Hi, I'm trying to install 3CX for the first time on my ESXi 6.7 server. After downloading the Debian ISO and following this guide (https://www.3cx.com/docs/manual/installing-debian-linux-pbx/) I'm stuck between step 16 and 17. The server finishes the installation of Debian and reboots. Step 17 says I should get a welcome to 3CX page after the system reboots, but instead I'm greeted with a standard Debian console login page asking me for my username, almost like the Debian installation skipped the part of installing 3CX. After redownloading the Debian ISO and trying this process a second time I had the same results. I had to think outside the box and started checking my network logs. I checked my pihole dns blocker and did not see any issues as far as DNS being blocked. Furthermore, I then check Snort IDS on my pfsense router. Sure enough at some point during the installation of Debian it reaches out to this ip 151.80.125.73 on port 80 TCP and tries to download something. That ip is owned by 3CX https://www.whatismyip.com/ip-whois-lookup/
Snort classifies this actions as:
I think it's just a false positive but according to Snort during the 3CX installation it reaches out to that ip and downloads a bash script that's Snort classifies as a variant of Unix.Miner.Xbash.
Given all that I made the change to Snort to allow that ip and was able to finish the installation of 3CX.
One request for the dev team would be to have the Debian install throw an error if it can't download the 3CX install bash script. Something like "Network error can not download 3CX installation bash script" would be very helpful.
Lastly, maybe you can download the script over https instead of http?
Snort classifies this actions as:
| Date | Action | Pri | Proto | Class | Source IP | SPort | Destination IP | DPort | GID:SID | Description |
|---|---|---|---|---|---|---|---|---|---|---|
| 2021-04-25 08:10:35 | 1 | TCP | A Network Trojan was Detected | 151.80.125.73 | 80 | 6x.xxx.xxx.xxx | 25695 | 1:47873 | MALWARE-OTHER Unix.Miner.Xbash variant dropped bash script |
I think it's just a false positive but according to Snort during the 3CX installation it reaches out to that ip and downloads a bash script that's Snort classifies as a variant of Unix.Miner.Xbash.
Given all that I made the change to Snort to allow that ip and was able to finish the installation of 3CX.
One request for the dev team would be to have the Debian install throw an error if it can't download the 3CX install bash script. Something like "Network error can not download 3CX installation bash script" would be very helpful.
Lastly, maybe you can download the script over https instead of http?
