Newbie need help installing Debian SBC

[Phil-cxcxcxcx]

I am running into some problems installing the v 18 SBC from Linux iso.
I am installing on a standalone PC.

Is there a place to ask my questions, and get some guidance?

I apologize in advance - I am a rank newbie to 3cx, though I do have some
background in Telecom and IT.

Thanks,

Phil

 

[SweetAction]

Right here is fine to ask for help, although I have to ask...

3CX SBC or full PBX.
If SBC, where does the PBX live.
What errors are you getting?

 

[Phil-cxcxcxcx]

Hi SweetAction,

Thank you for replying! Sorry it has taken so long to get back to the forum..

I finally got the SBC to install properly - guess I panicked a little and posted too early.
I have a Hosted-by-3cx system in the cloud. Steep learning curve for me, but as I
get more familiar, it's getting easier.

The SBC is installed on its own PC, Debian Linux iso.
The error I was getting installing the SBC was that credentials were wrong.
I copied the password into a text file, and looked at it with GHex ( reads the file
in hex ), and found that what I thought was a capital O was actually a zero.
That fixed that.

Next error was a phone configuration messup. I had put the Auth ID in the user name
field of the phone , instead of the extension number. Once corrected, phone registered
perfectly..

Watching countless youtube videos, and re-reading the 3cx pages online has helped a lot.

Anyway, Thanks to you and the forum for being there - from what I've read of the posts, a
great resource...

Phil

 

[Phil-cxcxcxcx]

I just looked in my activity log, and there are some entries I do not understand..
Possibly someone could help interpret them for me?

Here is one:

10/17/2022 5:50:38 AM - [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 192.158.226.18:58418 tid=1306728498 Call-ID=192173614-1379948636-68945443: REGISTER sip:137.220.62.144 SIP/2.0 Via: SIP/2.0/UDP 10.124.108.22:58418;branch=z9hG4bK1306728498;received=192.158.226.18 Max-Forwards: 70 Contact: <sip:[email protected]:58418> To: <sip:[email protected]> From: <sip:[email protected]>;tag=1146218367 Call-ID: 192173614-1379948636-68945443 CSeq: 2 REGISTER Proxy-Authorization: Digest username="4019",uri="sip:137.220.62.144",algorithm=MD5,realm="3CXPhoneSystem",nonce="414d5359634d337d99:1bf7f2563b5a80d4108cb388a8d8a46d",response="4d665a0e374caf4e82654dccf7f46f3a"

*** User-Agent: VOS3000 ***

Content-Length: 0

; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

Note the user-agent ( highlighted ). There are bunch of error messages, and each one has a different
user-agent - these are devices and phone I do not have connected to my PBX..
e.g.
Auerswald COMpact VoIP sofia-sip1.12.11
PolycomVVX-VVX
PolycomVVX-VVX_300-UA/4.1.6.4835
Asterisk PBX
:Avaya IP Phone 1120E
and several from 3CX phone system, but they mention user-names ( extensions ) which I do not have on my
PBX...

Can you tell me what these mean? All of them are " authentication failed". Is someone trying to crack into
my PBX?

Thanks,

Phil, the newbie on the block..

 

[SweetAction]

This is fairly common - via just random port scanning, your PBX has been found and bots are attempting to break in.

As this is hosted by 3CX, you can't use a firewall in front of the PBX to stop it. You are limited to ensuring your extensions have strong passwords (it's the default, so unless you went out of your way to set it as weak, you are fine) and you anti-hacking settings are set correctly (again, default is fine, so unless you changed it...)

Lastly I would set any extension not using direct SIP (STUN) to "disallow outside of LAN" - if they are behind a SBC they will still work - and review the guidance in these articles.

https://www.3cx.com/blog/voip-howto/global-ip-blacklist/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-1/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-2/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-3/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-4/

 

[Phil-cxcxcxcx]

I tried to find the setting "disallow outside of LAN" but could not. Can you tell me where it is?
I think my extension passwords are complex enough ( 17 characters..letters, caps, digits, symbols )
but they are not random - follow a pattern to make them easier to remember.
but will try some others for increased complexity..

I do have 1 SIP trunk...from Twilio...and 4 outbound rules...any suggestions about locking those down?
Here's the Outbound list.

E.164_OG Prefix: + : goes to Twilio SIP trunk.
domestic USA Prefix : 1 : goes to Twilio SIp tk
international_OG prefix: 011 : BLOCKED ( just did this )
Domestic US + 1 prefix: +,0-9 goes to Twilio SIP tk

Any possible security issues with these?

All my SIP phones are behind an SBC.

Thank you so much for the links. Very helpful. Complicated and dangerous world out there!

Phil

 

[SweetAction]

Regarding the SIP Trunk, in Hosted you can't lock it down further. If you were on prem you could use the NAT/Firewall device in front of the 3CX server to lock it down via IP whitelisting though.

Regarding outbound rules, security -> Allowed Country Codes restrictions should be good enough to block international calls, but an outbound rule doesn't hurt.

I would block premium numbers (900 numbers) as well.

 

[Phil-cxcxcxcx]

I decided to disallow all outbound calling for now. This is just a test system, and I'm far more interested in the inbound calls , to my IVR etc

My next aim is to change the sip phone passwords to something better than the default(admin).

All this does incline me to think that an on prem system can be secured more solidly than a hosted system.

I have a friend in the Netherlands who installed an on prem system for just that reason.

Thank you again, SweetAction.

Phil

---

 

[SweetAction]

My next aim is to change the sip phone passwords to something better than the default(admin).l

---

3CX does this for you automatically when using a supported device provisioned with their template.