Solved Login access denied. Too many incorrect login attempts

[dxfoxd]

I noticed a lot of warning messages lately IP [...] has been blacklisted on PBX [...]
Affected Module: SIP Server/Call Manager User agent: Avaya IP Phone 1120E
The IP [...] has been blacklisted for 86388 seconds Etc.

In the past I went to my management console and blacklisted the IP range forever. But when I received 3-6 blacklist warnings daily I stopped doing this. Today I wanted to access the Management Console using the admin user but found myself locked out: Login access denied. Too many incorrect login attempts. Try later or contact the Administrator. Login as an extension failed as well. I tried to login using another IP address, same result. I did not login for quite some time in the MC (can be even some weeks ago), and well, "contact the administrator". Who? That is the admin login! So this leads to nothing.

As I assumed login fails (hackers) trying to access the MC should also be blocked based on their IP and not on the login name, I cannot understand why I'm logged out and for how long. In the meantime, if the hack had success, they could be abusing my trunks.

So, the simple question is, how to access the MC? Anyone got an idea?

Peter

 

[leejor]

See @JohnS_3CX response in this tread...

https://www.3cx.com/community/threa...try-later-or-contact-the-administrator.63864/

 

[dxfoxd]

Thx, tried that. My installation is in the Google Cloud (Linux) so I tried to perform all options with the command line supplied in this post.

1. Made a backup and downloaded it, extracted the admin password from the XML, was exactly the same as my current pwd.
2. Tried to login 24+ hours later. Not successful.
3. Tried to restore an earlier (unchanged) backup: Not successful ("Provided backup is not valid")
4. Verified the blacklisted and whitelisted IPs in the XML, because the latest modem restart gave me a new WAN IP. My current IP is not listed in the XML.
5. Tried to login using several other external IPs (incl. mobile phone), not successful
6. Manually emptied the entire blacklist table in the 3CX database and added my own IP address as whitelisted. Restarted the 3CX services. Not successful.

Now I'm considering to fully reinstall, or is there anybody having another idea?

BTW, I can still use all extensions, except the web-based ones (soft phones and IP phones still work /...).

Peter

 

[Quentin D]

You could take a temporary IP address on GCloud and assign it to your 3CX VM.
This would temporarily break the FQDN and let you connect using IP as URL.

Once connected go to security and change the admin account name and password. "admin" is way too common.

Secondly, give your extension the admin rights so you still have a backup account.

 

[dxfoxd]

Thx for the suggestion. Did the above, FQDN was broken, 3CX login page appeared on new IP but still the same Error. Login access denied. Too many incorrect login attempts. Try later or contact the Administrator. So I now created an install on a local server and restored a backup. When logging in using a local ip 192.168.x.x I could access the MC again. I noticed that I overlooked one setting in the Settings > Security Settings Tab Console restrictions: Allow Access from specific IP Addresses. 192.168.x.x. is there by default, but my own IP as well as the Google external IP were changed, so it was practically impossible to login. Too bad that I did not discover this setting in one of the Progres DB tables, otherwise it had pointed me in the right direction.

Thx for your help!

 

[Quentin D]

Glad to see you get your access back.
Do not forget to change the admin logon name. That might help you not having this issue in the future.
You can also dicrease the amount of failed attemps before being banned.
You can also create a "fake" extension with admin rights as a backup and hide it so nobody will ask you who it is.

But of course, your instance, your choices ;-)