V20 Update 7 = hundreds of IP bans in minutes

[ZenMasta]

I just performed this update. Perhaps I should have checked to see which version I was on prior (if anything I likely was only a minor release or two behind). But as soon as it was completed, my email blew up with IP bans. it's been about 20 minutes and I've gotten nearly 400 emails so far, and right now they are coming in about 1 every couple of seconds.

On one hand, great that it's banning IPs but I'm wondering... what changed between the version I was on and this... did something get opened up that let bad actors see a potential attack vector or did 3cx just become more strict and started banning attempts that it would have missed in the past?

I've enabled these alerts because in the past they were very few and far between, so it was good to know, but this is too much.

I'm curious if anyone else experienced the same thing or if this might be an anomaly. I might have to disable alerts for this.

 

[ZenMasta]

It appears that this was a backlog of unsent alerts that were then queued when the update completed and services were back online. After 600 plus messages, the last few messages I receive were blocked international calls that I was trying to make on Monday 11/10. and then I noticed that in the bodies of the ban alerts, they were in the past as well.

 

[paulodagraca]

Hello,

I have seen this myself long time ago. Could have been on 3CX v12 or v12,5.
This means there was a problem before, now, not anymore.
Happy that this update has fixed your problem

Paulo

 

[SteveITS]

@ZenMasta From https://www.3cx.com/blog/change-log/phone-system-change-log-v20/ one item is "Fixed Voicemail Indicator (MWI) and improved reliability for unauthenticated SMTP servers to update promptly"...?

 

[SteveITS]

@ZenMasta Also where is your server hosted? We get maybe one email a month for clients in our data center, though we restrict access by country as well as via a few blocklists, and use IDS. So 600 seems high no matter the interval.

 

[ZenMasta]

@paulodagraca If I had a problem before, it was some how a very selective problem because I had received an email notification yesterday morning, a couple of hours before I performed the update. Then also Tuesday the 11th and October 21st. Which is strange because as I mentioned, at the tail end of all the emails yesterday, I saw alerts that should have been sent Monday about failed international calls that I was trying to make.

@SteveITS hosted with DigitalOcean


If I ever changed alert settings, it was a long time ago so here's what I have currently

 

[ZenMasta]

another interesting thing I just noticed between yesterday and today is that the 3cx app on my phone is ringing again for inbound calls.

Also, when looking at my backups in /var/lib/3cxpbx/Instance1/Data/Backups

I had one from yesterday 11/13 but prior to that, nothing since September. When they should be nightly.

 

[KyriacosS_3CX]

https://www.3cx.com/blog/releases/v20-update-7-hotfix/