Management console; Unauthorized console login attempt

[Hayward-i1]

Some advise appreciated.

A few months ago, I was reviewing the windows event viewer when I noticed a number of entries where it looked like someone had been trying to access the 3cx management console who was not authoirsed.

At the time, I was advised to go to Advanced, Console restrictions and change the setting to "Allow access from Specific IP Address". Which I did, it was previously set to "Allow access from everywhere" and thought nothing of it.

However, another review of the windows event log is continuing to show these events.

I am not going to include the entire entry by the one that made me wonder if this setting actually works is:

"LoginException: User or password is invalid from (xxx.xxx.xxx.xx)" Obviously I have masked the IP address, but is says user or password invalid as though someone is able to try login from outside the authoirsed list of white list IPs

Does anyone know what is going on, I do not want a brute force attack to successfully access my system?

 

[bitn2]

This is correct, you will allways got this info if someone will try to login from a not authorized ip.

 

[Hayward-i1]

Hmmm, I could have understood a message saying "Attempt to access management console from unauthorized location; denied,"

But to say they got the Username/Password incorrect is saying they got to the point of username/password and just got it wrong.

Hence my question. So are you saying it is just a poorly worded error message?

 

[NicholasP_3CX]

Just to clarify something about the admin console access.

In Version 20, the admin console is built in to the web client. There is no separate login credentials or page.

So a user can log in from anywhere in the world to use their own web client. This is NOT controlled by the "Console Restrictions" page.

What is controlled is the access to the admin console itself. So if you connect from an unauthorised IP address the admin console button will NOT be visible.

What you are seeing is someone probably fat fingering their own password on the web client. There is a limited number of times an IP address can try before it is blacklisted and wont be able to connect.

You can also be notified when someone has been blacklisted and investigate who it is and what they were trying to do.

 

[Hayward-i1]

Thank you, I had forgotten the admin console was/is now only available to authoirsed logins, via the ext login.

However, the error message is pretty clear, I had only copied part of the entry.

The source was "3CXManagementColsole" and the "ActionName: Management consolejs.controller.logincontroller.getaccessToken (3cx Management Console)"

I take it that you say saying this is only a standard user login message so should be expected and it has no relation to the management console login.