PBX: blocked for too many failed authentications; User-Agent: 3CX Phone System

[fostek-software]

Hello, the past one and a half weeks our system has gotten far too many of these and we haven't ever gotten these. I assume a bot or person is attempting a brute-force. I know the odds of them successfully entering our system are slim, but I do not want this happening at all.

Can you walk me through how to fix this?

I've tried:
- Confirmed Global Blacklist was indeed on.
- Changed the number of failed attempts from 25 down to 5, for added security.
- Configured the console restrictions to be from specific IP addresses.
- Changed the lockout time policy to 10 years, until that IP can connect again.
- Changed all the current blacklists to a longer lockout period as well.

And after all that, they are still coming in too often.

 

[leejor]

I'm quite surprised that you have not had hack attempts in the past, unless you have a dynamic IP, and it changes on a regular basis.They are quite common. Common SIP ports, such as 5060 are constantly being scanned with registration, and direct SIP calls attempted once they get a response. Many times, when an IP is blocked, they will simply increment, and try again.

 

[cobaltit]

Unplug your phone system from the internet for ultimate security. It's called air-gapping and that's how you stop internet-based attacks. Otherwise understand that the internet is a scary place and accept that this is happening to every internet connected device thousands of times a day. Turn off the alerts and don't dumb down any of the default 3CX security settings and you are fine.

https://www.3cx.com/docs/voip-security/