Version 18 Update 8 Final - The Recap

[JohnS_3CX]

Upgrade of clients site last night to 18.0 (Build 917) lost all Global contacts.

Can you provide us with some more info on this?

 

[tronic]

Can you provide us with some more info on this?

The client had global contacts yesterday on old version and then after upgrading last night they were gone this morning. As in empty like there was never any added in the first place. The contact's area was blank. They don't have Microsoft or CRM contacts. Let me know if you need more info.

 

[bit101]

Hi Nick,

in Update 8 there are no passwords generated for 3cx user extension in the welcome email. The user has now to type in a password by himself.
So this is very unsecure because the user will always set unsecure passwords. I know that from experiences over years!
So is there a possibility to active a passwort generation by 3CX?
The 3CX Passwords are were always secure.

regards,
Norman

 

[tronic]

The user generated passwords still need to meet complexity policy

 

[bit101]

from user view is this still uncomfortable because he has to think a passwort and has to save this separatly.
Therefore it should be the possibility to enable the passwords in the welcome emails again.


+1

 

[Guillaume Bourgeois]

from user view is this still uncomfortable because he has to think a passwort and has to save this separatly.
Therefore it should be the possibility to enable the passwords in the welcome emails again.


+1

You still have the possibility to choose passwords.
The passwords being now hash with a Salt , it is irreversible (or almost / not to say "impossible". ).

Generate the passwords yourself and create the extensions with the CSV file.
Find another way to communicate the passwords but not by e-mail in clear text.. which would be completely contradictory ; your need secure password approach ..and finally communicated in an insecure way.

It's a bit like the bank mailing you a credit card, pre-activated, with the PIN code written on a piece of paper in the same envelope. Without having the possibility to change their PIN. Result ; Anyone who gets their hands on the envelope can use it as they want..

However, to meet your challenges, maybe, a solution allowing you to view the password only once via a URL.
Equivalent to what OneTimeSecret proposes.
Of course, this would involve storing a copy of the plaintext password temporarily (when creating it before it is hashed) in the database (for a limited time), which is again contradictory but not as risk as an email.
The problem remains the same, if someone intercepts the email, they will have access to everything until the real recipient reports that they cannot see their password (URL already in use)

The fax machine <-> the fax machine! It's definitely the future!
Use Fax machine to send passwords to users on their own unattended physical fax machines,
I'm obviously kidding, I'm not making fun of you @bit101 , I promise, I'm kidding about the fact that it is complicated to communicate sensitive information securely.

Cheers,

 

[Atlas_EdgeM]

The client had global contacts yesterday on old version and then after upgrading last night they were gone this morning. As in empty like there was never any added in the first place. The contact's area was blank. They don't have Microsoft or CRM contacts. Let me know if you need more info.

Hi @tronic,

Did you manage to get sorted with this issue? I had the same for one of our self-hosted linux PBXs, Support advised that the only way to fix it is re-enter the contacts, as the data is stored within a table in the database.

I pulled the phonebook.xml from a pre-upgrade backup (in the provisioning folder) and once converted into the correct format, it imported through the console. The xml file is only an export of the data, so overriding the file does nothing as it is overwritten when the contacts are edited.

 

[tronic]

Hi @tronic,

Did you manage to get sorted with this issue? I had the same for one of our self-hosted linux PBXs, Support advised that the only way to fix it is re-enter the contacts, as the data is stored within a table in the database.

I pulled the phonebook.xml from a pre-upgrade backup (in the provisioning folder) and once converted into the correct format, it imported through the console. The xml file is only an export of the data, so overriding the file does nothing as it is overwritten when the contacts are edited.

That's good to know thanks. The client luckily had a recent copy that used to import.

 

[supporCLG]

Hello, whe update yesterday our server to this version, but today when we update our 3cx clients we see the inconvenient of can´t create 4+ conferences. Onle can have 3 persons on call conference, beyond that we face the error "invalid email".

Can help us

 

[tronic]

Hello, whe update yesterday our server to this version, but today when we update our 3cx clients we see the inconvenient of can´t create 4+ conferences. Onle can have 3 persons on call conference, beyond that we face the error "invalid email".

Can help us

Ive tried on a few of ours and it works fine with 10. Don't enter more.

Are you using legacy no rsvp?

 

[supporCLG]

Ive tried on a few of ours and it works fine with 10. Don't enter more.

Are you using legacy no rsvp?

This has been solved, https://www.3cx.com/community/threads/v18-8-build-935-big-issue.122435/#post-573730
the default config has been changed once we updated... thanks

 

[bit101]

You still have the possibility to choose passwords.
The passwords being now hash with a Salt , it is irreversible (or almost / not to say "impossible". ).

Generate the passwords yourself and create the extensions with the CSV file.
Find another way to communicate the passwords but not by e-mail in clear text.. which would be completely contradictory ; your need secure password approach ..and finally communicated in an insecure way.

It's a bit like the bank mailing you a credit card, pre-activated, with the PIN code written on a piece of paper in the same envelope. Without having the possibility to change their PIN. Result ; Anyone who gets their hands on the envelope can use it as they want..

However, to meet your challenges, maybe, a solution allowing you to view the password only once via a URL.
Equivalent to what OneTimeSecret proposes.
Of course, this would involve storing a copy of the plaintext password temporarily (when creating it before it is hashed) in the database (for a limited time), which is again contradictory but not as risk as an email.
The problem remains the same, if someone intercepts the email, they will have access to everything until the real recipient reports that they cannot see their password (URL already in use)

The fax machine <-> the fax machine! It's definitely the future!
Use Fax machine to send passwords to users on their own unattended physical fax machines,
I'm obviously kidding, I'm not making fun of you @bit101 , I promise, I'm kidding about the fact that it is complicated to communicate sensitive information securely.

Cheers,

Thats not completely correct because 3CX sends email via TLS to another Email Server so the email transport is secure for sure!

The advantage by showing passwords in the email is that the user can move the email to a secure place and have the password (a secure password generated by 3CX) in the email archiv or or somewhere else.

Now the user has to think a passwort and don´t know how to store that secure. I know what thousand of end user do every day!
That 3CX never store hashed passwords in the database before has nothing to do with sending passworts within an email!

I'll stick with it - create passwords by the user is uncomfortable und insecure! Most of user use insecure passwords and dont save that on a secure place. I see this since many years!

@Nick Galea: Please enable the possibility to enable passwords in email again generated by 3CX. Thanks!

 

[SteveITS]

@bit101 The counter arguments are that spam filters or mail archives will hold those passwords, perhaps indefinitely, and that most users will probably just leave the message in their inbox, to be viewed later by a hacker. I get your point though, they may choose "p@ssword" or put it on a sticky note on their monitor.

Perhaps a middle ground would be to send the password but require it be changed upon first login.

 

[tronic]

If the password is encrypted when they enter it in via the website there is no way for 3cx to read this password to email it. If the server can read the password to send via email then it's not encrypted and kind of defeats the purpose.
Remembering that this outcome has come from leading security experts 3cx hired to do full adits of there solution from start to finish.
Passwords in emails will never come back.

 

[Guillaume Bourgeois]

I am indeed convinced by all his arguments; there are both advantages and disadvantages to encrypting passwords or not encrypting them.
In the end, all of this becomes secondary if OAuth authentication is configured.

Perhaps the solution to satisfy everyone would simply be to suggest/ask 3CX to add support for other OAuth authentication methods? I find it hard to believe that a company, in 2023, uses no system that could also serve as an authentication method.

I'm not trying to spark a debate.

Kind regards

 

[tronic]

I am indeed convinced by all his arguments; there are both advantages and disadvantages to encrypting passwords or not encrypting them.
In the end, all of this becomes secondary if OAuth authentication is configured.

Perhaps the solution to satisfy everyone would simply be to suggest/ask 3CX to add support for other OAuth authentication methods? I find it hard to believe that a company, in 2023, uses no system that could also serve as an authentication method.

I'm not trying to spark a debate.

Kind regards

The negative with any security effort is it always loses simplicity for the client. I don't think anyone would doubt that the passwords in the email was convenient and easy for all.

The only real next step would be 2FA. This is the only thing that a client can't do something stupid with the password.

 

[Guillaume Bourgeois]

…

The only real next step would be 2FA. This is the only thing that a client can't do something stupid with the password.

Indeed, I follow you 100%

 

[N_G]

Users must set their own passwords and this is 100% the correct security practice as advised by any security agency and ISO standard and in use by ALL leading sites on the internet today. Sign up to any main site on the net and thats how it is. Password is 100% secure because it must meet complexity requirements. Our complexity requirements are 10 characters long with no spaces and must contain a lowercase letter, an uppercase letter and a digit.

And in any case, we recommend SSO! This is the best and most secure.

2FA yes its on our roadmap although you can get it today using SSO using Google or Microsoft SSO.

 

[Guillaume Bourgeois]

…

And in any case, we recommend SSO! This is the best and most secure.

2FA yes its on our roadmap although you can get it today using SSO using Google or Microsoft SSO.

I outline the reasons I wouldn't want to be the CEO of 3CX:
- Achieving global recognition;
- Managing an incredibly successful product;
- Guiding an exceptional and devoted 3CX team;
- Overseeing a building with so many windows to clean [I'm jealous];
- Operating an office with its own bar ;
- Coordinating thousands of global resellers pushing the 3CX brand ;
- Juggling numerous requests from stakeholders who are all invested in 3CX's success;

Wait a minute ... I've thought it over. I accept the CEO role at 3CX after you step down, When can I start? LOL!

@Nick Galea

 

[ltri37]

Looks like the latest release (8B) reintroduced the bug regarding Public Interface/Default Gateway, which was previously fixed.

Wrong, it's just the RPS_LOCAL change:

You can also switch this off if you want to as long as you’re using a VPN, local provisioning or another RPS server for example. To do this you will need to go to the Management Console >> Settings >> Parameters and search for RPS_LOCAL. Once there, set the value to 0. Existing installs do not need to do anything as the value is already set to 0!