Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just installed webmin in my FreeBSD box, now it can be accessed as, When I enter that address in browser I can see the login page of webmin directly. I want to have some additional security by asking username and password to access the login page itself, like that one of .htpasswd, any ideas how to achieve that ?

I know how to use Apache .htaccess or Nginx auth_basic but webmin is not using the web server and was not defined too, so, I am quiet lost how to have that username/password field before letting few IPs access that.

share|improve this question

closed as too localized by mdpc, RolandoMySQLDBA, Michael Hampton, Jay, pauska Mar 27 '13 at 0:29

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

Webmin uses a Miniserv HTTP server, which only has basic IP based allow/deny.

From Webmin FAQ:

How can I change Webmin's list of allowed IP addresses from the shell?

The file you need to modify is /etc/webmin/miniserv.conf , in particular the allow= or deny= lines. If the allow= line exists, it contains a list of all addresses and networks that are allowed to connect to Webmin. Similarly, the deny= line contains addresses that are not allowed to connect. After modifying this file, you need to run /etc/webmin/stop ; /etc/webmin/start for the changes to take effect. Naturally, the file can only be edited by the root user.

It is possible to use Webmin with Apache; See Webmin and Apache. Your best bet would be using Apache/Nginx as a proxy to Webmin's Miniserv - make sure to allow connections to webmin miniserv only from localhost to prevent security breaches. Adding the following line to /etc/webmin/miniserv.conf should achieve that:


Afterwards you can configure additional security prompts or whichever you need the more familiar and configurable Apache/Nginx.

share|improve this answer
thanks for the answer, I don't want to put the webmin overhead to the web-server, so, I was looking if something could be done inwebmin itself. I have used the IP blocking, still I want to have password protection to allowed IPs. Where I work is an umbrella organization which has few public IPs sharing among 150 Organizations and I don't want other table to sneak peak my server. – Jhilke Dai Mar 27 '13 at 0:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.