1

When I'm in File Manager of Webmin, I can double click and see the codes of the files in a new tab in Firefox with its specific URL.

But when I remove ?rand=xxxx... after the file.php and paste the URL in Chrome browser, I still can see the codes.

This is the URL I just pasted in the Chrome browser

http://xxx.xxx.xxx.xxx:10000/file/show.cgi/var/www/html/mysite.com/files/file.php

And then I logout of webmin and I change the file.php with other file, I can see the codes.

Is Webmin safe? How do I secure it?

1

5 Answers 5

5

The ?rand= is a cache breaker. It is a random string appended to the url to make sure the page you receive is not cached. Your session/login information is maintained in the browser through cookies and is unaffected by the value of ?rand=.

When you removed the ?rand= portion, you only removed the cache breaking feature from your requests, though, most browsers won't cache this. I believe IE 6 out of the box used to cache the responses a little too aggressively which is why they introduced that fix.

1

Your webmin is fine. I'm sure this is all related to session information stored in the database that webmin uses.

Your server is as about as secure as you make it. While webmin takes a lot of the load off of you to secure your system, it's still prudent to "do it the long way" and check your logs from time to time.

Keyword here for webmin is "web" which means info is both stored on your browser as cookies, but also on your server as session data. Also, if you use SSL for webmin (which you should, imho), then all your data is encrypted at however many bits your SSL certs are encrypted at.

0

Webmin is a tool for you to use to administer your server. You should only allow it to be accessed by server admins. Think of it like FTP/SSH access -- it allows people to access your server and make changes to the files contained on it.

The file manager in Webmin provided the same functionality as FTP access. Just as you see the PHP code of your files using FTP, you will see them with Webmin. Does that make sense?

0

If you are using webmin gpl you can look at the source and see if its safe for yourself (as well as asking here for others opinions). If it's webmin pro you can call support and verify that you haven't found a bug.

0

one way you could remove your stored session from the equation here is to try navigating directly to that URL from a computer that hasn't been logged into Webmin before. If you can still access the file then you may have a problem.