Grandstream HT801 ATA

[#1]

There’s a lot of good information about the Grandstream HT801 ATA in these forums but the one thing I have not seen mentioned anywhere is passwords. 

I have obviously changed the Grandstream’s admin password but there are two other passwords within the config that can be changed and I’d be grateful if anyone on here could give me some idea what they are.  These are New End User Password & New Viewer Password and appear at the top of the Basic Settings page.

I did post the above on another thread but I think that was past it’s sell by date and was no longer attracting many readers…  

Members on here have been very helpful in my migration to HTTP and VoIP for which I'm grateful.

[#2 · Accepted solution]

@PNnewbie I believe there are three levels of access to the Web GUI on the HT series.

username admin - has access to all configuration pages and can change all values

username user - has access only to the basic settings pages (not sure exactly what they are?)  but can change values on those pages

username viewer - has access to all configuration pages BUT can not change anything

AIUI the New End User Password refers to the password for the user account, the New Viewer Password refers to the password for the viewer account.

[#3]

MisterW - thanks for that. 

I've read your post a few times and I 'think' I understand - though not too sure....

After I log into the ATA using my Admin password I can look under Status, Basic Settings, Advanced Settings and FXS Port.  I was able to change System Ring Cadence which appears in the Advanced Settings without inputting a password.  So does this mean that the ATA comes without any of these two passwords set?   

Under Basic Settings it is possible to set both the passwords – New End User & New Viewer but nowhere does it actually ask for a password.

I’m obviously concerned as when using VoIP security can be an issue and I do not want a hacker gaining access to my ATA and running up a bill for me! 

Thanks again.

[#4]

@PNnewbie I dont actually have a HT so I'm working from the admin guide here https://documentation.grandstream.com/knowledge-base/ht80x-administration-guide/

From that , it appears that

EITHER

the login screen probably defaults to a username of admin BUT that you can enter user or viewer as the login name and then use the passwords set for those additional usernames

OR

you dont enter a username but that it detects the password you enter as being for a particular user i.e if you enter the password for viewer then you get that level of access

[#5]

@PNnewbie

The Web UI Access Level Management is tabulated on page 9 of the admin guide https://documentation.grandstream.com/article-categories/ht8xx-series.

It states that default passwords are set for these users.

You may also disable the 'end user', and 'viewer' level access in the advanced setup tab, as depicted at the top of page 10.

Not sure why these two accounts have been added to the system, but at least they can be disabled.

Regards,

Alistair

[#6]

Moderator's note:
Thread moved from Home Phone to Tech Help

[#7]

MisterW/ 

"...the login screen probably defaults to a username of admin BUT that you can enter user or viewer as the login name and then use the passwords set for those additional usernames..."

That could make sense.

I've changed the passwords for the user and viewer accounts but I can only access config using admin and the appropriate password.

"...you dont enter a username but that it detects the password you enter as being for a particular user i.e if you enter the password for viewer then you get that level of access..."

I'll try that later.

SO, I'm not much the wiser!  Two things I've noticed - I can't change the passwords back to the original as obviously they do not have enough letters/figures (they were originally viewer & 123).  One good thing maybe is that I seemed to be able to log in using user or viewer with the original passwords.  That obviously means that even if the admin password had been changed hackers could presumably get in via one of the two other accounts... 

archerry - thanks for your input as well.  Like you I'm not too sure why they need three passwords.

[#8]

---

@PNnewbie wrote:

I’m obviously concerned as when using VoIP security can be an issue and I do not want a hacker gaining access to my ATA and running up a bill for me! 

Thanks again.

---

Unless you've exposed your ATAs web interface to the outside world (by port forwarding), which I suspect isn't recommended, then for a hacker to get access to your ATA they'd have to be on your internal network. This is quite unlikely.

You should be more concerned about the security around your VoIP providers account as that is more likely to be compromised than your ATA. 

[#9]

MisterW - "...you dont enter a username but that it detects the password you enter as being for a particular user i.e if you enter the password for viewer then you get that level of access..."

I'll try that later.

I've changed the user and viewer passwords this morning but the only way I can access the ATA is by signing in as admin with the new admin password I created a few days ago.   The login screen will only allow a certain number of attempts, 5 I think, then it won't allow any more for 15 minutes so trying various things can take a while...  Access by the user and viewer can be turned off in the config but I've checked and these are actually on so I can't pretend to understand what's happening...

Not the end of the world but I'd like to know what's happening.

[#10]

Having been doing some more tests with the Grandstream HT801’s interface, it appears that the user and viewer level passwords require three ‘character classes’ – letters/figures/capitals.  I’d set the user and viewer passwords with four classes – also including a special character.  Now while the interface explains exactly what is required for the admin password it does not go to such detail about the user and viewer passwords.   

Having set up the user and viewer passwords using three character classes I can now gain access to the three levels – admin, user and viewer – using the appropriate user name and password.  

So it starts to make more sense now – I think.  However all levels of access appear to give access to all four web pages, whilst the Grandstream paperwork suggest different levels of log in allows access to different pages.  I need to do some more tinkering but I suspect that whilst everything there can be viewed by anyone who can access the pages only admin can actually make changes.

Purely academic really as I have now blocked user and viewer access.

Be aware that you are only allowed 5 attempts to access the interface and that if you exceed the five attempts you will be locked out for 15 minutes.  Nothing appears in the password boxes so type carefully!