address restrictions and the use of SSL.
3.1 Network Security
Unless you are running Webmin on a system that is never connected to any other network, it is a wise idea to restrict which client network addresses are allowed to log in. Because Webmin is so powerful, anyone who manages to log in will have total control over your system—as though they had root shell access. Even though a username and password is always required to log in, it is always good to have an additional layer of security in case an attacker guesses (or somehow discovers) your password. IP access control also protects you from any bugs in Webmin that may show up in future that will allow an attacker to log in without a password—some older releases have had just this problem.
To restrict the IP addresses and networks from which Webmin will accept connections, follow these steps:
1. In the Webmin category, click on the icon for the Webmin Configuration module. 2. Click on the icon for IP Access Control. The form shown in Figure 3.1 will appear for
restricting client IP addresses.
3. Select the option Only allow from listed addresses, and enter the IP addresses or host- names of client systems in the text box from which you will allow access. If you want to allow access from an entire IP network, enter the address of the network with 0 for the final octet. For example, if you wanted to allow all clients with IP addresses from
192.168.1.0 up to 192.168.0.255, you would enter 192.168.1.0.
SSL Encryption 15
Networks can also be entered in the standard network/netmask format, like
192.168.1.0/255.255.255.0. You can also grant access from an entire domain by
entering a wildcard hostname like *.foo.com, assuming that reverse IP address resolution has been set up for that domain.
4. When done, click the Save button to apply your changes. Webmin will warn you if the restrictions will prevent the client system on which you are currently running your browser from logging in so you do not accidentally lock yourself out!
3.2 SSL Encryption
If you are accessing your Webmin server over an untrusted network such as the Internet, you should be aware that, by default, an attacker can capture your login and password by listening in on network traffic. This is particularly easy if you are using a non-switched Ethernet network shared by people that you do not fully trust, such as those in offices or universities.
Fortunately there is a solution that is relatively easy to set up—switching Webmin to use SSL so that all network traffic between your web browser and the server is encrypted. The RPM pack- age of Webmin will run in SSL mode by default if the OpenSSL library and Net::SSLeay Perl module are installed. Most systems, however, do not meet these requirements so you will need to follow the steps below to enable SSL:
1. Install the OpenSSL library, if you do not already have it. Most recent Linux distribu- tions will include it as standard, but you may have to install it from your distribution CD.
If there are separate packages for openssl and openssl-devel, make sure both are installed. If your operating system does not come with OpenSSL, you can download it from www.openssl.org/ instead.
2. Install the Net::SSLeay Perl module, if it is not already installed. If your system is con- nected to the Internet, the easiest way to do this is to enter the Perl Modules module of Webmin (under the Others category), enter Net::SSLeay into the From CPAN field and click the Install button.
After the Perl module has finished downloading, click on Continue with install to have Webmin automatically compile and install it.
3. Once both are installed, go to the Webmin Configuration module and click on SSL Encryption. The form shown in Figure 3.2 will appear.
4. On the top part of the page, change the Enable SSL if available? option to Yes, and click Save. If all goes well, Webmin will be switched to SSL mode and your browser will connect to it securely.
5. If this is the first time you have connected to Webmin in SSL mode, your browser will display a warning about the certificate being invalid. For now, you can ignore this warn- ing and choose to accept the certificate. For more details, see Section 3.3 “Requesting a Valid SSL Certificate”.
6. From now on, when logging into Webmin you must use a URL starting with https:// instead of just http://. Once in SSL mode, it will no longer accept insecure connections. 7. Go back to the SSL Encryption page and scroll down to the second form. If a warning
starting with Because you are currently using the default Webmin SSL key… is dis- played, you definitely should continue following these steps to create your own private SSL certificate and key. If, however, it does not appear, then a private key was created at installation time and there is no need to go on reading.
8. If your system is always accessed using the same hostname in the URL, enter it into the Server name in URL field, such as www.example.com. This will cause the generated certificate to be associated only with that hostname. Otherwise select Any hostname to allow the certificate to be used with any URL hostname. This is more convenient, but slightly less secure.
9. In the Email address field, enter your email address—such as [email protected]. 10. If appropriate, fill in the Department field with the name of the department or group
within the organization to which this system belongs, such as Network Engineering. This can be left blank if inappropriate, such as on a home system.
11. In the Organization field, enter the name of the company or organization that owns this system, such as Foo Corporation. Again, this can be left blank if it makes no sense. 12. In the State field, enter the name of the state that your system is in, such as California. 13. In the Country code field, enter the two-letter code for the country in which the system
resides, such as US.
14. Leave the Write key to file field unchanged, and the Use new key immediately field set to Yes.
15. Hit the Create Now button to generate a new key and certificate, write them to /etc/
webmin/miniserv.pem and immediately activate them. Your browser will probably
Requesting a Valid SSL Certificate 17
Older versions of Webmin just used a fixed SSL key that was included as part of the package. This, however, was completely useless for securing network traffic because anyone with a copy of that key can decrypt the data that is supposedly protected with SSL! For this reason, recent Webmin versions create a new private key at installation time if possible, and warn you if the old fixed SSL key is being used.
3.3 Requesting a Valid SSL Certificate
If you want to use a valid SSL certificate and do not have one for your hostname, it is possible to generate one using the openssl command and a certificate authority. A valid certificate is one that is recognized by all browsers because it was signed by a recognized authority. Those created by Webmin itself, by following the steps in Section 3.2 “SSL Encryption”, do not meet this crite- ria and will trigger a warning in all browsers when they connect to the Webmin server.
Unfortunately, certificate authorities charge money for signing and verifying that the owner of the server in the hostname actually matches the company details in the certificate. For this reason, most people do not bother to use a signed certificate with Webmin, as there is no real advantage in security once you have accepted an unsigned certificate into your browser for the first time.
If you do want to obtain a real valid certificate, however, the steps to follow are:
1. At the shell prompt, run the openssl genrsa -out key.pem 1024 command. This will create the key.pem file, which is your private key.
2. Run the openssl req -new -key key.pem -out req.pem command. When it asks for the common name, be sure to enter the full hostname of your server as used in the URL, like www.yourserver.com. This will create the req.pem file, which is the cer- tificate signing request (CSR).
3. Send the CSR to your certificate authority by whatever method they use. They should send you back a file that starts with —BEGIN CERTIFICATE— which can be put in the
cert.pem file.
4. In Webmin, enter the Webmin Configuration module and click on SSL Encryption. 5. In the SSL Encryption form (shown in Figure 3.2), enter the path to your key.pem file
into the Private key file field, and the path to your cert.pem file into the Certificate file field.
6. Click the Save button to switch to the new certificate.
From now on, your browser should no longer display a warning when connecting to Webmin in SSL mode.
3.4 Summary
Securing your Webmin server to prevent unauthorized access is critical, as there are many poten- tial attackers on the Internet who would love to use it to take over your system. This chapter has covered the two different types of security configuration (IP access control and SSL) that should be performed where possible. Because some versions of Webmin have had remotely exploitable security holes, it is also advisable to always upgrade to the latest version as soon as it becomes available to ensure your system's security.
19