Welcome Emails - v20

[Drain Bamaged]

Good Day,

As we cutover to v20 we hit an issue. We can no longer send out a Welcome Email without doing a password reset. This invalidates the config files and QR codes attached to the email (and any past emails) and is reducing our overall security. Let me explain.

We set strong passwords on the extensions when we create them. Something like: Y9RC6=wVJXfL$QxU5 On the old v18 system we could click "Send Welcome Email," the user gets a config file they can drag and drop onto their 3CX and they are up and running with a secure password. The QR code could be used for the mobile app. Worked great.

Now on v20, the user receives a Welcome Email with config and QR code attached, but neither of those files will be accepted because they contain a temporary password. User needs to change that password. As soon as they do, the config file and QR code (with the embedded temporary pw) don't work. We provision using the softphone provision button through the web interface just fine, but the larger concern is that the user can amend Y9RC6=wVJXfL$QxU5 to Password123* (One of our users literally did just that, it was picked up on an audit)

Can you please return the "Send Welcome Email" button to the interface? Place it adjacent to the Reset button so we can choose whether a user password needs to be reset? If a user needs to be set up again (or to add a second device) we can send the regular email without a reset and its a drag and drop affair. They would also have the email with config and QR for future reference.

Due to a merger we're onboarding another 400 users this year so this feature is sorely needed.

Here's a screenshot from a couple of our branch offices.

v18:


v20:





Thank you, have a nice weekend.

 

[SteveITS]

3CX purposefully removed the file/QR info from email (see various other posts). I expect this was for security purposes so someone who got into a mailbox couldn't get access to the 3CX extension. The new way is the user logs in to the web client and clicks the Apps icon.

At any rate a password reset can be done from the login page. The Reset button also disconnects apps. IIRC it used to disconnect desk phones but nowadays the phone should pick up the changed passwords..

 

[fxbastler]

One should restart the phone so it fetches the new configuration before it gets added to the blacklist.

 

[SteveITS]

For the desk phones? In my limited testing it is reprovisioned automatically. This behavior may have changed around v20 update 2-3, I'm not sure.

 

[fxbastler]

For the desk phones?

yes

As far as I can remember from a few such failures last year, the devices were affected, remaining on the blacklist for a while after the extensions were cleared. Since then, we always do it this way as a precaution: log in to the desk phone, reset the extension, and restart the phone. I did this again just yesterday morning as a precaution.

Good to know that this is no longer necessary, I’ll have to give it a try.

 

[Drain Bamaged]

One should restart the phone so it fetches the new configuration before it gets added to the blacklist.

And if this phone is behind an SBC, it does not work. FYI.

 

[SteveITS]

Work…to automatically get the updated password? It worked for me when I tried it a couple months back. Phone stayed connected.

 

[NicholasP_3CX]

Properly provisioned phones should pick up their new password through a reprovisioning.

Password resets should be done by the users themselves, by clicking forgot password. Make it easier on yourselves, let them self help themselves for this particular operation. The "Forgot Password" option will only reset the web client password.