Weak SIP Authentication ID error

[TekToneIT]

Hey Everyone,

We have quite a few extensions that function only to forward calls to cell phones, and have no physical IP phone or Softphone associated with them. Recently I noticed that some (but not all) of these extensions were showing a "Weak SIP Authentication ID." error message on the Users page in the admin console. I have been unable to find any configuration difference between the extensions that are and are not showing the error, and have not had any luck getting the error message resolved permanently. If I add a physical IP phone or Softphone to the extension the error disappears, but as soon as I delete that entry under the User's IP Phone tab, the error comes back.

In the grand scheme of things its not a huge deal, but I don't want to have to try an explain it to a security auditor at some point either, because historically they have not considered "false alarm" to be a valid response. Does anyone have an idea how to resolve this without permanently associating a phone with the extension?

The attached screenshot shows two extensions without phones that are showing the error, and two that are not.

Thanks!

**EDIT** I have tried using the 'Reset' option for the Users in question and it did not make a difference.

 

[SteveITS]

If it's an old enough extension, IIRC, the default was made stronger since then. See thread https://www.3cx.com/community/threads/weak-sip-authentication-id-for-one-ext-only.133937/post-638867

Note the Reset button will affect web/mobile also.

 

[BrunoI_3CX]

As SteveITS mentioned, this warning can be related to older extensions created on previous versions, where the Authentication ID or password may not meet the current security requirements.

It may also appear if the Authentication ID was manually modified or a custom value is being used that does not comply with the required complexity standards.

Regarding the behavior when a physical IP phone is added to the extension, this occurs because the system automatically generates and enforces stronger credentials for device authentication, which is why the warning disappears.

To avoid this warning without assigning a device, please log in as the System Owner, navigate to Admin > Users, select the user, and use the 'Reset' option to regenerate the credentials.

Once done, please check whether the warning is cleared and let us know your results.

 

[TekToneIT]

Sorry, I should have put this in the original post. I did try using the 'Reset' option on all of the extensions that are having this issue and it did not fix it.

 

[NikosT_3CX]

@tektoneit how long is the Auth ID on the extension for the deskphone you are using ?
Does it meet the criteria that is mentioned in the warning ?

 

[TekToneIT]

@tektoneit how long is the Auth ID on the extension for the deskphone you are using ?
Does it meet the criteria that is mentioned in the warning ?

There is normally no deskphone connected to these extensions. When I add a deskphone, an Auth ID of the correct length is generated and the error goes away, but comes back as soon as I remove the phone from the extension.

 

[NikosT_3CX]

@tektoneit have you created these extensions from the Admin Console or you have imported them via .csv to the PBX ?

 

[TekToneIT]

@tektoneit have you created these extensions from the Admin Console or you have imported them via .csv to the PBX ?

From the admin console.

 

[NikosT_3CX]

@tektoneit I would recommend telling your partner to open a ticket to our support portal so we can check this further.