IP Blacklist issues since U6 upgrade

[silicon2]

Since we upgrade to U6, we are seeing more extension brute force attempts than ever. I noted that some of the ip addresses in the event log were not shown in the IP Blacklist, and yet when attempting to add them we are seeing "This IP address is already in the blacklist" - which it is not in the local IP Blacklist - so does this mean it is in the Global BlackList (If so, it would be better to state this clearly).

I suspected that something is not right. So I manually added a public ip address and checked the Windows Firewall on the Windows 10 VM hosting the 3CX instance, and could find NO added firewall rule within the Windows firewall rule list (apart from the standard 3CX allow rules). I think something is wrong here - isn't this how this works?

 

[AlphaNumbers]

You are not seeing more of anything. 3CX have just made i visible so you are aware - These attacks were always happening.

 

[silicon2]

OK, I never used to get my extension phone system "yelling" at me for incorrect password attempts directly on the handset until U6. So it isn't just an awareness issue being exposed in the logs. Something different is going on.

 

[AlphaNumbers]

Directly on the handset? That i'd like to see.

 

[silicon2]

It is also does not address my query regarding the operation of the Global/Local blacklist either, any enlightment there for me?

 

[silicon2]

Directly on the handset? That i'd like to see.

I'll see if I can capture the audio/video of it happening.

 

[AlphaNumbers]

It is also does not address my query regarding the operation of the Global/Local blacklist either, any enlightment there for me?

Yes those IP's will be added to global blacklist and obviously 3CX dont share this information.

 

[silicon2]

Yes those IP's will be added to global blacklist and obviously 3CX dont share this information.

It would be good if it was shared and timestamped as to when it was added, as it would help me determine if the attempts logged were prior to adding to the global blacklist as I'm wondering how well this is working. Not sure why this info can't be shared as I can't think how this would be an issue.

 

[AlphaNumbers]

If they're in the blacklist you wont see the attempts at all. After the login attempts hit your limit specified, they get added to the blacklist.

 

[kwen1x]

Hi Silicon2

see feature suggestion

https://www.3cx.com/community/threa...mpts-webclient-and-management-console.119205/

apparently the console 'attacks' are now (since U6 ??) hard-coded into 10 attempts, before being blacklisted...

Click on vote+ button to make this feature more popular...

 

[kwen1x]

the screenshot you shared are attacks on the management console, not on the 'extensions'.
For the extensions the IP blacklist threshold is used that you can configure through UI

 

[silicon2]

the screenshot you shared are attacks on the management console, not on the 'extensions'.
For the extensions the IP blacklist threshold is used that you can configure through UI

I'm confused as my phone now several times a day "yells" at me for bad password attempts (I think to access voicemail) - and yet, this never used to happened prior to U6. So confused as to whether this is the new mgt console revelations or something else.

 

[kwen1x]

see eventlog:

mgmt console wrong password = event 30037
extension wrong password = event 12290

maybe voice mail failed login is yet another event id ?!

 

[SteveITS]

I'm confused as my phone now several times a day "yells" at me for bad password attempts (I think to access voicemail) - and yet, this never used to happened prior to U6. So confused as to whether this is the new mgt console revelations or something else.

Is your phone STUN? If so might be external connections? What model?

The blacklist is internal, not via firewall. 3CX just denies attempts.