Community Hub0 Subscribers
Community hub
Webmin
View on Wikipediafrom Wikipedia
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
| Webmin | |
|---|---|
 | |
| Developers | Jamie Cameron Ilia Rostovtsev and the Webmin community[1] |
| Initial release | October 5, 1997 (version 0.1) |
| Stable release | 2.520[2]  (2025-10-04; 23 days ago) [±] |
| Repository | |
| Written in | Perl |
| Operating system | Linux (RHEL, Fedora, CentOS, AlmaLinux, Rocky Linux, Oracle Linux, Debian, Ubuntu), FreeBSD, OpenSUSE and other Unix-like operating systems[3][4] |
| Available in | English, and other 41 languages[5] |
| Type | Control panel |
| License | BSD 3-clause "New" or "Revised" License |
| Website | www |
Webmin is a web-based server management control panel for Unix-like systems. Webmin allows the user to configure operating system internals, such as users, disk quotas, services and configuration files, as well as modify and control open-source apps, such as BIND, Apache HTTP Server, PHP, and MySQL.[6][7]
History
[edit]Webmin, developed by Jamie Cameron, was first released as version 0.1 in October 1997. It was initially created while Cameron was administering a DNS server and needed a user-friendly interface that would allow users to modify DNS records without granting them root access to the server.[8] Over time, various themes, a dashboard that displays CPU, RAM, and disk space usage with visual gauges, and a sidebar with a search function were also added.[9]
Financial support for the Webmin project came from the Linux distribution companies Caldera and MSC Linux, as well as many user contributions of code patches, hundreds of modules, language translations, and user suggestions.[8]
In 2019, a backdoor was discovered which would allow a remote attacker to execute malicious commands with root privileges on the machine running Webmin. This backdoor exploit was present on versions 1.882-1.921, when a network admin would enable the password expiration policy. Developers of Webmin believed that the backdoor being introduced was the result of a malicious injection to the code via the online source code repository SourceForge.[10]
Since its release, the Webmin user interface, its appearance, and its many features have changed dramatically using code that has been completely rewritten over the subsequent versions. This includes the overhaul brought by Webmin 2.0, which enforced strict HTTP Strict Transport Security policy for SSL, and gave options to users upgrading from older versions.[11][12]
General description
[edit]Webmin is largely based on Perl, running as its own process and web server. It defaults to TCP port 10000 for communicating, and can be configured to use SSL if OpenSSL is installed with additional required Perl modules. Webmin is built around over 110 standard modules, which have an interface to the configuration files and the Webmin server, which makes it simple to add new functionality. Due to Webmin's modular design, it is possible for anyone who is interested to write plugins for desktop configuration. Webmin allows for controlling many machines through a single interface, or seamless login on other Webmin hosts on the same subnet or LAN.
Webmin is released under the BSD license.
If a plugin for certain tasks is not available, it is possible to open a terminal and perform various tasks through a command line interface (CLI). This is especially useful if using SSH (or similar) is not an option.
Inclusion in distributions
[edit]While Webmin was included in the official repositories of some Linux distributions (Debian and Ubuntu), it was removed from those because Webmin was not compatible with the way that the distributions' packages handled configuration files and caused unexpected issues with systems.[13]
Related software
[edit]Webmin can be expanded by installing modules,[7] which can be custom made. Aside from this, there are two other major projects that extend the functionality of Webmin:
- Usermin presents and controls a subset of the features available in Webmin, such as webmail and other user-level tasks, rather than administrator-level tasks.
- Virtualmin, which is a web hosting control panel. Virtualmin enables users to host websites under domains, and gives the server admin and the end user a simple interface for managing their websites.
Webmin released Minecraft Server Module 1.0 in January 2013, and version 1.1 in March 2013. The module presents a very basic GUI for server administration. The Webmin Minecraft server is free and open source with no limitations on simultaneous players.
See also
[edit]References
[edit]- ^ "Introduction to Webmin". Webmin. Retrieved 11 February 2007.
- ^ https://github.com/webmin/webmin/releases/tag/2.520.
{{cite web}}: Missing or empty|title=(help) - ^ "Webmin Installation". Webmin. 2 October 2017. Retrieved 7 October 2018.
- ^ "Installation - Webmin Documenation". webmin. Archived from the original on 2022-10-01. Retrieved 2021-12-21.
- ^ "Supported Languages". Webmin. 2 October 2017.
- ^ Federico Kereki (2008-04-01). "Graphic Administration with Webmin". Linux Journal. Retrieved 2014-04-08.
- ^ a b Shawn Powers (July 2012). "Webmin—the Sysadmin Gateway Drug". The Open-Source Classroom. Porky.linuxjournal.com. Archived from the original on 2014-04-08. Retrieved 2014-04-08.
- ^ a b "Introduction - Webmin Documentation". doxfer.webmin.com. Retrieved 2023-05-01.
- ^ Contributor, Inmotion Hosting (2021-12-02). "What is Webmin and Why Use it?". InMotion Hosting Blog. Retrieved 2023-05-01.
{{cite news}}:|last1=has generic name (help) - ^ "Backdoor found in Webmin, a popular web-based utility for managing Unix servers". ZDNET. Retrieved 2023-05-19.
- ^ "Webmin 2.0 Released For Open-Source Web-Based Server Management/Administration". www.phoronix.com. Retrieved 2023-05-19.
- ^ Kocher, Laveesh (2022-08-24). "Webmin 2.0 Is Now Available For Open Source Web-Based Server". Open Source For You. Retrieved 2023-05-19.
- ^ Ubuntu documentation Webmin
External links
[edit]Webmin
View on Grokipediafrom Grokipedia
Introduction
Overview
Webmin is a web-based system administration tool designed for Unix-like operating systems, providing a graphical interface to manage server configurations and services. It enables administrators to handle operating system internals such as user accounts, disk quotas, services, and configuration files, as well as common applications including Apache web servers, BIND DNS, PHP interpreters, and MySQL databases.[1][6] Technically, Webmin is implemented in Perl and operates as a web server listening on TCP port 10000 by default, allowing remote access via a standard web browser. It incorporates support for SSL/TLS encryption to secure communications, including features like HTTPS, HSTS, and integration with SSL certificates. Additionally, Webmin is multilingual, with translations available in 43 languages to accommodate diverse users worldwide.[1][7][6] The tool's initial release occurred in October 1997 with version 0.1, and as of November 2025, the latest stable version is 2.600, released on November 9, 2025. Webmin is distributed under the BSD-3-Clause open-source license, which permits free modification and redistribution for both commercial and non-commercial purposes, fostering a community-driven development model. Its modular architecture allows for extensibility through add-on modules, enhancing its adaptability to various administrative needs.[8][5][6]Licensing and Availability
Webmin is released under the BSD-3-Clause license, which permits free use, modification, and distribution of the software for both commercial and non-commercial purposes without any warranty.[6] This permissive open-source license imposes no restrictions on commercial applications, allowing users and organizations to integrate or extend Webmin as needed.[9] The software is available for download from the official website at webmin.com, where pre-compiled packages and installation scripts are provided for various systems.[10] Source code is also accessible via the project's GitHub repository, enabling developers to build from source or contribute improvements.[9] Webmin supports a wide range of platforms, including Linux distributions such as AlmaLinux, CentOS, Debian, Fedora, Oracle Linux, Rocky Linux, and Ubuntu, as well as BSD variants, FreeBSD, OpenSUSE, Solaris, and other Unix-like operating systems.[6] Webmin's interface has been translated into 43 languages through volunteer efforts, with human translations covering varying percentages of modules (from 100% for English to partial for others) supplemented by full machine translations.[7] These community-driven internationalization efforts ensure accessibility for non-English speakers, using UTF-8 encoding throughout.[6] Support for Webmin is primarily provided through free community channels, including forums for user questions and bug reports, as well as comprehensive documentation covering installation, configuration, and module usage.[11][12] For those requiring professional assistance, paid support options are available through related projects like Virtualmin, which offers enhanced services in its proprietary edition.History and Development
Origins and Early Releases
Webmin was developed by Jamie Cameron in 1997 as a web-based interface to simplify Unix system administration, initially focused on managing a DNS server by enabling users to edit records without requiring root access.[8] This tool addressed the need for a graphical, remote method to handle configuration tasks on Unix-like systems, reducing reliance on command-line operations.[8] The first public release, version 0.1, appeared in October 1997, marking the beginning of its availability as a downloadable program.[8] From this starting point, Webmin underwent rapid evolution, expanding beyond DNS management to include modules for tasks such as handling Unix users, Samba file sharing, NFS, and Cron job scheduling, thereby broadening its utility for general system administration.[8] Early adoption gained momentum through support from key companies in the Linux ecosystem. Caldera International became the first Linux distribution vendor to integrate Webmin as its standard administration tool, even developing a custom theme for it, while MandrakeSoft (later known as Mandriva) included Webmin as a standard feature in its distributions.[13][14] This backing facilitated its inclusion in several early Linux distributions, helping it reach sysadmins managing home or small company networks.[2] By the late 1990s, Webmin had fully embraced an open-source model, with the software freely available for download and initial positive feedback arriving via user mailing lists.[8] This spurred community growth, as developers worldwide submitted code patches, new modules, translations, and feature suggestions, resulting in over 100 community-created modules that extended Webmin's capabilities.[8]Major Updates and Milestones
Webmin's development in the 2000s focused on refining its core architecture, culminating in version 1.000 released around 2002, which provided a more stable foundation for its modular system and broader adoption among Unix administrators.[15] In 2019, two related but distinct security vulnerabilities were discovered around the same period. One was a command injection vulnerability in password_change.cgi (CVE-2019-15107), allowing unauthenticated remote code execution on the MiniServ web server (default port 10000) by exploiting the "old" parameter, affecting versions 1.882 to 1.921 (with 1.890 vulnerable by default and others if password changes were enabled). Public exploits exist for this vulnerability, including Metasploit modules. Mitigation involves updating to Webmin 1.930 or later, or disabling the ability to change expired passwords.[16][17] The other was a backdoor vulnerability stemming from a supply chain compromise in the build process dating back to 2018 (CVE-2019-15231), which also enabled unauthenticated remote code execution in versions 1.882 through 1.920. Both issues were promptly patched in version 1.930.[18][19] Additionally, older versions (1.800 and below) were susceptible to remote code execution if the Authentic theme was enabled globally and port 10000 was exposed to untrusted networks.[19] In the 2010s, Webmin transitioned its version control to GitHub, facilitating collaborative development and easier access to source code starting around 2017.[9] In the late 2010s, enhancements for modern infrastructure included integration with container technologies via Cloudmin modules that added support for Docker volumes and image management in releases like Cloudmin 9.1 on September 7, 2016, with ongoing updates in subsequent Webmin versions.[20] Version 2.000, released on August 23, 2022, marked a major update by enforcing HTTP Strict Transport Security (HSTS) for SSL-enabled installations, improving HTTP-to-HTTPS redirection, and introducing support for modern user interface themes such as Authentic.[21][22] As of 2025, Webmin maintains an ongoing monthly release cadence to deliver timely updates and fixes, exemplified by version 2.500 on September 4, which added dual HTTP/HTTPS server mode support, compatibility with Dovecot 2.4 and MariaDB 12, and optimizations in the Authentic theme.[4][23] This pattern continued with version 2.510 on September 16, 2025 (bug fixes for modules like BIND DNSSEC handling), version 2.520 on October 4, 2025 (incorporating bug fixes for modules like BIND and Samba, along with updates to third-party integrations and security enhancements), and version 2.600 on November 10, 2025 (further Authentic theme improvements and module updates).[24][25][5]Features and Architecture
Core Functionality
Webmin provides a browser-based web interface for system administration, accessible via HTTPS on the default port 10000, allowing users to manage Unix-like servers locally or remotely without requiring command-line expertise.[26] The interface supports customizable themes to enhance usability, such as the Authentic theme, which offers a modern, Bootstrap-based design with improved visual and structural elements for better navigation and aesthetics.[27] This graphical approach simplifies complex tasks by presenting configuration options through forms, tables, and buttons, reducing the need to edit text files or execute terminal commands manually.[8] At its core, Webmin enables essential system management through built-in tools for handling user accounts via the Unix Users and Groups module, which allows creation, modification, and deletion of users and groups with associated permissions.[8] File system administration is supported by modules that facilitate mounting, unmounting, and configuring storage devices, ensuring efficient disk space utilization.[8] Networking capabilities include configuring IP addresses, DNS servers, routing tables, and interfaces like Ethernet or wireless, all accessible via the Network Configuration module to maintain connectivity and resolve network issues.[28] Service control is handled primarily through the Bootup and Shutdown module, which permits starting, stopping, restarting, or reloading daemons such as Apache web server or SSH for secure remote access, with options to enable services at boot time.[29] Webmin's multi-server capability is facilitated by the Webmin Servers Index (Cluster) module, enabling centralized management of modules, themes, users, and groups across multiple interconnected Webmin servers from a single interface, which streamlines administration in clustered environments.[30] For integration, it includes a built-in Command Shell under the Tools category, allowing execution of non-interactive Unix CLI commands directly in the web UI with output display and history for re-execution, bypassing firewall restrictions on SSH or Telnet.[31] Additionally, scripting automation is supported via the Custom Commands module, which creates web-based interfaces for shell scripts and parameterized commands, enabling automated tasks like file editing with validation while restricting access for security.[32] These features form the baseline of Webmin's operations, complemented by over 110 standard modules for extended functionality.[9]Modules and Extensibility
Webmin's modular architecture enables extensive system administration capabilities through a collection of over 149 official modules, each designed to manage specific server components and services. These modules cover a wide range of tasks, including configuration of web servers such as Apache, databases like MySQL and PostgreSQL, and DNS services via BIND.[33] Each module presents a dedicated web-based interface with forms, tables, and controls tailored to the task, allowing administrators to perform operations like starting/stopping services, editing configuration files, and viewing logs without command-line access.[34] The system's extensibility is a core strength, permitting users to develop and install custom modules to address unique needs. Modules are created using Perl, leveraging Webmin's API for integration with the web interface and underlying system commands; this involves structuring the module as a directory of CGI scripts and library files under the Webmin installation path.[34] Official and third-party modules are available for download from the central repository at webmin.com, where they can be installed directly through the Webmin Configuration module.[33][26] Representative examples illustrate this flexibility: the File Manager module offers a graphical interface for browsing, uploading, downloading, and editing files on the server filesystem, complete with permissions management. The Scheduled Commands module provides tools for creating, editing, and monitoring cron jobs, including a calendar view for timing and output logging. Among third-party contributions, the Minecraft Server module (version 1.1, released in 2013) enables setup and management of Minecraft servers, including player controls and console access.[35] Module updates are handled seamlessly through the Webmin interface, with automatic checks and installations available from the official repository to maintain compatibility with operating system changes and Webmin versions. Administrators can schedule these updates (e.g., daily at a specified time) and receive email notifications, ensuring modules remain current without manual intervention.[26][36]Security Considerations
Webmin incorporates several built-in security mechanisms to protect administrative interfaces and system resources. It mandates SSL/TLS encryption for all communications, configurable through the Webmin Configuration module, where administrators can generate self-signed certificates or integrate custom ones using OpenSSL, ensuring data in transit remains encrypted against interception.[26] Role-based access control (RBAC) is enforced via the Webmin Users module, allowing granular permissions for users and groups to access specific modules while restricting root-level actions for non-administrators.[26] Additionally, integration with firewall tools is supported by allowing port reconfiguration (default 10000) and IP access controls to limit connections to whitelisted addresses or networks, such as 192.168.1.0/24, thereby reducing exposure to unauthorized probes.[26] A notable vulnerability in Webmin versions 1.882 to 1.921 was an unauthenticated remote code execution (RCE) issue tracked as CVE-2019-15107, involving command injection in the password_change.cgi script via the "old" parameter in MiniServ (default port 10000). This backdoor, maliciously inserted through a compromised build server, allowed arbitrary command execution without authentication. Version 1.890 was vulnerable by default, while versions 1.900 to 1.921 required the expired password change feature to be enabled (non-default). Public exploits exist, including Metasploit modules. The vulnerability was addressed in version 1.930 by removing the malicious code and strengthening input validation in authentication scripts. Due to the severity of this and similar issues, port 10000 should never be exposed to the public internet.[16][19] To deploy Webmin securely, administrators should implement strong authentication by integrating with Pluggable Authentication Modules (PAM) or Lightweight Directory Access Protocol (LDAP) for centralized credential management, avoiding reliance on local weak passwords.[26] Access should be restricted using IP whitelisting in the Webmin Configuration module to permit only trusted networks, combined with firewall rules blocking port 10000 from external sources.[26] Regular updates are essential to patch zero-day risks, as Webmin's modular architecture can introduce module-specific exposures if not maintained; enabling automatic security notifications via the Package Updates module aids in timely remediation.[19] Since its release in August 2022, Webmin 2.0 and subsequent versions have introduced enhancements like mandatory HTTP Strict Transport Security (HSTS) enforcement in SSL mode, improved HTTP-to-HTTPS redirection, and support for modern TLS ciphers with OCSP stapling to bolster encryption resilience.[21] Two-factor authentication (2FA) support, configurable with providers like Google Authenticator or Authy through the dedicated module, adds an extra verification layer for logins.[26] Session management has been refined with better timeout enforcement and referer checks to prevent session hijacking.[19] As of November 2025, no major exploited incidents comparable to the 2019 backdoor have been reported post-2020, though vulnerabilities such as privilege escalations (e.g., CVE-2024-12828, fixed in Webmin 2.111) and a host header injection in the password reset feature (CVE-2025-61541, affecting versions 2.510 and below, fixed in later releases) underscore the need for vigilance.[19]Installation and Distribution
Inclusion in Operating System Distributions
Webmin has been integrated into various operating system distributions since its early development, providing administrators with a convenient web-based interface for system management. Historically, it was bundled as a standard tool in early Linux distributions such as Caldera OpenLinux, where it served as the primary administration interface and inspired the development of a custom Caldera theme.[13] Distributions like SUSE and Debian included Webmin in their repositories prior to the 2010s, reflecting its popularity for simplifying tasks like user account setup and service configuration.[37][38] As of 2025, Webmin remains available in the package repositories of several major Linux distributions, including Fedora, CentOS Stream, AlmaLinux, Rocky Linux, Oracle Linux, and openSUSE, often through official setup scripts that enable easy repository configuration and updates via tools like DNF or Zypper.[10][39][40] However, it was removed from the main repositories of Debian and Ubuntu in the mid-2000s due to challenges in maintaining the packages, including compatibility issues with Debian policy on configuration file handling and insufficient maintainer resources to address ongoing updates and security requirements.[41][42] Despite this, users can still install Webmin on Debian and Ubuntu derivatives via third-party personal package archives (PPAs) or the official Webmin repository setup script, which adds the necessary GPG key and sources for APT-based systems.[10][43] In Unix-like systems beyond Linux, Webmin enjoys native package support in BSD variants and Solaris. FreeBSD provides Webmin through its ports collection and binary packages, allowing straightforward installation withpkg install webmin.[44] Webmin can be installed on OpenBSD manually from the source archive, requiring adjustments for certain Perl modules to align with its security-focused environment. For Solaris (including Oracle Solaris), pre-built PKG packages are available from the official Webmin site, supporting installation on legacy and modern versions alike.[10]
The decision to include or retain Webmin in distribution repositories often weighs its benefits for novice administrators—such as graphical management of complex configurations—against the overhead of dependency maintenance, particularly for Perl-based components, and evolving security standards.[41]
Installation Methods
Webmin installation requires a Unix-like operating system such as Linux, BSD, or Solaris, root access for system administration privileges, and Perl version 5.10 or higher as the core runtime environment.[9][10] Webmin includes a built-in mini web server that listens on TCP port 10000 by default, eliminating the need for an external web server like Apache unless specifically configured otherwise; however, an external server can be integrated for advanced setups.[10]Package-Based Installation
The recommended method for most users is installing via the operating system's native package manager after configuring the official Webmin repository, which ensures automatic dependency resolution and easy updates. This approach is supported on major distributions including RHEL derivatives (e.g., Fedora, CentOS, AlmaLinux, Rocky Linux, Oracle Linux), Debian derivatives (e.g., Ubuntu), and FreeBSD.[10] To set up the repository, download and execute the official script:[curl](/page/CURL) -o webmin-setup-repo.sh [https](/page/HTTPS)://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
[sudo](/page/Sudo) sh webmin-setup-repo.sh
sudo dnf install webmin
[sudo](/page/Sudo) yum install webmin
[sudo](/page/Sudo) apt update
sudo apt install webmin --install-recommends
--install-recommends flag ensures optional Perl modules for full functionality are included.[10]
For FreeBSD, update the package index and install directly from ports or binaries:
pkg update
pkg install webmin
Manual Installation
For systems without official packages or custom environments, download the source tarball from the official site and perform a manual setup, which is compatible across Linux, BSD, Solaris, and other Unix-like OSes.[10] Download the latest archive:wget https://www.webmin.com/download/webmin-current.tar.gz
/usr/local/webmin):
tar xf webmin-current.tar.gz
cd webmin-*
sudo ./setup.sh /usr/local/webmin
setup.sh script prompts for configuration details, including the administrative port (default 10000), login name (default root), and whether to enable SSL encryption; it generates a self-signed SSL certificate if selected and installs core Perl dependencies where possible.[10][46] For Solaris specifically, use the PKG format instead:
gunzip webmin-current.pkg.gz
sudo pkgadd -d webmin-current.pkg all
rolemod -K type=normal root.[10]
Post-Install Configuration
After installation, access Webmin via a web browser athttps://your-server-ip:10000, logging in with the root username and the system's root password by default.[10] To set a dedicated Webmin administrator password (recommended for security), run:
sudo /usr/share/webmin/changepass.pl /etc/webmin root newpassword
sudo ufw allow 10000/tcp
[sudo](/page/Sudo) ufw reload
[sudo](/page/Sudo) iptables -A INPUT -p tcp --dport 10000 -j ACCEPT
DBD::mysql) or the system's package manager (e.g., [sudo](/page/Sudo) apt install libdbd-mysql-perl on Debian).[49][50] Always verify downloads with SHA256 checksums provided on the official site to ensure integrity.[10]