Solved Root password in setupconfig.xml

[Arthur.b]

The current trend is to no longer use the root account of 3CX instances but to go through the owner's account. It is now possible to configure a 3CX via a config file "setupconfig.xml," which allows for the provisioning of FQDNs and internal dial plans, as well as creating an owner's account and no longer providing root access. However, upon opening the XML file, the root account is present, and the password is in clear text, moreover, the password is very weak, with no special characters. If this file leaks, it's game over for the 3CX instance.

 

[NikosT_3CX]

@Arthur.b we can understand your concern but mainly it's up to the admin/owner to have a secure password ( replacing the random one from the file ) and also keep the file in a secure location or delete it totally and keep the credentials in a secure location.

 

[AWS2P]

Are you speaking specifically about hosted 3CX instances, or it doesn't matters where they are hosted?

 

[NikosT_3CX]

@aws2p at 3cx hosted solution the machines are deployed via the portal, so this is for self managed machines that are installed with https://www.3cx.com/install/ config file or via the setupconfig.xml/