invalid CONSOLE login attempts not considered in IP blacklist ?

[kwen1x]

Hi,

I see the eventlog that is (over)loaded with 30037 events: User or password is invalid from .. (3CX Phone System Management Console).
Console access has been restricted to limited list of IP addresses, yet console page is still 'accessible' from internet ??
However, if I try to connect with VALID admin credentials, the connection is refused.
Seems odd 'implementation' of this IP restriction option.

Furthermore an event 30037 is logged when INVALID credentials are detected, yet these attempts do not result in the IP address in question being put on the IP blacklist ??
Only events 12290 (as far as I've seen) trigger their IP address being added to blacklist...

Why not blacklist illegal admin console attempts ?

 

[kwen1x]

I think that's a wrong assumption there, never said that we dropped MC blacklisting.

It worked before, and it still works in U6 - Just go ahead and try it on a U5 and a U6 and you will get blacklisted on both occasions.

John,

at least 3 users are telling you it is not working in v18 build 908 ?
As far as I can see this is the latest build.
Can you elaborate on what you mean with U5 and U6 ?

 

[JohnS_3CX]

Hi @kwen1x

Here is what happens when I try to login with a wrong password too many times

- Both systems were using the default settings, and I made 10 wrong attempts.
- The behavior is the same in both system versions - I got blacklisted.
- This applies to Management Console / Webclient login attempts specifically.
- What I meant about the anti-hacking module is that you basically control the attempts for SIP, not for MC/WC but that does not mean you are not protected. The system will blacklist someone who tries logging in with the wrong password. If the password leaked, this will not protect you. If the attacker is trying random passwords, they will get blocked and you will see all their attempts in your event log.
- Console restrictions take it a step further by also ignoring attempts from anyone who is not in the allowed list (specifically for the actual Management console - not the webclient)

You can set up both systems and test / compare if you like, but here are the results on both cases if you want me to save you some time:

U5 = 3CX V18 Update 5 (18.0.5.418)


U6 = 3CX V18 Update 6 (18.0.6.908)

 

[kwen1x]

Hi John,

this is what I (and I think others also) get with or without console restrictions in place:



with console restrictions in place, I also get this message, even when credentials are correct.
IP addresses are not blacklisted, that is/was the whole point of this thread...

Also IP addresses triggering an 30037 eventlog are NOT showing up in the list of IP addresses being blacklisted..

 

[kwen1x]

running 18.0 (Build 908), which is U6 as I understand (on linux not windows)

 

[rjamesm2884]

This is the new normal with 3CX. If something like this can't be solved we have a problem with this product.

 

[kwen1x]

Hi @JohnS_3CX

How do we proceed ?
Teamviewer session ?
Some kind of support dump ?

 

[MSPN]

Same here, blacklist is not working since U6.

 

[JohnS_3CX]

Have you made 10 attempts to enter the wrong password as noted here?
https://www.3cx.com/community/threa...red-in-ip-blacklist.119034/page-2#post-553999

 

[bitn2]

We have the same discussion in the german forum... before this option also restricts the web login not only the sip. From now on it is only sip and the web login restriction is hardcoded to 10 times. This is something 3cx should mentioned somewhere in the release notes and the description on this option should be clearer.

 

[kwen1x]

We have the same discussion in the german forum... before this option also restricts the web login not only the sip. From now on it is only sip and the web login restriction is hardcoded to 10 times. This is something 3cx should mentioned somewhere in the release notes and the description on this option should be clearer.

Aha, this is clearer..
Console hacking attempts are hardcoded to 10... I did not catch that one in this discussion before !
Thanks for clarifying this 'bitn2'..

From security point of view, which is worse: some who guesses console password or someone who guesses SIP password ??
Would it not make more (security) sense to 'publish' BOTH thresholds in the GUI and let the (paranoid) admins decide, in stead of a hard-code, arbitrary value ?
And while we are at it, in another thread someone also suggested 'protecting' the console login with an extra 2FA possibility ?
It think this would make 3CX a better product...

 

[JohnS_3CX]

Perhaps one of the Partners can post it in the Ideas section as future improvements / feature request. We can definitely consider it.

 

[kwen1x]

Perhaps one of the Partners can post it in the Ideas section as future improvements / feature request. We can definitely consider it.

bitn2.. I see you are a 'Gold Partner'.. can you submit this ?
I'm very dissapointed to get an 'academic' reply to this subject from JohnS_3CX, given the sensitive nature of the issue

 

[bitn2]

bitn2.. I see you are a 'Gold Partner'.. can you submit this ?
I'm very dissapointed to get an 'academic' reply to this subject from JohnS_3CX, given the sensitive nature of the issue

I can try, my english isnt that good... :-D

 

[kwen1x]

kein Probleem...
you can take my text

"
Would it not make more (security) sense to 'publish' BOTH thresholds in the GUI and let the (paranoid) admins decide, in stead of a hard-code, arbitrary value ?
And while we are at it, in another thread someone also suggested 'protecting' the console login with an extra 2FA possibility ?

"

Thanks

 

[bitn2]

kein Probleem...
you can take my text

"
Would it not make more (security) sense to 'publish' BOTH thresholds in the GUI and let the (paranoid) admins decide, in stead of a hard-code, arbitrary value ?
And while we are at it, in another thread someone also suggested 'protecting' the console login with an extra 2FA possibility ?

"

Thanks

https://www.3cx.com/community/threa...mpts-webclient-and-management-console.119205/

 

[kwen1x]

Can I invite the other users who reacted in this thread to goto the 'idea' link provided by bitn2 and click on the +1 voting button ?
Let's hope we get this on the radar of the the powers at 3CX...

 

[ITGS-Pichi]

Totally agree. I just voted, since I'm seek of have my Event log full of those attempts daily

 

[binnih]

Totally agree. I just voted, since I'm seek of have my Event log full of those attempts daily

Same here

 

[tw_arsenal]

Same here

Console Restrictions is broken in 18.0 U6 (Build 908)
3CX console is flooded with failed login attempts from random IPs
This used to work great before U6, the web server would even display the HTTPs page. What happened?

 

[Suri]

We have the same issue, console is restricted to our ranges only. Failed authentication in anti-hacking is set to 2 attempts. The event log is filled with invalid login attempts from many ip ranges. I try to manually blacklist but the list is getting too long and I have to blacklist a bigger subnet. The version we are running is 18.0 Update 6 (Build 908). I tested some attempts to login to management console from unallowed ip, hit login many times but that ip has not appeared in the event log even after 2 minutes. Was there a bug in the recent update? If so when can we expect it to be fixed?

These attempts started happening after we upgraded to upgrade 6 release on Feb.