v16 Disappearing Extensions

[DrainBamaged]

This was posted on another thread from John_S in support:

"If you as a user-extension you have access (of any level) to the Management Console, you can manage users below your elevation level only. System Management options are considered elevated rights in this particular case here, hence you cannot see those extensions or make any changes on them."

I'm currently working remotely, several time zones away from home office. I got a panic call at 4AM my time from one of our junior techs saying several key manager extensions had disappeared. He was trying to send a new Welcome email to a user, but couldn't see the extension, because the target user was set to run call reports. Then he saw several others were gone and called me fearing a database corruption or hack attempt. Turns out it is due to the above "feature." This is nuts guys. If someone is given all extension admin rights on 3CX, then hiding other extensions because they have call reports and ability to download call recordings makes zero sense. The extension admin has greater powers than the call reports user in my mind.

This needs to be fixed ASAP please. And I'm repeating my call for proper system logging (who modified what, when and from what IP). It will certainly give me more nights of uninterrupted sleep. Thank you.

 

[Evolute IT]

This was posted on another thread from John_S in support:

"If you as a user-extension you have access (of any level) to the Management Console, you can manage users below your elevation level only. System Management options are considered elevated rights in this particular case here, hence you cannot see those extensions or make any changes on them."

I'm currently working remotely, several time zones away from home office. I got a panic call at 4AM my time from one of our junior techs saying several key manager extensions had disappeared. He was trying to send a new Welcome email to a user, but couldn't see the extension, because the target user was set to run call reports. Then he saw several others were gone and called me fearing a database corruption or hack attempt. Turns out it is due to the above "feature." This is nuts guys. If someone is given all extension admin rights on 3CX, then hiding other extensions because they have call reports and ability to download call recordings makes zero sense. The extension admin has greater powers than the call reports user in my mind.

This needs to be fixed ASAP please. And I'm repeating my call for proper system logging (who modified what, when and from what IP). It will certainly give me more nights of uninterrupted sleep. Thank you.

In fact, the only reason why it doesn't show up it's because that other extension has admin rights.

Admins can't view/edit other admins. That makes sense.

 

[DrainBamaged]

No, they do not have admin rights, they have the ability to download call recordings or call reports. That makes them, at best, a power user NOT an admin. They do not have the ability to change anything beyond their own extension. Saying that equates to someone who can delete or modify entire groups of extensions is illogical and a perfect example of security through obscurity.

Let's define terms.

Power user - Someone who can download call recordings, run reports and / or manage their own extension.

Extension admin - Someone who can amend / delete or change extension settings within a group or the entire organization and potentially do General System Admin in some cases.

Admin - No restrictions.

Saying that an extension admin can't see a power user is ridiculous. What happens if someone who can download call reports in one of our branch offices is terminated for cause. The extension admin can't shut down their phone access because they can't be seen? Extension admins are designated to do the day-to-day running of the office they are in. In v15.5 the rights page of others were grayed out for extension admins, but they could see and change all other aspects of the ext. That made sense.

We have six 3CX installs across multiple time zones around the world. Now I, as Admin, have to be available 24/7/365 in case a power user in Japan needs a Welcome email sent? Give me a break. (Properly designed) Software is supposed to make your life easier. I'm not giving local managers with little IT knowledge full Admin access to get around this. Without proper logging, there is no accountability.

We're suspending updating to v16 at our branch offices as long as this situation remains.

 

[NickD_3CX]

I have bee thinking about this for the past few days and I can see some good points. Of course the reason why this changed from V15.5 to V16 was due to some security holes that allowed certain admins/"power users" to exploit the rights of other users. I won't go into details, but there were some scenarios.

I would like to hear some more opinions on this though and break them down to see what could potentially better suit everyone. Just to set the scope, we are talking about Management Console access and right. Things like system logging is also important, but it shouldn't be possible to exploit others rights in the first place.

So lets go with 2 "General System Administration" users. What should one be able to modify on the others extension settings.

Just to make something clear, I am not promising or saying a change will be made, but I would like to get a better idea of others requirements.

 

[DrainBamaged]

Hi Nick,

Today the extension management and General System Administration (GSA) are separate and that level of granularity is fine as it stands.

If given GSA powers (we give that to certain managers in remote offices whose time zones are well outside of home office), an individual should be able to access the following functions:

• Phones
• Extensions (Everything except amending others admin powers)
• Groups
• Inbound Rules
• Digital Receptionist
• Ring Groups
• Call Queues
• Recordings (No delete, just download)
• Call Log
• Reports
• Security (Edit IP Blacklist only)
• Advanced (Edit Contacts only)

This lets them set up a new user (or remove a terminated employee), take care of any general housekeeping tasks in the system / queues, access needed info for call reports or do basic fault finding and handle 90% of any issues themselves.

Finally, the logging is probably the most important in a large organization. The whole "Trust, but verify" argument.

To be clear, this would handle my situation, but not everyone is the same. Ideally, being able to select a check box beside each function on the menu would allow someone to customize access for their people, as required, but that's probably too large of a change.

 

[NickD_3CX]

Something that we certainly don't want people with GSA rights to be able to do is change other GSA users email addresses and Web Passwords.
Also exporting data like extensions could potentially be a problem.

As you said though, not everyone has the same requirements, so it would be good if others could pitch in, maybe help me get a feel and find some common ground.

It has happened before where we implement something for the more "vocal" part of the 3CX community, then the other half of the users jump out saying "why did you change that?".

 

[DrainBamaged]

I agree with your assessment of the addresses, exports and passwords.

Hierarchical security is in use in a lot of places. You'll never get 100% agreement with any system, but make if you make it practical and logical there will be minimal fuss. Cheers.

 

[Davdi]

We would find it useful for user admins to be able to see each-other. We typically manage the 3cx server for the client, but if there is more than 1 person at the company who wants to be able to use the management console we usually create a separate "User admin" extension. That they all can use.

 

[Union Tech]

It seems to me that there are some small changes that could help both ways.

When selecting the "Manage all extensions", perhaps a sub checkbox on that particular option that allows for "include other Management Console users" that could be unchecked by default.

Also a visual indicator that when you check one of those boxes that tells you what is happening. We've been trying to figure out why the extensions have been disappearing for weeks. (Ok we didn't look at it real hard, but it was a small issue we've dealt with on and off).


We have many users that need to be allowed access to the console but we also need their extension to be managed by our other managers.

Would it be more logical to have more than just an ADMIN account and allow the creation of USERS, and those users could be admin-y level with the ability to manage everything regardless of the extension?

At the very least there should be an option to allow the 'manage all extensions' users to . . . manage ALL extensions.

Also - regarding the passwords and email address changes - passwords for the web console should not be viewable once they have been changed. I think that should be universal - why should I or anyone ever be able to see what a pw is if it's not something generated randomly by the system (OTP)?
Even at that, if a pw reset occurs, then it should email that pw to the user and then force a change on login.

 

[Union Tech]

Oh - as a temporary work-around, we're probably creating a new bogus extension for our admins so that they can log in to the system and manage the actual phone extensions of users and the tech team. It's a bit of work, but it will serve our purpose until (hopefully) a decision is made (by dev team) to make this workable again.

 

[AWS2P]

The first admin created from PBX install should stay always the most powerful