0

Originally asked this here but I think it was the wrong site.

I have got webmin installed on my Ubuntu. What would be the best way of adding an additional password layer like via .htpasswd file?

So far I have tried placing .htaccess & .htpasswd in /etc/webmin folder but it doesn't seem to be picking up from there.

Improve this question
2
  • Webmin is self-hosted. It does not use Apache httpd. If you feel Webmin is insecure, don’t use it.
    – Daniel B
    Jun 2, 2018 at 17:07
  • @DanielB By self-hosted, I think you mean has it's own server. That's actually quite helpful. It's not about what I 'feel', just don't think there's any need to expose a powerful tool to attacks. I might use it's restrict access to IPs feature.
    – Anon
    Jun 3, 2018 at 1:09

1 Answer 1

Reset to default
0

As comments replied, Webmin doesn't use Apache but miniserv, so creating a .htpasswd will not have the intended effect.

If you use Cloudflare, you can protect Webmin page(s) with a CF worker emulating a htpasswd behavior. See https://www.maxivanov.io/how-to-password-protect-your-website-with-cloudflare-workers/

I also agree that regardless of feelings, it's worth adding an extra layer of security if your webmin auth page is public. Webmin (< 2.0) had a severe vulnerability with password resets (https://www.cvedetails.com/vulnerability-list/vendor_id-358/Webmin.html). Webmin (> 2.0) shows unwanted behavior in the auth process, like sending "Login to Webmin failed" notifications when it succeeded.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.