0

I use Ubuntu server 16.04 on which I base my Apache server environment. I have installed CSF-LFD to filter almost all ports in the machine:

# Setup CSF-LFD:
cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
sed -i 's/TESTING = "1"/TESTING = "0"/g' /etc/csf/csf.conf
csf -r
perl /usr/local/csf/bin/csftest.pl
# cd /etc/csf && sh uninstall.sh

I then installed Webmin and unfiltered its native port (10000) which was filtered by CSF-LFD from before:

cat << EOF >> /etc/apt/sources.list

deb http://download.webmin.com/download/repository sarge contrib
EOF
cd /root
wget http://www.webmin.com/jcameron-key.asc
apt-key add jcameron-key.asc
sudo apt-get update
apt-get install webmin -y
sed -i 's/ssl=1/ssl=0/g' /etc/webmin/miniserv.conf
sed -i 'TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995"/TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,10000"/g' /etc/csf/csf.conf
service csf restart
/etc/init.d/webmin restart

Yet I just can't access it: When I go to http://my_ip:10000, I fill in the username and password, click login, and the page just refresh for about 0.25 second. I can repeat this process up to 5 times till I'm blocked for 1 minute.

I've already installed Webmin several times on VPSs and never had this problem in which I try to login and the login fails, with no error, anywhere (or thus it seems to me).


This situation is quite wired, because:

.1. I made sure I insert the correct password (I checked that in about 5 different occasions).

.2. I Checked from several browsers after total browser cache-flush: It's not a browser Cache issue...

.3. Not only I can go to the login screen when http://my_ip:10000 without probelm, Port 10,000 is LISTEN, so it's quite certainly not a CSF-LFD issue. See:

root@ubuntu-2gb-fra1-01:/var/webmin# netstat -an | grep :10000
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN
udp        0      0 0.0.0.0:10000           0.0.0.0:*

.4. Apache error log shows no webmin-related errors:

root@ubuntu-2gb-fra1-01:/var/webmin# tail /var/log/apache2/error.log
[Mon Nov 21 01:13:20.984586 2016] [mpm_prefork:notice] [pid 22959] AH00171: Graceful restart requested, doing restart
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
[Mon Nov 21 01:13:21.040358 2016] [mpm_prefork:notice] [pid 22959] AH00163: Apache/2.4.18 (Ubuntu) configured -- resuming normal operations
[Mon Nov 21 01:13:21.040376 2016] [core:notice] [pid 22959] AH00094: Command line: '/usr/sbin/apache2'
[Mon Nov 21 01:13:25.730236 2016] [mpm_prefork:notice] [pid 22959] AH00169: caught SIGTERM, shutting down
[Mon Nov 21 01:13:40.492172 2016] [mpm_prefork:notice] [pid 1720] AH00163: Apache/2.4.18 (Ubuntu) configured -- resuming normal operations
[Mon Nov 21 01:13:40.495566 2016] [core:notice] [pid 1720] AH00094: Command line: '/usr/sbin/apache2'
[Mon Nov 21 07:06:27.483595 2016] [mpm_prefork:notice] [pid 1720] AH00169: caught SIGTERM, shutting down
[Mon Nov 21 07:06:28.568672 2016] [mpm_prefork:notice] [pid 7745] AH00163: Apache/2.4.18 (Ubuntu) configured -- resuming normal operations
[Mon Nov 21 07:06:28.568778 2016] [core:notice] [pid 7745] AH00094: Command line: '/usr/sbin/apache2'

.5. Apache access log shows no webmin-related errors:

root@ubuntu-2gb-fra1-01:/var/webmin# tail /var/log/apache2/access.log
80.246.133.215 - - [21/Nov/2016:20:46:37 +0000] "GET /icons/ubuntu-logo.png HTTP/1.1" 200 3624 "http://46.101.188.112/" "Mozilla/5.0 (Linux; Android 7.0; Nexus 5X Build/NBD90W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Mobile Safari/537.36"
80.246.133.215 - - [21/Nov/2016:20:46:38 +0000] "GET /favicon.ico HTTP/1.1" 404 505 "http://46.101.188.112/" "Mozilla/5.0 (Linux; Android 7.0; Nexus 5X Build/NBD90W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Mobile Safari/537.36"
46.59.140.166 - - [21/Nov/2016:22:06:26 +0000] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Safari/537.36"
46.59.140.166 - - [21/Nov/2016:22:06:27 +0000] "GET /icons/ubuntu-logo.png HTTP/1.1" 200 3623 "http://46.101.188.112/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Safari/537.36"
92.247.83.67 - - [21/Nov/2016:23:18:05 +0000] "GET / HTTP/1.0" 200 11595 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
199.241.190.169 - - [21/Nov/2016:23:30:27 +0000] "PROPFIND /webdav/ HTTP/1.1" 405 569 "-" "WEBDAV Client"
36.230.254.210 - - [22/Nov/2016:00:26:57 +0000] "CONNECT 163mx02.mxmail.netease.com:25 HTTP/1.0" 405 546 "-" "-"
54.206.114.46 - - [22/Nov/2016:01:11:03 +0000] "GET / HTTP/1.1" 200 3488 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
212.83.181.85 - - [22/Nov/2016:03:04:27 +0000] "GET http://www.stilllistener.com/checkpoint1/test2/ HTTP/1.1" 404 520 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
213.57.101.253 - - [22/Nov/2016:03:16:13 +0000] "GET / HTTP/1.0" 200 11595 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"

.6. Webmin miniserv log give no clear error:

root@ubuntu-2gb-fra1-01:/var/webmin# tail /var/webmin/miniserv.error
[21/Nov/2016:01:13:42 +0000] PAM authentication enabled
[21/Nov/2016:07:06:41 +0000] [000.000.000.000] /session_login.cgi : Access denied for 000.000.000.000. The host has been blocked because of too many authentication failures.
[21/Nov/2016:07:50:24 +0000] [000.000.000.000] /session_login.cgi : Access denied for 000.000.000.000. The host has been blocked because of too many authentication failures.
[21/Nov/2016:16:23:46 +0000] miniserv.pl started
[21/Nov/2016:16:23:46 +0000] Using MD5 module Digest::MD5
[21/Nov/2016:16:23:46 +0000] PAM authentication enabled
[21/Nov/2016:20:33:02 +0000] miniserv.pl started
[21/Nov/2016:20:33:02 +0000] Using MD5 module Digest::MD5
[21/Nov/2016:20:33:02 +0000] PAM authentication enabled
[22/Nov/2016:03:05:03 +0000] [000.000.000.000] /session_login.cgi : Access denied for 000.000.000.000. The host has been blocked because of too many authentication failures.

Notes:

  1. Even though /etc/webmin/config already includes log=1. Both locate webmin.log or find / -type f -name webmin.log 2>/dev/null, so I can't use that particular file to further debug.

My question:

If the software is installed in the conventional way, port 10000 is opened, and no clear error is seen anywhere (or thus it seems to me), what else can prevent a user from logging to Webmin in this case?

0

Naturally, Webmin uses your Unix users as its own users (that includes root). Yet, it seems Webmin didn't use the non-root work user I created in Unix for some reason, maybe it was due to a typo or corrupted pasting of a ready password, back when I created my Unix non-root work user. So basically there are 2 ways to solve this problem.

Way 1 - Using the root user:

If you want to use your Unix root user to operate in Webmin just create a password for it if you haven't already, and login with it.

Note that in some cases, some people don't create a root password and hence when logging in with SSH keys, they can't do some password-requiring operations with root, like logging in to Webmin, and they might wonder why... In this case, all is required is creating a root password in Unix, via:

passwd root

Create a password and you're good to go. Now try to login with Webmin.

Way 2 - Using a non-root user:

If you created a non root work user (with a password) just try to login with it. It should work. If it doesn't work, try this:

Create a Webmin user:

/usr/share/webmin/changepass.pl /etc/webmin [user] [[password]

In [user] and [password] just type the desired username which is identical to my Unix non-root work user (you can also just type there root) and a password without brackets.


My opinion on which way to choose:

  • If you are the only person who uses the server, I see no reason, not to pick way 1... It is indeed a best practice to work in Unix from a non root work user, but I'm not sure it's always a best practice in all that has to do with Webmin; I personally use Webmin as root in my own servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.