V20 Impossible security

[DrLloyd]

Has anyone encountered the following scenario or how would you recover from it:
V20 REMOVES THE ROOT LOGIN TO THE SYSTEM. You have to log on via a user account. They have been pushing the system owner level for a while, so that is great... but there are no checks and balances...
If using the 3CX SMTP relay, if an email generates an NDR, that email address is blacklisted on the 3CX side. There is NO notification or log to confirm this. You have to contact support to have it removed. Best practice is use your own relay, I guess.
If the same email is used for multiple user accounts, then you may not be able to reset a particular account... that is the system owner...
SO If you upgrade to V20, thankfully it prompts for a backup, because if you are an MSP who manages a hundred systems, and all you have recorded is the admin credentials, once the upgrade has completed, you could have no way to recover the credentials to the system if the email gets blacklisted in some way, or you had not recorded the info for the system owner. It is not always the main POC where the system was installed. . you better have the backup and restore back. That is fine for the next couple of months, but I can see a password getting lost in the future and having no way to access the system...
Thoughts?

 

[SteveITS]

There have been similar threads posted. "hundreds" is difficult to scale of course but when 3CX said the management console was going away and a System Owner was required we created a System Owner extension for ourselves, on each server.

One thought I've posted before is to use plus addressing to ensure email uniqueness... [email protected] or whatever.

 

[CentrexJ]

Yes, very important to prepare your systems ahead of the upgrade. Make sure the email is only for one extension, use a different email for reports, set a password on the owner extension and document it.

 

[DrLloyd]

Agreed on the plus uniqueness.
I have not determined if an out of office trips it as well.
Here I go to create a bunch of users.
It is just feeling like 3CX is forgetting how the real world is sometimes.

 

[CentrexJ]

Agreed on the plus uniqueness.
I have not determined if an out of office trips it as well.
Here I go to create a bunch of users.
It is just feeling like 3CX is forgetting how the real world is sometimes.

In our case we already had a test extension on each customers system that we use for testing. We just had to make sure that it was also system owner, and as mentioned the email wasn't used for another extension or for the email reports. Its helpful to have a test extension for troubleshooting issues anyway.