Security Suggestion for 3cx

[paulmacfarlane]

We had an incident that someone changed the ADMIN password and the ADMIN email address. Took a little hacking but we were able to recover it.

SUGGESTION to 3cx:

When the ADMIN password or email address is changed, send an email to the LICENSE CONTACT 3cx has in addition to the admin email.
When an ADMIN FORGOT PASSWORD is sent, send also to the LICENSE CONTACT 3cx has in addition to the admin email.

This way the owner is always contacted and can be alerted when something goes wrong!

 

[SteveITS]

I understand your point, however, in v20 there is no separate login and everyone logs in as an extension. Perhaps notification could happen when a System Owner extension resets their password.

 

[paulmacfarlane]

Either a password reset or email change. Maybe not just system owner but anyone with admin level access.
The point being: Someone at a trusted address will receive password reset emails for owners/admins.

Another suggestion. Email addresses: Can we restrict the email addresses to a specific Domain?

Maybe that's a v20 thing, but work VM and work Ext should be related to a work Domain ONLY.