@GeekBoy wrote:
Had a security breach on an extension this morning.
Extension password is a twelve digit alpha-numeric code with a tested working fail2ban process in place.
Thus, brute force intrusion is unlikely.This PBX has about eight extensions, with only one affected. Looking in the logs, they look clean with no usual activity, or access.
In fact the fail2ban log shows zero password failures in the entire log for that extension, except for today when I changed the password and the legitimate phone tried to authenticate.
So it appears the intruder was able to obtain the password someway.
On a note the extension is in private residence, connected to a router, with the voip phone with he default admin/admin credentials in place.
Any ideas?
Thanks
Posts: 2
Participants: 2