Re: [webmin-l] Webmin security issue

[Michael H. <mi...@hu...>]

Waleed - 

Under Webmin .. Webmin Users select one of your users and then go back
to "Available Webmin Modules". 

Find Filemanager, you'll see it is a clickable link.  Click it - in
there you can restrict access to particular folders, "Allow access to
directories". 

Also change "Can Edit Configuration Module?" to No. Scroll down near the
bottom to "Access Files As Unix User".  The default may be root.  Choose
either the Webmin User, or a unix user you want. 

You may need to go into "Permissions For All Modules" to further
restrict access to user/group selection, etc. 

Cheers! 

mph

On 2017-04-24 04:09, Waleed Alsanie wrote:

> I deleted the users from the sudoers group. I granted then an access to the File Manager module in webmin, and the surprise is that they still can access other users's files including .profile and everything which they cannot access through the ssh! 
> 
> On Mon, Apr 24, 2017 at 1:26 AM, Andrey Repin <anr...@ya...> wrote:
> 
>> Greetings, Waleed Alsanie!
>> 
>>>> Sudo-capable users having full root access in Webmin is expected ..
>>>> because they can run any command as root when logging in via SSH,
>>>> there's no security risk to them having root access in Webmin as well.
>> 
>>> Thanks Jamie,
>>> But they do not login via SSH.
>> 
>> Doesn't matter.
>> 
>>> We installed Webmin to allow them to use it instead of ssh.
>> 
>> Then let them use it. Why you're using wrong tools and demand them to work in
>> the "right way"?
>> 
>>>> The first question is WHY these users have sudo access in first place?
>>> We want them to manage some activities in the server
>> 
>> So, DO THAT. Don't substitute one (system sudo) for another (webmin
>> permissions).
>> 
>> --
>> With best regards,
>> Andrey Repin
>> Monday, April 24, 2017 01:25:13
>> 
>> Sorry for my terrible english...
>> 
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> -
>> Forwarded by the Webmin mailing list at web...@li...
>> To remove yourself from this list, go to
>> http://lists.sourceforge.net/lists/listinfo/webadmin-list [1]
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot 
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
 

Links:
------
[1] http://lists.sourceforge.net/lists/listinfo/webadmin-list