Good Morning All
Maybe a 3CX issue or not but am attemtping to track down if 3CX uses tinyproxy proxy daemon
I have a hosted system set up as a demo and am having an issue with possibly someone hacking .. I have 1 telephone in my office off of the hosted system and I had a Man in the Middle attack last week that I hope via my Norton pop up has been stopped . More on that later . That being said I went in to my hosted system to review the logs but the hosted system deletes them rapidly . It looks like every 2 days but yet the system is not that active either as ALL of the events and activities logs are being deleted . Is there any way to change this ? They would sure be helpful if I could see the past week or 2 .
So I have no visibility into what's going on ( tel system wise ! )
I have been searching my logs on the router and found something called Tiny Proxy which I think is associated with NGINX ? as I am still investigating and not known for sure yet ( I also have a 3cx version in my home office with 5 phones ) . No more info available as I am still tracking this down, but on this system the logs do not show any sort of activity related to hacking attempts .
This Tiny Proxy error is the only message that I can see in any of my logs . Wireshark comes up empty also . The IP addresses are my tv's as my home office is shared wiht my home Network . So I am trying to figure out who uses linux debian and some others ! So no clue what would be using this in my network .
Oct 30 15:04:00 2020tinyproxy [4282]err<147>opensock: Could not establish a connection to 192.168.2.100
Oct 30 14:59:46 2020tinyproxy [4284]err<147>Error reading readable client_fd 8
Oct 30 14:59:46 2020tinyproxy [4284]err<147>opensock: Could not establish a connection to 192.168.2.100
Oct 30 14:59:43 2020tinyproxy [4283]err<147>opensock: Could not establish a connection to 192.168.2.100
Oct 30 14:10:14 2020tinyproxy [4282]err<147>opensock: Could not establish a connection to 192.168.2.101
Oct 30 14:10:11 2020tinyproxy [4285]err<147>opensock: Could not establish a connection to 192.168.2.101
Oct 29 11:57:59 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:57:59 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Oct 29 11:56:33 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:56:33 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Oct 29 11:56:00 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:56:00 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Oct 29 11:55:55 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:55:55 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Anyone else have this issue ?
Any help would be appreciated
Thx
Regards
Rich
Maybe a 3CX issue or not but am attemtping to track down if 3CX uses tinyproxy proxy daemon
I have a hosted system set up as a demo and am having an issue with possibly someone hacking .. I have 1 telephone in my office off of the hosted system and I had a Man in the Middle attack last week that I hope via my Norton pop up has been stopped . More on that later . That being said I went in to my hosted system to review the logs but the hosted system deletes them rapidly . It looks like every 2 days but yet the system is not that active either as ALL of the events and activities logs are being deleted . Is there any way to change this ? They would sure be helpful if I could see the past week or 2 .
So I have no visibility into what's going on ( tel system wise ! )
I have been searching my logs on the router and found something called Tiny Proxy which I think is associated with NGINX ? as I am still investigating and not known for sure yet ( I also have a 3cx version in my home office with 5 phones ) . No more info available as I am still tracking this down, but on this system the logs do not show any sort of activity related to hacking attempts .
This Tiny Proxy error is the only message that I can see in any of my logs . Wireshark comes up empty also . The IP addresses are my tv's as my home office is shared wiht my home Network . So I am trying to figure out who uses linux debian and some others ! So no clue what would be using this in my network .
Oct 30 15:04:00 2020tinyproxy [4282]err<147>opensock: Could not establish a connection to 192.168.2.100
Oct 30 14:59:46 2020tinyproxy [4284]err<147>Error reading readable client_fd 8
Oct 30 14:59:46 2020tinyproxy [4284]err<147>opensock: Could not establish a connection to 192.168.2.100
Oct 30 14:59:43 2020tinyproxy [4283]err<147>opensock: Could not establish a connection to 192.168.2.100
Oct 30 14:10:14 2020tinyproxy [4282]err<147>opensock: Could not establish a connection to 192.168.2.101
Oct 30 14:10:11 2020tinyproxy [4285]err<147>opensock: Could not establish a connection to 192.168.2.101
Oct 29 11:57:59 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:57:59 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Oct 29 11:56:33 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:56:33 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Oct 29 11:56:00 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:56:00 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Oct 29 11:55:55 2020tinyproxy [2435]err<147>Error reading readable client_fd 8
Oct 29 11:55:55 2020tinyproxy [2435]err<147>read_request_line: Client (file descriptor: 8) closed socket before read.
Anyone else have this issue ?
Any help would be appreciated
Thx
Regards
Rich
