MFA - Invalid security code

[ASTERHC]

Our main operator account started complaining about invalid username and password today. Thinking someone had changed the password and not updated our password manager I managed to login with another account and perform a password reset but I am unable to get the MFA code working.

I scan the MFA QR code using the Keeper mobile app and browser plugin, type or copy the MFA code and each time I am getting the error message "Invalid security code".

I did a quick search to see if others had this issue and saw some post about mentioning time drift but I cannot see anywhere in the 3CX console where it list the 3CX system time to confirm if there has been any time drift to confirm that this is the issue.

We are using Version 20.0 Update 7 (Build 1060 Beta).

 

[bitn2]

You need to check the underlaying os for time drift. Is this a Linux or Windows pbx?

 

[SteveITS]

Also check the phone’s time, some can be set to not auto update time.

.1060 isn’t a beta but you’re missing the second u7 hotfix, 20.0.7.1080.
https://www.3cx.com/blog/change-log/phone-system-change-log-v20/

 

[ASTERHC]

You need to check the underlaying os for time drift. Is this a Linux or Windows pbx?

Linux. The console is currently showing the end screen of the setup progress as the system as not been rebooted since it was setup.

Also check the phone’s time, some can be set to not auto update time.

Mobile phones, desk phones and computers are all showing the correct time.

.1060 isn’t a beta but you’re missing the second u7 hotfix, 20.0.7.1080.

I know but internal bureaucracy is what it is.

 

[SteveITS]

all showing the correct time

So just to be pedantic about it, I once had a coworker whose phone had drifted ~25 seconds so time was "correct" to the minute 35/60ths of the time but that left only a 5 second window for each code to work. So the auto update setting is more or less required. The codes are almost always the wrong time. Possibly, the time was incorrect when the QR was scanned originally, and they've changed it now?

In Linux the "date" command will show time to the second.

Perhaps 3CX can add "date" under System Info, or Overview, or something, but I'm not seeing it either.

FWIW: https://www.3cx.com/community/threads/3cx-self-hosted-no-system-clock-synchronized.134964/

 

[ASTERHC]

So just to be pedantic about it, I once had a coworker whose phone had drifted ~25 seconds so time was "correct" to the minute 35/60ths of the time but that left only a 5 second window for each code to work.

I did read your previous post about this when I was searching for my MFA issue which lead me to believe I maybe seeing the same issue related to time drift.

In Linux the "date" command will show time to the second.

Can't currently type in the console. Likely the system needs a reboot after the inital install has completed.

Perhaps 3CX can add "date" under System Info, or Overview, or something, but I'm not seeing it either.

Would be great as well as the ability to specify a NTP source for those that might run their own or have their preference.

FWIW: https://www.3cx.com/community/threads/3cx-self-hosted-no-system-clock-synchronized.134964/

Thanks, looks like I will either need to wait for 3CX to add NTP back in or do it myself.

 

[KyriacosS_3CX]

Can't currently type in the console. Likely the system needs a reboot after the inital install has completed.

If you have a realish console, type Alt+F1-10 to get a new terminal, or just so an SSH into it.

 

[miguelparedes]

Hello, good morning, the same thing happened to me, the system indicated an invalid token, reviewing the comments, I entered through the console (linux) with the date command, validated that the time is not synchronized, a difference of 3 minutes, enough for what was described to happen, I adjusted it with the command sudo timedatectl set-time and it worked without problems

 

[ASTERHC]

Issue has now been resolved. Updated to Version 20.0 Update 7 (Build 1080 Release) and then manually set the time. I will monitor to see if time drifts and see if I need to install the NTP client.

 

[bitn2]

Just install the ntp client... Its a few seconds to do so and no problems anymore.