IPO Web services

[karlzre]

Hi,

I saw that log from the ipoffice.
Access to Web Service failed due to incorrect credentials. Web Service: /ws/security/authenticate. Username: Administrator.

What are these web services, what canbe done trough that ?
May a hacker made config changes from there ?
How can i securise it ?

Thx

ACA IPTelephony
ACA IPOffice implement
ACS IPOffice implement

 

[janni78]

It's described a bit on Devconnect.

As long as no one can access your IPO from the internet you should be fine.
You can get some info from the PBX without credentials and make config change with the same account as with Manager.

"Trying is the first step to failure..." - Homer

 

[critchey]

As stated as long as your IP office is not reachable from the public internet you should be ok. I guess it is also possible an employee could enter the IP of your control unit into their web browser and muck around if disgruntled or just bored. As long as you are using a non default Administrator password and have other accounts disabled or changed passwords you shouldn't have to worry about the second scenario.

If you are on the public internet then yes you do need to worry they can make a lot of changes... you should NEVER put your IP office on a public internet without locking it down through a firewall and really knowing what your doing.

The truth is just an excuse for lack of imagination.

 

[karlzre]

The ipo id not connected direcly to the internet.
It s behind à sbc but the source looks to be the customer firewall.

We are checking with customer if there is some natting from this device.

Password is not the default off course.

ACA IPTelephony
ACA IPOffice implement
ACS IPOffice implement

 

[critchey]

So if you are saying that it is in fact connected to the public internet but you have a SBC and firewall in the way it seems like something is not as locked down as you would like.

The truth is just an excuse for lack of imagination.

 

[tlpeter]

I am 90% sure this of a false alarm.
Do you use one-x mobile?
Seems like an authentication error from there.
But if not then secure the sbc more by only allowing avaya equitment.

BAZINGA!

I'm not insane, my mother had me tested!

 

[IPOfficeGuru]

BTW. Web Services on IPO500 are a joke. Takes time to load up once you login, sluggish response at best, limited access to system features. Nothing to see here move along...

"Never fear billing a client for services rendered, or they will think your time is worthless"