3 ms·

One of my servers has Webmin on it, which I rarely use. I'm not sure if deleting it would break anything on the backend so if I were to block the port it uses w

One of my servers has Webmin on it, which I rarely use. I'm not sure if deleting it would break anything on the backend so if I were to block the port it uses with SELinux, would that pretty much alleviate the problem until I was sure that removing it would not break anything? I've already checked the server for any rogue Apache modules and nothing appears out of place. Never mind. There is a stop script.

SwellJoe 14y ago
Removing Webmin will not effect anything on your server, other than removing Webmin. Webmin operates directly on config files (i.e. it doesn't regenerate configs out of a database or anything wonky, like most control panels do), and doesn't tie into anything in any way that would cause other services to stop working. (Virtualmin, on the other hand, does provide a few bits that could be important...if you've used Virtualmin to configure mail, it will rely on scripts that are part of the Virtualmin install to check for spam and viruses, as well as perform autoreply functions.) But, Webmin hasn't had a major remote exploit in years (that we know of). In terms of security risks, I consider Webmin pretty low on the list, because of its good security history (see http://webmin.com/security.html http://webmin.com/security.html for the security history going back several years). It does provide root access, though, which makes it a very valuable target for exploits. As far as we know, Webmin is not implicated as a vector in this particular attack. Plesk has been mentioned as correlated with this attack, but I don't think that's been confirmed, and Plesk has no relation to Webmin, so it seems an odd choice. Source and disclaimer: I am a developer on the Webmin and Virtualmin projects, and co-founder of Virtualmin, Inc.
- lovehashbrowns 14y ago
  Thanks for the info. :) The page I was reading said it was mostly Plesk, but their pastebin file lists Plesk only. I am just covering my bases until everything is known about this. Although it is pretty unfair that I made it seem as if Webmin was specifically identified as having a vulnerability. As a beginner, I'd rather disable Webmin for now. Just in case! But you are correct; Webmin is probably not affected by this.

SwellJoe 14y ago

Removing Webmin will not effect anything on your server, other than removing Webmin. Webmin operates directly on config files (i.e. it doesn't regenerate configs out of a database or anything wonky, like most control panels do), and doesn't tie into anything in any way that would cause other services to stop working. (Virtualmin, on the other hand, does provide a few bits that could be important...if you've used Virtualmin to configure mail, it will rely on scripts that are part of the Virtualmin install to check for spam and viruses, as well as perform autoreply functions.) But, Webmin hasn't had a major remote exploit in years (that we know of). In terms of security risks, I consider Webmin pretty low on the list, because of its good security history (see http://webmin.com/security.html http://webmin.com/security.html for the security history going back several years). It does provide root access, though, which makes it a very valuable target for exploits. As far as we know, Webmin is not implicated as a vector in this particular attack. Plesk has been mentioned as correlated with this attack, but I don't think that's been confirmed, and Plesk has no relation to Webmin, so it seems an odd choice. Source and disclaimer: I am a developer on the Webmin and Virtualmin projects, and co-founder of Virtualmin, Inc.

lovehashbrowns 14y ago
Thanks for the info. :) The page I was reading said it was mostly Plesk, but their pastebin file lists Plesk only. I am just covering my bases until everything is known about this. Although it is pretty unfair that I made it seem as if Webmin was specifically identified as having a vulnerability. As a beginner, I'd rather disable Webmin for now. Just in case! But you are correct; Webmin is probably not affected by this.