Securing VirtualMin's Defaults (was Re: [webmin-devel] [Protected Web Directories] Webmin Version: 1.121)

[Martin M. <mm...@ag...>]

Hi Jamie,

Jamie Cameron <jca...@we...> wrote:

>> >> Wish:
>> >> If "UserB:PasswdB" is a non-webmin-admin he should be "chrooted" to
>> >> his ~/. while using this module.
>>=20
>> This should be a deafult behaviour and not to be "patched" afterwards.
>> Isn't that possible?
>
>I could add an ACL option to include the current user's home directory
>.. that would make it easier.

Now that I have looked a little bit more into this I found out that
the same behaviour is in some other modules if you use VirtualMin
which allows some modules by default. So want to start up a talk about
useful default's for Modules.

This is what I did against the defaults

######################################################################

Edited via "Webmin Users"

Global ACL

Root directory for file chooser
	Manually set to "User's home directory"
Users visible in user chooser
	Manually set to "Only Users - fischer"
Groups visible in group chooser
	Manually set to "Only Groups - fischer"

In fact I set it to the User/Group the Directory is set for.

######################################################################

Custom Commands

Can edit module configuration?
	Manually set to "no"

Commands this user can run
	Is it possible to enable another option?
	"Only installed and edited by $user" where $user is
	the Non-Root-User which uses this Module.

In this case a user can setup his own stuff which will be running with
his user credentials and nothing else in the beginning.

######################################################################

=46ile Manager

Access files on server as user
	Manually set to "$username"

Only allow access to directories
	Manually set to "$homedir"

"Include home directory of Webmin user"
and
"Open first allowed directory?"
are active by default.

######################################################################

MySQL Database Server

Login to MySQL as
	Password is shown in Clear-Text!

Backup file directory
	Manually set to "$homedir"

######################################################################

Protected Web Directories (not part of VirtualMin), but would be nice.

Create .htaccess and htusers files as Unix user
	Manually set to "$username"

Allowed directories
	Manually set to "$homedir"

######################################################################

Upload and Download

Can upload and download files as users
	Manually set to "$username"

Can upload and download files to directories
	Manually restricted to "$homedir"

"Include current Webmin user's home directory"
is active by default.

######################################################################

Webalizer Logfile Analysis

I see that I have changed the name of the logfile in the
WebAlizer-Module, but it is not shown here. So the User is editing a
LogFile-Report which does not exist.

######################################################################

It would be nice to have a feature to apply certain settings to all
users (except webmin-admin) via template. So I could setup "my
defaults" and then apply them to a group of users or to a selection of
users.


bis dahin - kind regards

Martin Mewes

--=20
http://webmin.mamemu.de/
Official Webmin/Usermin Translation Co-Ordinator 2003/2004
Proud Agent 2.0 Beta Tester