I receive these links in notifications via email when a call is completed. They are also present in the CRM integration.

The links that are sent to the email seem to be valid for about a week. Because I can still download files from links that were created this current week. But those from last week are no longer working.

As far as I understand, it is not possible to restrict access using 3cx configurations, am i right?

No it's not possible. You can simply not use those emails and CRM variables if that is a problem.

 

[balandine]

I can opt out of email notifications, but the link in the CRM is part of the business requirements. I cannot refuse it.

I will then look for other ways to restrict access.

 

[Kevin Attard Compagno]

I wonder if you might get some benefit by offloading recordings to a different storage location and managing access from there? Something like this:



?

You would get this sort of structure:



...which might lend itself?

 

[balandine]

I wonder if you might get some benefit by offloading recordings to a different storage location and managing access from there? Something like this:

View attachment 51019

?

You would get this sort of structure:

View attachment 51020

...which might lend itself?

That's an interesting thought, thank you.
I have an integration set up with CRM, where a link to the recording is sent. I'm afraid this functionality will break if I start sending all recordings to an external storage right away.

 

[balandine]

I have an idea to configure this restriction in nginx.The configuration will look something like this:

location /recording/ {
allow 10.0.0.0/8;
deny all;
}

This way, I can at least restrict access to recordings through private prefixes. But I'm not sure if this scheme will work.To avoid breaking the production system, I've set up a test server.

I'll be testing how this works this week.

 

[bitn2]

I have an idea to configure this restriction in nginx.The configuration will look something like this:

location /recording/ {
allow 10.0.0.0/8;
deny all;
}

This way, I can at least restrict access to recordings through private prefixes. But I'm not sure if this scheme will work.To avoid breaking the production system, I've set up a test server.

I'll be testing how this works this week.

That isnt a good idea.. This will set your pbx unsupported and could be overwritten with each update.

 

[VoIPTools]

This also does not put any restrictions on which employees can listen to a recording. So, if the CEO is in merger talks, and that call is recorded, anyone with access to the CRM, has access to that recording. If the HR department gets a report of a boss harassing an employee, the boss has access to that recording? I can think of many, many scenarios where you need further restrictions to recordings rather than anyone can listen to any phone call.

 

[balandine]

I can think of many, many scenarios where you need further restrictions to recordings rather than anyone can listen to any phone call.

Yes, I also had questions regarding information security.

 

[SteveITS]

A while back, when I programmed a site with file downloads, requests used a “download.php” type file, and that could access the actual file for download. So the actual file wasn’t accessible via web and checks were possible. Existing URLs could be redirected there I’d think. FWIW.

Access to recordings in the web client is by role anyway though so that’s more of an internal issue? Don’t record the HR call?