#5601 Webmin refuses to start without a root password in PAM

[{16/7}]

https://sourceforge.net/p/webadmin/discussion/600155/thread/5094083b18/

As the subject indicates, a root password that can authenticate via PAM is required in order for webmin to start; as it stands currently, using changepass.pl is insufficient.

Normally, as a security measure, I disable the root password on all my machines whenever possible.

Because webmin runs as root by default, it doesn't seem to me that it should need to further authenticate as root using PAM to perform its functions, just for user logins. Therefore, it would seem that using changepass.pl to give root (or some other arbitrary administrative webmin user) a password should be sufficient to bootstrap webmin.

[Jamie Cameron]

Webmin doesn't necessarily need to a password that can authenticate via PAM for root in order to start. However, you will need to login as either root or a user who can sudo to root , unless you set a separate password with changepass.pl

[{16/7}]

I apoligize, not only should I have provided more details in the submission of my bug report (Webmin 2.010 now, previously 2.001 when I started the thread on the mailing list, on ArchLinux), but I also should have included the steps to reproduce:

$ sudo passwd -d root
$ sudo systemctl start webmin.service
Job for webmin.service failed because the control process exited with error code.
See "systemctl status webmin.service" and "journalctl -xeu webmin.service" for details.
$ journalctl -b
...
systemd[1]: Starting Webmin server daemon...
perl[2981188]: pam_unix(webmin:auth): user [root] has blank password;
authenticated without it
miniserv.pl[2981188]: IPv6 support enabled
miniserv.pl[2981188]: Using MD5 module Digest::MD5
miniserv.pl[2981188]: Using SHA512 module Crypt::SHA
miniserv.pl[2981188]: PAM test failed - maybe /etc/pam.d/webmin does not
exist
miniserv.pl[2981188]: PAM use is mandatory, but could not be enabled!
systemd[1]: webmin.service: Control process exited, code=exited,
status=1/FAILURE
systemd[1]: webmin.service: Failed with result 'exit-code'.
systemd[1]: Failed to start Webmin server daemon.
$ sudo systemctl stop webmin.service
$ sudo passwd
New password:
Retype new password:
passwd: password updated successfully
$ sudo systemctl start webmin.service
$ systemctl status -l webmin.service
...
systemd[1]: Started Webmin server daemon.

Some additional context: Before writing the webmin mailing list, I initially contacted the ArchLinux package maintainer here: https://aur.archlinux.org/packages/webmin and was told to take the matter here.

I have reproduced the problem several times, exactly as indicated above, from the time I made my initial posts to the very moment I write this.

From my point of view, there seem to be 3 components that could be failing: 1. webmin, 2. perl-authen-pam, or 3. ArchLinux. I have even VM'ed a copy of Arch, and reproduced this the exact same way.

I understand what you are saying. So with your confirmation, I am happy take this back to the AUR, since it seems likely that this must be a problem with ArchLinux's default configuration in /etc/pam.d, which means /etc/pam.d/webmin may need to be adjusted to compensate. So if you have nothing else to add, I will do exactly that.

If you would like to verify for yourself before I do so, I can arrange an ssh session to the VM I mentioned previously.

[Jamie Cameron]

Ok it looks like the issue is that the "mandatory PAM" option is enabled, which maybe is done by the Arch Linux package. The fix is to edit /etc/webmin/miniserv.conf and remove the line pam_only=1 , then re-try starting Webmin.

[{16/7}]

Thank you, that did the trick. So not a bug after all.

FWIW, the only Arch-relevant mention I can find about that configuration is this thread, which also suggests setting no_pam=1 and states that it and pam_only=1 are mutually exclusive.

I think the best course of action is for me to consider making my own changes to /etc/pam.d to reflect my own policy and setting pam_only to its default. Unfortunately, I think it can be said that disabling root passwords is an uncommon practice, so supporting it shouldn't be the default. Mandatory PAM is certainly a good idea for those that do use root passwords.

[Jamie Cameron]

We don't usually set pam_only=1 , as this prevents Webmin from using it's fallback behavior of reading /etc/shadow directly. However, the option exists to support systems where PAM imposes additional login requirements that should never be bypassed.

[{16/7}]

Looks like the last line in the setup-post.sh script in the AUR tarball (https://aur.archlinux.org/cgit/aur.git/snapshot/webmin.tar.gz, which triggers spam protection if I attempt to markup a proper link) contains a line which enforces pam_only=1 and no_pam=0 by default, among a few other configs.

[Jamie Cameron]

I'd generally recommend just using the Webmin-supplied packages if you can, as this avoids odd behavior like this introduced by third-party packages.