Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I'm in File Manager of Webmin, I can double click and see the codes of the files in a new tab in Firefox with its specific URL.

But when I remove ?rand=xxxx... after the file.php and paste the URL in Chrome browser, I still can see the codes.

This is the URL I just pasted in the Chrome browser

http://xxx.xxx.xxx.xxx:10000/file/show.cgi/var/www/html/mysite.com/files/file.php

And then I logout of webmin and I change the file.php with other file, I can see the codes.

Is Webmin safe? How do I secure it?

share|improve this question

5 Answers 5

The ?rand= is a cache breaker. It is a random string appended to the url to make sure the page you receive is not cached. Your session/login information is maintained in the browser through cookies and is unaffected by the value of ?rand=.

When you removed the ?rand= portion, you only removed the cache breaking feature from your requests, though, most browsers won't cache this. I believe IE 6 out of the box used to cache the responses a little too aggressively which is why they introduced that fix.

share|improve this answer

Your webmin is fine. I'm sure this is all related to session information stored in the database that webmin uses.

Your server is as about as secure as you make it. While webmin takes a lot of the load off of you to secure your system, it's still prudent to "do it the long way" and check your logs from time to time.

Keyword here for webmin is "web" which means info is both stored on your browser as cookies, but also on your server as session data. Also, if you use SSL for webmin (which you should, imho), then all your data is encrypted at however many bits your SSL certs are encrypted at.

share|improve this answer

Webmin is a tool for you to use to administer your server. You should only allow it to be accessed by server admins. Think of it like FTP/SSH access -- it allows people to access your server and make changes to the files contained on it.

The file manager in Webmin provided the same functionality as FTP access. Just as you see the PHP code of your files using FTP, you will see them with Webmin. Does that make sense?

share|improve this answer

If you are using webmin gpl you can look at the source and see if its safe for yourself (as well as asking here for others opinions). If it's webmin pro you can call support and verify that you haven't found a bug.

share|improve this answer

one way you could remove your stored session from the equation here is to try navigating directly to that URL from a computer that hasn't been logged into Webmin before. If you can still access the file then you may have a problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.