Today I needed to find some specific info about my FreePBX setup, so I used Google to find it.
Guess what… Within 2 minutes I found five (yes 5) 100% open FreePBX setups!
(I’m sure that I can find more if I want to.)
C’mon… They did not even have the default admin password set!
Is it me who is paranoid about my system security, or are the owners who own the open FreeBPX setups just stupid?
Maybe the next release of FreePBX should have somekind of notepad in it for users who can access the open system to add a note saying something like “Hey you wannabe admin… You are an idiot… Fix your system”
So… How do I send a PM from here?
OK guys, the rest of this discussion is in PM ONLY!!! until the sites that we found are notified!!
I did say precoffee… I agree this should live in PM.
So… where are the PMs ?
…crickets…
Hardly a no no. Although, pre coffee request… you should PM me.
And just to be clear, I am listed as a contributor and am also a support engineer and work with the Developers testing and seeking out ways to make everything more secure.
So, I am leaning towards legit request for info…
I would love to mail the owner, but how do I get the email address from the user(s) if I only have an IP nr?
I’m not going to call the owner (even as I see his nr in the Trunks)
What search terms did you use ?
Yeah… right… hmmmm… Thats a no no… Even if you are a contributor.
Sorry.
I found a lot when I searched and a couple without passwords. I am mailing those that I found open to alert them. I suggest that you do that also localhost.
I have the same love-hate relationship with FreePBX. It is the product I install on my clients machines because it is simply more convenient than editing the .conf files by hand. It does nothing to temper the frustration from clients who are “interested” but have been burned by poor performance, toll theft, security breaches or failed hardware because some guy found the ISO and decided it was a business opportunity. All of us in this thread have enough experience to know what we are doing but I am surprised how many people do not.
I wish there was a certification test or something that I could point to showing I know what I am doing. Of course even if such a certification existed most clients would have no idea what it meant and why it is valuable.
Your wish may be granted sooner than you think. I can’t say more at this time.