RE: Webmin Security Questions

[Allan Jensen <aje () callcentereurope com>]

> -----Original Message-----
> From: ATD [mailto:simon () snosoft com] 
> Sent: 24. oktober 2002 20:04
> To: Allan Jensen
> Cc: security-basics () securityfocus com
> Subject: RE: Webmin Security Questions
>
>
> All, 
>       Three points:
>
> 1-) I have seen remote exploits for webmin that grant shell 
> access due to flaws in the scripts that webmin uses.

I haven't seen them, which is why I deemed Webmin somewhat secure. I stand
corrected.
But (thinking aloud) how could it gain shell access when authentication is
required before you get one single page? Could it have been an exploit for
the built-in webserver itself?

> 2-) Webmin requires an httpd to run.  

It comes with its own (quote: "..Webmin consists of a simple web
server..."), but yes,If you are using webmin, then a httpd server will be
running.
There are ways to secure/obscure that; move Webmin to run on another port
and only allow it to be accessed from certain IP addresses (via
iptables/ipchains/ipfw/your favourite packet filter) comes to mind.

> In doing that you open up another service for an attacker to pounce on.

True.

> 3-) Why would a systems administrator rely on a web based 
> administration tool? Shouldn't that administrator understand 
> the inner workings of his or her system. Shouldn't that 
> administrator also be security aware?  

As I was writing; it's a great tool for anyone who's afraid of administering
system via a keyboard. That said, I know of few professional admins who have
that problem.

> Don't get me wrong, webmin does have a place but I do not see it in a 
> network that requires any serious level of security. It would 
> be handy for a test network, or maybe an isolated network 
> behind a few firewalls.  I would not suggest using it on any 
> system directly exposed to the internet though. 

Um, no! I've been deploying it onto a corporate LAN to give my Windows admin
colleagues a way to administer some Linux boxes when I was out of office,
but it was using SSL and was restricted to a few IP addresses. But no Webmin
access was - and should be - allowed from the Internet!


Best regards,
-Allan Jensen