Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am really surprised at this behavior. In Virtualmin, I can see the password for any SSH user by clicking the "(Show..)" link next to the "Password ( ) Leave unchanged" option in a variety of locations. I have found that the passwords for all users including users with SSH access are stored in cleartext files in /etc/webmin/... This seems like an unnecessary risk! How can I prevent Virtualmin from storing passwords in this manner?

share|improve this question

closed as off-topic by HopelessN00b Jan 14 '15 at 1:36

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

Is this just not possible? I am shocked. – Josh Mar 19 '10 at 12:35
never underestimate the stupidity of programmers – The Unix Janitor Mar 20 '10 at 15:03
This question appears to be off-topic because it is about working with a service provider's management interface, such as cPanel. – HopelessN00b Jan 14 '15 at 1:36
up vote 4 down vote accepted

The last release of Virtualmin (3.88.gpl) has the feature "Hashed password storage"

So it's now possible:

Hashed password storage

Storage of plaintext passwords for virtual servers and mailboxes can now be disabled on a per-template basis. Virtualmin will instead store only hashed passwords in multiple formats, which prevents passwords from being compromised if the system is hacked. This feature should ideally be enabled before any virtual servers have been created.

share|improve this answer
Awesome, thanks! – Josh Sep 25 '11 at 15:13
this is an option when you install/setup, but by enabling it you loose the ability to view the servers password. i like this as my passwords are randomly generated and not used anywhere else, therefore no loss if compromised. – Hayden Thring Jan 17 '13 at 10:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.