HELP - Need to know how to find unauthorized access in my MD110!!

[New4thebox]

Hi guys, this is a newbie question:

Our last MD110 administrator has left the company I work for and my manager has put me in charge of its administration. Mi first task was to secure the remote access to the PBX, ¿Any suggestion how can i see the user list available and their privileges? ¿how can i change their password? ¿any ideas?

Thnxs

 

[parnum]

have you any username/password at all to log on with? if you have do IOUAP; for NIU or IOPWP; for IPU.

do you have DNA? log on via MDSupport and do these commands in TTY mode.

best parnum

 

[New4thebox]

Yes i have a username/password to logon, but the username is the former administrator last name, i do not even know which is the admin user. is it admin?

Thanks again

 

[whosrdaddy]

no it is MDUSER

-----------------------------------------------------
What You See Is What You Get
Never underestimate tha powah of tha google!

 

[parnum]

log on and send us IOUAP; and your username and it will tell us the level you log on at. It will not tell us your passwords .
best parnum

 

[New4thebox]

Okey I'll do it this weekend. Thank you very much.

Another thing they just asked my is to see if out director´s ports has been somehow compromised, if they are monitores by other port or somehow recorded to gain access to their conversations. Any idea what should i look into the porst setting to see if there is something unusual?

Thanks again very much guys, you are saving my xxx!!!

 

[parnum]

send us KSCAPIR=x; or EXCAPIR=x; for his extension whichever will work, unless uou have voice recording the only way is silent intrusion and this can be easy to prevent. Unless he is Voip extension maybe?

best parnum

 

[New4thebox]

Hi best parnum. Here is the info. There are no Voip extensions.

The two interns belongs to senior managers, anything unusual?

<kscap:dir=654;
KEY SYSTEM CATEGORY PRINT
DIR TRAF SERV CDIV ROC ITYPE TRM ADC LANG BSEC
7404 00101015 0002120000 001151000 000001 20 0 00100000000000 F 0

END

<excap:dir=511;
EXTENSION CATEGORY FIELDS
DIR TRAF SERV CDIV ROC TRM ADC BSEC
2011 00000015 0002120400 001151000 000001 0 010000000 0

END

THANKS!!!!

 

[parnum]

Hi

if you do

KSCACIR=7404,SERV=0013120000;
EXCACIR=2011,SERV=0013120400;

this will change intrusion level on extensions to priority 3, intrusion permitted from handset, no-one is allowed to intrude. At present both extensions are fully open for intrusion from higher intrusion level (Serv d3+4).

Nobody can listen in with this setting.

best parnum

 

[Monrovia]

thanks for the info best parnum