Re: [webmin-l] Webmin security issue

[Andrey R. <anr...@ya...>]

Greetings, Waleed Alsanie!

>>Sudo-capable users having full root access in Webmin is expected ..
>>because they can run any command as root when logging in via SSH,
>>there's no security risk to them having root access in Webmin as well.

> Thanks Jamie, 
> But they do not login via SSH.

Doesn't matter.

> We installed Webmin to allow them to use it instead of ssh.

Then let them use it. Why you're using wrong tools and demand them to work in
the "right way"?

>>The first question is WHY these users have sudo access in first place?
> We want them to manage some activities in the server

So, DO THAT. Don't substitute one (system sudo) for another (webmin
permissions).


-- 
With best regards,
Andrey Repin
Monday, April 24, 2017 01:25:13

Sorry for my terrible english...