Reports URL protection with password or IP range?

[nobody]

If you generate a Call report, as pdf or html page, it is put under
https://fqdn.of.pbx/managment/Reports/someofuscatedfilename.pdf/html
And available to the whole world.

Its unlikely that someone will guess the filename, but it might happen, that someone gets the url by accident. Those reports a really not for everyones eyes.
Is there a built in protection of the files under this path, or can I add one myself? I am familiar with apache but nginx will most likely work similar. But, if there is an update to the pbx will my customizations still be there afterwards?

 

[cobaltit]

I would imagine you control the firewall in front of the PBX so you can do exactly what you are asking there.

 

[craigreilly]

I would imagine you control the firewall in front of the PBX so you can do exactly what you are asking there.

Same IP as the phone system and if I recall presence information - so maybe not so easy to fix on your own.

 

[nobody]

A firewall normally cannot look inside https traffic. You have to fix that using the webservers configuration. Either by a basic auth style password protection or by limiting the access depending on the Ipaddress or both methods.

If you want to lock out anyone but the local subnet from this directory:
On windows:
C:\Program Files\3CX Phone System\Bin\nginx\conf
make a backup of nginx.conf
edit nginx.conf with notepad
The file contains two definitions for the server. One for port 80 (http) and on for port 443 (https/ssl). Depending on your setup the numbers might be different.
Inside both sections you find a predefined statement pointing to the Reports Folder:

location /management/Reports {
            alias "C:/ProgramData/3CX/Instance1/Data/Http/Reports";
}

If 192.168.55.0/24 is your local subnet, change that to:

location /management/Reports {
            alias "C:/ProgramData/3CX/Instance1/Data/Http/Reports";
            allow 192.168.55.0/24;
            deny all;
}

Make these changes for both the http and the https Server. Save file, restart the nginx service. From now on a 403 forbidden will be served to anyone who accidentally got the link for the report, who is outside the subnet.

I think it is much safer to protect the folder in addition to the cryptic name of the report, because People forward mails to wrong addresses, people make typos when composing mail. There is a multitude of options. With an additional protection, there will be no or less damage to your precious data.

 

[craigreilly]

• Thanks for sharing this solution.

 

[cobaltit]

So your request was protection via password or IP range. An ACL in the firewall by IP range does not not require HTTPS inspection.

Also, there was no declaration of needing presence (or provisioning or anything else that would require HTTP/HTTPS access) from some place besides the desired report viewing location so no solution for that scenario was given. But yes this approach is all or nothing but has the benefit of being a 3CX supported scenario. Editing the nginx config is certainly more granular (but unsupported).