Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to install webmin to make server administration tasks on my Ubuntu 10.4 server easier. However I'm very nervious about having that kind of power accessable over the web.

So I want to know how to secure webmin so that it can't be used to comprimise my server.

So far here are my ideas, but I still don't feel comfortable:

  1. Make webmin accessable from only the localhost (how?)
  2. Use SSH tunneling to access the webmin server whenever I need to administrate it

Can anyone help me with instructions on making webmin accessable only from the localhost?

What other ways can I make webmin secure?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

Securing it really depends on how it's being served. But by default it comes with it's own web server. /etc/webmin/miniserv.conf has allow and deny directives. So you can use this to only allow access from the localhost.

Then as you say just ssh in using port tunneling to access it. At that point in theory it would be as secure as your ssh setup is. If someone gains ssh access to your server then you already have issues.

share|improve this answer
    
You mentioned that "Securing it really depends on how it's being served", is there a more secure way of serving it rather than the inbuilt web server? I was thinking of using the inbuilt server so that it was not reliant on the configurations that it will be administrating. –  Josiah May 7 '10 at 3:37
    
I think you're on the right track in securing it now. The only advantage that apache would have over the built in server would probably be more options for authentication and perhaps some ram savings if the server needs to have apache running any ways. But there's a trade off for that. As it also means that if you mess up your apache config you would find yourself unable to access webmin as well. –  3dinfluence May 7 '10 at 13:10
    
To further harden SSH you can use permitopen directives to restrict what ip addresses can forward ports and what ips/ports they can forward to. I believe you can even restrict this per user. –  3dinfluence May 7 '10 at 13:18

How I secured mine:

  • Create a Webmin only user with a unique password. Delete all other webmin users
  • Change the default port
  • Limit access via IP addresses at both the firewall and the webmin panel
share|improve this answer
    
Won't points #2 and #3 be rectified by only allowing localhost access? Is there an additional security benefit to changing the default port (besides obfuscation)? When you say limiting access in the firewall, wont that restrict general access to the server also (visitors to my website)? –  Josiah May 7 '10 at 3:35
1  
#3: Firewalls can do port to IP only rules. Say Webmin is running on port 9665, you can make it so only IP 1.2.3.4 can access your server via port 9665. If 2.2.3.4 tried, they would be denied. –  David Rickman May 7 '10 at 4:38
1  
#2: It's obfuscation, sure. But the bots that would scan it or any "hacker" that scans for it won't find it immediately, they will need a much more broad scan to locate it. Which requires more resources for the bots and more time for the "hacker" –  David Rickman May 7 '10 at 4:40
    
The question is: will I have any better protection using a Firewall port to ip rule than I would if I only allowed access locally and used an SSH tunnel? –  Josiah May 7 '10 at 5:13
1  
SSH will allow for key based authentication only. Which will always be more secure than using username and passwords. However if you restrict the IP addresses that are allowed to access webmin then this may not make much difference. –  3dinfluence May 7 '10 at 13:16

Probably the easiest way to achieve this is to use mod_access to control access to the directory tree that Webmin lives in. Here is a quickstart page on the subject. Here is a second option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.