Locating Admin Panel

[grappa]

Hi everyone, we have an on premises installation of 3CX on a linux server. We recently upgraded to v20 and I'm unable to locate the admin panel for the system. It used to be `INTERNAL IP`:5001. 3CX now gives the message 3CX Version 20 requires a secure connection to use the Web Client. You are not using an FQDN or HTTPS to connect to 3CX.
Fine, we have an external url that we can use. "****.ca.3cx.us:5001/" But when I log in with a username and password, it takes me to the user panel of that user instead of the admin panel. Can anyone share where to access to the admin panel?

 

[NikolasA_3CX]

Hi Grappa,

If you are referring to the Management Console, please note that on V20 the Management Console no longer exists, as everything has been moved to the Admin Console of Web client.

 

[Charles_3CX]

In version 20 you need to use the FQDN to access the webclient. When logging in with a user set to a role with the appropriate rights, such as system owner, they will see the admin button (gear icon bottom left of the webclient) to access the admin console, from where the system is now administered.

 

[grappa]

In version 20 you need to use the FQDN to access the webclient. When logging in with a user set to a role with the appropriate rights, such as system owner, they will see the admin button (gear icon bottom left of the webclient) to access the admin console, from where the system is now administered.

Found it. Thank you very much.

 

[grappa]

That's weird. A few hours ago a user had the gear icon on the bottom left. I logged in and took a look. Now, when I log back in using the same user, the gear icon is no longer there.

 

[Vali_3CX]

That's weird. A few hours ago a user had the gear icon on the bottom left. I logged in and took a look. Now, when I log back in using the same user, the gear icon is no longer there.

You may check, almost for sure he was reassigned a role having no admin rights.

 

[grappa]

You may check, almost for sure he was reassigned a role having no admin rights.

So the issue is that I don't have any other users with admin access and I can't go in and change the rights of any user. Can this be changed somehow?

 

[SteveITS]

That's weird. A few hours ago a user had the gear icon on the bottom left. I logged in and took a look. Now, when I log back in using the same user, the gear icon is no longer there.

Do/did you have console restrictions set up to allow only certain IPs?

 

[grappa]

Do/did you have console restrictions set up to allow only certain IPs?

no.

 

[grappa]

Is there no way to access the admin panel in this scenario?

 

[JohnS_3CX]

If you have a recent backup, open it up and look at the XML file.
Search for <role name="system_owners" />

In this example you can see that user 100 is a system owner, and if you log in as that user you will have access to the Admin Console.

 

[grappa]

This is BS. I've made no changes, logged back into the user that was the system admin before and now the admin gear button has magically reappeared.

 

[grappa]

It just happened again. I got an error message. Then, I logged out and logged back in as the same user and now the admin gear icon has disappeared again.

 

[Seiten]

What is the purpose of requiring an FQDN??? It is an on premises installation!! This requirement is difficult for me because the local host override on my VERY SECURE ROUTER is pointing back to my Wireguard server in order to ensure continuity when in in the LAN or outside coming through via the Wireguard connection. What is the vulnerability of getting to the admin console via a local IP???? I dont understand? Oh, the this new management console is a HUGE STEP BACKWARDS. Very archaic interface compared to the refined interface of the Management Console.

 

[SteveITS]

What is the vulnerability of getting to the admin console via a local IP?

HTTPS encrypts the connections.

 

[Seiten]

HTTPS encrypts the connections.

Im sorry, I dont understand that answer. I can easily access a local ip address with an HTTPS: URL prefix.

 

[SteveITS]

Im sorry, I dont understand that answer. I can easily access a local ip address with an HTTPS: URL prefix.

If you accept/bypass the cert warning. Phones and apps can't do that.

Now, that said, 3CX has been saying for months that split DNS will be required, however per https://www.3cx.com/community/threads/v20-split-dns-desk-phones.124260/#post-584781 that apparently doesn't apply to local LAN phones and per https://www.3cx.com/community/threads/split-dns-server-requirement.119182/post-554805 is optional for phones ("Phones should be provisioned by secure URL although you can switch this off at your own risk").

 

[Alejandro_3CX]

Im sorry, I dont understand that answer. I can easily access a local ip address with an HTTPS: URL prefix.

Hi @Seiten without an FQDN, SSL services can't be used properly. Browser also will limit this to only connect with a domain instead of an IP address for security reasons.

This is not new, the requirement about the split DNS for on premise installation have been mentioned multiple times in different blog posts and forums. The access to the admin console, and the use of different 3cx application such as PWA, Web client must be done via FQDN.

Have a nice day!

 

[SweetAction]

If you accept/bypass the cert warning. Phones and apps can't do that.

Playing devil's advocate, spin up my own CA, sign my own cert for the IP, import my CA into my phones and devices. I mean technically this is secure, but to do it correctly is a massive amount of effort.

 

[SteveITS]

massive amount of effort

Point, but I'm not gonna.