webadmin-list — Webmin users mailing list

Re: [webmin-l] What defines permission for uploaded files if nottheumask

[Marcos R. <we...@al...>]

On Wed, 23 Aug 2006, Jamie Cameron wrote:

> On 23/Aug/2006 22:38 Munzir Taha (=?utf-8?q?=D9=85=D9=86=D8=B0=D8=B1?=  =?utf-8?q?_=D8=B7=D9=87?=) wrote ..
>> On Thursday 24 August 2006 00:32, Jamie Cameron wrote:
>>> On 23/Aug/2006 13:14 Munzir Taha wrote ..
>>
>>> unfortunately Webmin doesn't yet have
>>> an option to set its own umask, but I will add this in future.
>>
>> Good. For now I guess any user can set his own umask by manually editing
>> his .bashrc file which is ok with me.
>
> That wouldn't actually work, as Usermin doesn't process .bashrc.
>
>>>> Also, may I request to add the support of extracting .tar.bz2 files?
>> My
>>>> experience with them they have better compression ratio than .tar.gz
>> in
>>>> general.
>>>
>>> Nice idea ... I will add this to the next release.
>>
>> Great!
>> Also don't forget the support need to be available for updown module, too.
>>
>> BTW: what's the difference between uploading using updown module or file
>> manager? Isn't the functionality unnecessarily duplicated?
>
> Yes .. yes it is :)
>
> - Jamie

mmmmm.... the file manager requires java... and I *think* that the updown 
module does not... ergo... no unnecessarily duplication ;)

Cheers!
Marcos

[webmin-l] doveot, usermin and webmin crashing

[Barry <we...@i1...>]

I seem to be getting a ton of somehow-malformed spam mails which are 
causing dovecot, usermin and webmin to crash.

System is centos 4.3, sendmail, spamassassin 3.0.14.

A side effect is that some mails get caught in the mail queue.

Another side effect seems to be that
some of the spams are making it through to my remote email client 
without X-Spam headers that are put there by spamassassin.

And another side effect seems to be that any sshd shells I have open are 
closed  remotely meaning I have to restart the session (not sshd) each 
time.

I am getting pounded by these spams - only consistent way I can tell to 
identify them is they all are generated by Microsoft Outlook (big 
surprise!).

Anyone know what might be going on?
Is there a way to block them *before* they get to spamassasin? I have 
checked back over a years worth of emails - if I don't get any from 
Outlook Express it will not be any skin off my back.

Best,

Barry

Re: [webmin-l] webmin does not know sendmail status

[Jamie C. <jca...@we...>]

On 25/Aug/2006 11:46 Barry wrote ..
> In both the sendmail server module, and the system and server status 
> module, the status for sendmail is reported incorrectly as down.
> 
> Also, in the server module, clicking ont he start server button doe snot
> seem to do anything.
> 
> System is Centos4.3, latest webmin (1.290).
> 
> Output that shows sendmail is running:
> 
> # ps aux|grep sendmail
> root     11849  0.0  0.5 28844 3052 ?        SNs  13:42   0:00 sendmail
> -Am -bs
> root     11922  0.0  0.0  3672  508 pts/0    S+   13:42   0:00 grep sendmail
> 
> 
> Any ideas?

Yes - click on the Module Config link in the Sendmail module, and make sure
the 'Full path to sendmail pid files' is set correctly. My guess is that
for some reason, Sendmail is putting its PID file in a different location to
what Webmin expects..

 - Jamie

[webmin-l] webmin does not know sendmail status

[Barry <we...@i1...>]

In both the sendmail server module, and the system and server status 
module, the status for sendmail is reported incorrectly as down.

Also, in the server module, clicking ont he start server button doe snot 
seem to do anything.

System is Centos4.3, latest webmin (1.290).

Output that shows sendmail is running:

# ps aux|grep sendmail
root     11849  0.0  0.5 28844 3052 ?        SNs  13:42   0:00 sendmail 
-Am -bs
root     11922  0.0  0.0  3672  508 pts/0    S+   13:42   0:00 grep sendmail


Any ideas?

Best,

Barry

Re: [webmin-l] removing Webmin users from command line

[Jamie C. <jca...@we...>]

On 25/Aug/2006 04:18 Silver Salonen wrote ..
> Hi.
> 
> Is it possible to remove Webmin users from command line? Where does Webmin
> keep its users? I see file webmin.acl, but I suspect it's for some other
> purpose ;)

To remove a user, you would need to do the following :

1) Delete the user's line from /etc/webmin/webmin.acl
2) Delete the user's line from /etc/webmin/miniserv.users
3) Delete all /etc/webmin/*/username.acl files, and /etc/webmin/username.acl
4) Restart Webmin with the command /etc/webmin/restart

 - Jamie

Re: [webmin-l] Webmin security risk!

[Russ F. <ru...@to...>]

On 25 Aug 2006, at 15:48, J=E9r=F4me Wax wrote:

> In complex company, root for a specific computer do not alwars know =20=

> all
> passwords and don't have all power.
>
> Certificates can solve this problem by adding a limitation in time for
> example.
>
> Behind this simple question, most of softwares use now certificates
> mechanism.
>
> Why do not just give webmin users the choice between certificates or
> plain text ?
>
> __________________________
> http://www.lo2k.net
>
> Hamid Hashemi a =E9crit :
>> You are saying that there is no security for that but there is ! As
>> Jamie said the files are readable by root only. and if you think that
>> someone who can access the root files will have problem decoding the
>> passwords are stored in these files, then you are wrong !
>> We have to work on the files security instead of encoding the =20
>> password
>> with some mechanism which can be decoded easily.
>>
>> _Hamid
>>
>> J=E9r=F4me Wax wrote:
>>>>> It could at least be encrypted with a private key and then =20
>>>>> decrypted
>>>>> inside Webmin to pass to the other systems. This would add to the
>>>>> inconvenience of abusing the password, should it be viewed, but =20=

>>>>> any
>>>>> impression of this being a secure solution is an illusion.
>>>>> Even using asymmetric keys, as in ssh, Webmin would still hold =20
>>>>> some
>>>>> credential which could be copied and abused.
>>>>> It's an intractable problem.
>>>>> --r
>>>>>
>>>>>
>>>> Private keys are a one way incription mechanism. You have to =20
>>>> know the
>>>> original password, and then encrypt it with the public key to =20
>>>> see if the
>>>> result is the same. In our case, we want a method that will =20
>>>> allow webmin
>>>> to know the password. There is no simple anwer here. If Webmin =20
>>>> encrypts
>>>> the password, then any potential hacker can use the =20
>>>> encrypription method
>>>> from Webmin to retrieve it. Just a waste of time.
>>>>
>>>>
>>> You close your door after leaving your home but any people can =20
>>> open it
>>> with right tools.
>>> If you let it open, people are encouraged to enter...
>>>
>>> Poor protection is better than none.

Perhaps I should not have started on this topic. Everyone is an =20
expert on security, and sometimes they don't even mind violently =20
agreeing with the previous poster ;^) , but the point is that webmin =20
is in this case not authenticating in incoming transaction, but needs =20=

to be authenticated to an external system. In order to do that, it =20
needs, a key, a password, a token, whatever, and once it has such, =20
there is potential for abuse.

As someone stated, only root can read the file. Therefore the risk =20
occurs only if the 'client' system is compromised. So there should be =20=

nothing to worry about. The comment about private keys being a one-=20
way encryption mechanism is way off. Restating my original position, =20
simple reversible encryption of the password might provide some peace =20=

of mind to those adminstrators who go around  opening files while =20
others are looking over their shoulders, perhaps working on system =20
admin while at the pub. But this is a not a real security measure. =20
Just a fig-leaf. But sometimes a fig-leaf is good enough.

My vote would be to spend time on other aspects of security.

Thanks to Jamie Cameron and all who have contributed to the success =20
of Webmin.

Best wishes,
may peace be upon us.

--r
Russ Ferriday - Topia Systems - multilingual content management
contact: ru...@to... - (+44) (0)2076 1777588 - skype: ferriday
a member of the
evenios group

Re: [webmin-l] Accessing webmin from work via proxy

[Jamie C. <jca...@we...>]

On 25/Aug/2006 08:21 =3D?ISO-8859-1?Q?J=3DE9r=3DF4me_Wax?=3D wrote ..
> Michael Ryerse a =E9crit :
> > Hi, I am considering installing Webmin on my server, but need to know
> > if I can access it from work, which filters all web connections 
> > limiting me to port 80.  Will webmin work for me?  Seems to me webmin
> > runs as it's own webserver and requires a different port to work 
> > properly.  Sorry if this is a common question, I searched 
> > www.webmin.com <http://www.webmin.com> FAQ's, searched this list, 
> > googled, and searched some other sites but cannot find an answer.  
> > Thank you!
> >  
> > -Mike
> 
> You can install it on Apache, I recommand you this page 
> "http://www.webmin.com/apache.html"

I've been in this situation myself (where port 10000 is blocked), and
the solution was to setup an apache virtual server which uses the 
proxypass directives to forward traffic to port 10000 on the same
machine. This is documented on the page above..

Re: [webmin-l] Webmin security risk!

[Jamie C. <jca...@we...>]

Even a cert wouldn't help in this case, as again Webmin would need to
be able to read that cert, and thus so could an attacker.

If someone has root access on a Webmin system that is controlling other
slaves (via the Webmin Servers Index module and cluster featues), even if
some amazing form of security prevents him from getting the password, he
could still do nasty things by changing the code on the master system to
send malicious commands to slaves when a legitimate user uses the master.

 - Jamie

On 25/Aug/2006 07:48 =3D?ISO-8859-1?Q?J=3DE9r=3DF4me_Wax?=3D wrote ..
> In complex company, root for a specific computer do not alwars know all
> passwords and don't have all power.
> 
> Certificates can solve this problem by adding a limitation in time for
> example.
> 
> Behind this simple question, most of softwares use now certificates 
> mechanism.
> 
> Why do not just give webmin users the choice between certificates or 
> plain text ?
> 
> __________________________
> http://www.lo2k.net
> 
> Hamid Hashemi a =E9crit :
> > You are saying that there is no security for that but there is ! As 
> > Jamie said the files are readable by root only. and if you think that
> > someone who can access the root files will have problem decoding the
> > passwords are stored in these files, then you are wrong !
> > We have to work on the files security instead of encoding the password
> > with some mechanism which can be decoded easily.
> >
> > _Hamid
> >
> > J=E9r=F4me Wax wrote:
> >>>> It could at least be encrypted with a private key and then decrypted
> >>>> inside Webmin to pass to the other systems. This would add to the
> >>>> inconvenience of abusing the password, should it be viewed, but any
> >>>> impression of this being a secure solution is an illusion.
> >>>> Even using asymmetric keys, as in ssh, Webmin would still hold some
> >>>> credential which could be copied and abused.
> >>>> It's an intractable problem.
> >>>> --r
> >>>>     
> >>>>       
> >>> Private keys are a one way incription mechanism. You have to know the
> >>> original password, and then encrypt it with the public key to see if
> the 
> >>> result is the same. In our case, we want a method that will allow webmin
> >>> to know the password. There is no simple anwer here. If Webmin encrypts
> >>> the password, then any potential hacker can use the encrypription method
> >>> from Webmin to retrieve it. Just a waste of time.
> >>>   
> >>>     
> >> You close your door after leaving your home but any people can open
> it 
> >> with right tools.
> >> If you let it open, people are encouraged to enter...
> >>
> >> Poor protection is better than none.
> >>     
> 
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D121642
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list

[webmin-l] Can't locate Compress/Zlib.pm

[Robert L. <rl...@os...>]

I have been using Webmin for many years and love it. This is the first time
I have run into a problem that I am not sure how to fix. I have two
identical servers setup at different locations for a school district. They
are being used a Proxy/Filter servers. Both are running Debian 3.1 with
Squid and Dans Guardian. I installed the DansGuardian module on both
systems. It works great except for one problem. On one system I get the
following error message when I click "Display Logfile".

	Can't locate Compress/Zlib.pm in @INC (@INC contains: /root/webmin-1.290
/etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4
/usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8
/usr/local/lib/site_perl .) at /root/webmin-1.290/dansguardian/logs.cgi line
117.
BEGIN failed--compilation aborted at
/root/webmin-1.290/dansguardian/logs.cgi line 117.

I have searched the system and cannot find "Zlib.pm" any where. The funny
part is that this was working when I setup the machine in the lab for
testing. Any help is much appreciated.

Robert Lowery

Re: [webmin-l] Accessing webmin from work via proxy

[<jer...@li...>]

Michael Ryerse a =E9crit :
> Hi, I am considering installing Webmin on my server, but need to know=20
> if I can access it from work, which filters all web connections=20
> limiting me to port 80.  Will webmin work for me?  Seems to me webmin=20
> runs as it's own webserver and requires a different port to work=20
> properly.  Sorry if this is a common question, I searched=20
> www.webmin.com <http://www.webmin.com> FAQ's, searched this list,=20
> googled, and searched some other sites but cannot find an answer. =20
> Thank you!
> =20
> -Mike

You can install it on Apache, I recommand you this page=20
"http://www.webmin.com/apache.html"

[webmin-l] Accessing webmin from work via proxy

[Michael R. <mic...@gm...>]

Hi, I am considering installing Webmin on my server, but need to know if I
can access it from work, which filters all web connections limiting me to
port 80.  Will webmin work for me?  Seems to me webmin runs as it's own
webserver and requires a different port to work properly.  Sorry if this is
a common question, I searched www.webmin.com FAQ's, searched this list,
googled, and searched some other sites but cannot find an answer.  Thank
you!

-Mike

Re: [webmin-l] Webmin security risk!

[<jer...@li...>]

In complex company, root for a specific computer do not alwars know all=20
passwords and don't have all power.

Certificates can solve this problem by adding a limitation in time for=20
example.

Behind this simple question, most of softwares use now certificates=20
mechanism.

Why do not just give webmin users the choice between certificates or=20
plain text ?

__________________________
http://www.lo2k.net

Hamid Hashemi a =E9crit :
> You are saying that there is no security for that but there is ! As=20
> Jamie said the files are readable by root only. and if you think that=20
> someone who can access the root files will have problem decoding the=20
> passwords are stored in these files, then you are wrong !
> We have to work on the files security instead of encoding the password=20
> with some mechanism which can be decoded easily.
>
> _Hamid
>
> J=E9r=F4me Wax wrote:
>>>> It could at least be encrypted with a private key and then decrypted=
=20
>>>> inside Webmin to pass to the other systems. This would add to the=20
>>>> inconvenience of abusing the password, should it be viewed, but any=20
>>>> impression of this being a secure solution is an illusion.
>>>> Even using asymmetric keys, as in ssh, Webmin would still hold some=20
>>>> credential which could be copied and abused.
>>>> It's an intractable problem.
>>>> --r
>>>>    =20
>>>>      =20
>>> Private keys are a one way incription mechanism. You have to know the=
=20
>>> original password, and then encrypt it with the public key to see if =
the=20
>>> result is the same. In our case, we want a method that will allow web=
min=20
>>> to know the password. There is no simple anwer here. If Webmin encryp=
ts=20
>>> the password, then any potential hacker can use the encrypription met=
hod=20
>>> from Webmin to retrieve it. Just a waste of time.
>>>  =20
>>>    =20
>> You close your door after leaving your home but any people can open it=
=20
>> with right tools.
>> If you let it open, people are encouraged to enter...
>>
>> Poor protection is better than none.
>>    =20

Re: [webmin-l] Webmin security risk!

[Dov Z. <do...@za...>]

=D7=A6=D7=99=D7=98=D7=95=D7=98 Munzir Taha (=D9=85=D9=86=D8=B0=D8=B1 =D8=B7=
=D9=87):
> On Friday 25 August 2006 16:22, Dov Zamir wrote:
>  =20
>> =D7=A6=D7=99=D7=98=D7=95=D7=98 J=C3=A9r=C3=B4me Wax:
>>    =20
>
>  =20
>>> You close your door after leaving your home but any people can open i=
t
>>> with right tools.
>>> If you let it open, people are encouraged to enter...
>>>
>>> Poor protection is better than none.
>>>      =20
>> Not really. Poor protection gives a false sense of security. At least
>> you know what the risks are when you leave your door open.
>>    =20
>
> I'd love it if you told me where is you home located to see whether you=
 do=20
> what you believe in ;)
>
>  =20
Now you are misunderstanding. I do not preach no security, but rather=20
good security. What I'm saying is that bad security is worse than no=20
security. And yes, I do lock my door when I leave home.

Re: [webmin-l] Webmin security risk!

[Munzir T. ( ) <mun...@gm...>]

On Friday 25 August 2006 16:22, Dov Zamir wrote:
> =D7=A6=D7=99=D7=98=D7=95=D7=98 J=C3=A9r=C3=B4me Wax:

> > You close your door after leaving your home but any people can open it
> > with right tools.
> > If you let it open, people are encouraged to enter...
> >
> > Poor protection is better than none.
>
> Not really. Poor protection gives a false sense of security. At least
> you know what the risks are when you leave your door open.

I'd love it if you told me where is you home located to see whether you do=
=20
what you believe in ;)

=2D-=20
Munzir Taha
Telecommunications and Electronics Engineer
Maintainer of Fedora Arabic Translation Project
https://listman.redhat.com/mailman/listinfo/fedora-trans-ar
Maintainer of the OpenBugs project page at
http://www.arabic-fedora.org/munzir/OpenBugs.html
Master CIW Designer, ICDL, MOUS, Linux+, LPI 101
Riyadh, SA

Re: [webmin-l] Webmin security risk!

[Dov Z. <do...@za...>]

????? Hamid Hashemi:
> You are saying that there is no security for that but there is ! As=20
> Jamie said the files are readable by root only. and if you think that=20
> someone who can access the root files will have problem decoding the=20
> passwords are stored in these files, then you are wrong !
> We have to work on the files security instead of encoding the password=20
> with some mechanism which can be decoded easily.
>
My point exactly. The conf file with the password is not like an open=20
door. Only a hacker with intent to jepordise the system will know that=20
there is a password there. And if he got that far, the system is=20
jepodised already. Encrypting the password will have no effect. Just=20
ensuring the proper permissions and using built in security measures=20
should be enough. There is no real reason to apply more security=20
specifiaclly for this password.

> _Hamid
>
> J=E9r=F4me Wax wrote:
>>>> It could at least be encrypted with a private key and then decrypted=
=20
>>>> inside Webmin to pass to the other systems. This would add to the=20
>>>> inconvenience of abusing the password, should it be viewed, but any=20
>>>> impression of this being a secure solution is an illusion.
>>>> Even using asymmetric keys, as in ssh, Webmin would still hold some=20
>>>> credential which could be copied and abused.
>>>> It's an intractable problem.
>>>> --r
>>>>    =20
>>>>      =20
>>> Private keys are a one way incription mechanism. You have to know the=
=20
>>> original password, and then encrypt it with the public key to see if =
the=20
>>> result is the same. In our case, we want a method that will allow web=
min=20
>>> to know the password. There is no simple anwer here. If Webmin encryp=
ts=20
>>> the password, then any potential hacker can use the encrypription met=
hod=20
>>> from Webmin to retrieve it. Just a waste of time.
>>>  =20
>>>    =20
>> You close your door after leaving your home but any people can open it=
=20
>> with right tools.
>> If you let it open, people are encouraged to enter...
>>
>> Poor protection is better than none.
>>
>> ___________________________
>> http://www.lo2k.net
>>
>>
>> ----------------------------------------------------------------------=
---
>> Using Tomcat but need to do more? Need to support web services, securi=
ty?
>> Get stuff done quickly with pre-integrated technology to make your job=
 easier
>> Download IBM WebSphere Application Server v.1.0.1 based on Apache Gero=
nimo
>> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&da=
t=3D121642
>> -
>> Forwarded by the Webmin mailing list at web...@li...=
e.net
>> To remove yourself from this list, go to
>> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>>
>>  =20
>
> --=20
> Regards
>     =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>    /  Seyyed Hamid Reza    /        WINDOWS FOR NOW  !!            /
>   /  Hashemi Golpayegani  /  Linux for future , FreeBSD for ever  /
>  /    Morva System Co.   / ------------------------------------- /
> /  Network Administrator/ ha...@mo...   ,   ICQ# : 42209876 /
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
> !DSPAM:500,44ef000946381804284693!
> -----------------------------------------------------------------------=
-
>
> -----------------------------------------------------------------------=
--
> Using Tomcat but need to do more? Need to support web services, securit=
y?
> Get stuff done quickly with pre-integrated technology to make your job =
easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geron=
imo
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=
=3D121642
>
> !DSPAM:500,44ef000946381804284693!
>  =20
> -----------------------------------------------------------------------=
-
>
> -
> Forwarded by the Webmin mailing list at web...@li...=
.net
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>
>
> !DSPAM:500,44ef000946381804284693!
>  =20

Re: [webmin-l] Webmin security risk!

[Hamid H. <ha...@mo...>]

You are saying that there is no security for that but there is ! As 
Jamie said the files are readable by root only. and if you think that 
someone who can access the root files will have problem decoding the 
passwords are stored in these files, then you are wrong !
We have to work on the files security instead of encoding the password 
with some mechanism which can be decoded easily.

_Hamid

Jérôme Wax wrote:
>>> It could at least be encrypted with a private key and then decrypted 
>>> inside Webmin to pass to the other systems. This would add to the 
>>> inconvenience of abusing the password, should it be viewed, but any 
>>> impression of this being a secure solution is an illusion.
>>> Even using asymmetric keys, as in ssh, Webmin would still hold some 
>>> credential which could be copied and abused.
>>> It's an intractable problem.
>>> --r
>>>     
>>>       
>> Private keys are a one way incription mechanism. You have to know the 
>> original password, and then encrypt it with the public key to see if the 
>> result is the same. In our case, we want a method that will allow webmin 
>> to know the password. There is no simple anwer here. If Webmin encrypts 
>> the password, then any potential hacker can use the encrypription method 
>> from Webmin to retrieve it. Just a waste of time.
>>   
>>     
> You close your door after leaving your home but any people can open it 
> with right tools.
> If you let it open, people are encouraged to enter...
>
> Poor protection is better than none.
>
> ___________________________
> http://www.lo2k.net
>
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>
>   

-- 
Regards
    =================================================================
   /  Seyyed Hamid Reza    /        WINDOWS FOR NOW  !!            /
  /  Hashemi Golpayegani  /  Linux for future , FreeBSD for ever  /
 /    Morva System Co.   / ------------------------------------- /
/  Network Administrator/ ha...@mo...   ,   ICQ# : 42209876 /
================================================================ 

Re: [webmin-l] Webmin security risk!

[Dov Z. <do...@za...>]

=D7=A6=D7=99=D7=98=D7=95=D7=98 J=C3=A9r=C3=B4me Wax:
>
>>> It could at least be encrypted with a private key and then decrypted=20
>>> inside Webmin to pass to the other systems. This would add to the=20
>>> inconvenience of abusing the password, should it be viewed, but any=20
>>> impression of this being a secure solution is an illusion.
>>> Even using asymmetric keys, as in ssh, Webmin would still hold some=20
>>> credential which could be copied and abused.
>>> It's an intractable problem.
>>> --r
>>>    =20
>> Private keys are a one way incription mechanism. You have to know the=20
>> original password, and then encrypt it with the public key to see if=20
>> the result is the same. In our case, we want a method that will allow=20
>> webmin to know the password. There is no simple anwer here. If Webmin=20
>> encrypts the password, then any potential hacker can use the=20
>> encrypription method from Webmin to retrieve it. Just a waste of time.
>>  =20
> You close your door after leaving your home but any people can open it=20
> with right tools.
> If you let it open, people are encouraged to enter...
>
> Poor protection is better than none.

Not really. Poor protection gives a false sense of security. At least=20
you know what the risks are when you leave your door open.

Re: [webmin-l] Webmin security risk!

[<jer...@li...>]

>> It could at least be encrypted with a private key and then decrypted 
>> inside Webmin to pass to the other systems. This would add to the 
>> inconvenience of abusing the password, should it be viewed, but any 
>> impression of this being a secure solution is an illusion.
>> Even using asymmetric keys, as in ssh, Webmin would still hold some 
>> credential which could be copied and abused.
>> It's an intractable problem.
>> --r
>>     
> Private keys are a one way incription mechanism. You have to know the 
> original password, and then encrypt it with the public key to see if the 
> result is the same. In our case, we want a method that will allow webmin 
> to know the password. There is no simple anwer here. If Webmin encrypts 
> the password, then any potential hacker can use the encrypription method 
> from Webmin to retrieve it. Just a waste of time.
>   
You close your door after leaving your home but any people can open it 
with right tools.
If you let it open, people are encouraged to enter...

Poor protection is better than none.

___________________________
http://www.lo2k.net

Re: [webmin-l] Webmin security risk!

[Dov Z. <do...@za...>]

=D7=A6=D7=99=D7=98=D7=95=D7=98 Russ Ferriday:
> On 25 Aug 2006, at 11:59, Munzir Taha (=D9=85=D9=86=D8=B0=D8=B1 =D8=B7=D9=
=87) wrote:
>
>> On Friday 25 August 2006 08:47, Jamie Cameron wrote:
>>> On 24/Aug/2006 22:30 Munzir Taha wrote ..
>>>
>>>> On Thursday 24 August 2006 18:38, Jamie Cameron wrote:
>>>>> On 24/Aug/2006 05:07 Munzir Taha wrote ..
>>>>>
>>
>>>> The real problem is having the root password on this file
>>>> /etc/webmin/servers/1108941386.serv
>>>> May be this is because I am monitoring another server from webmin.
>>>
>>> That's right .. the master Webmin needs to store the password of the
>>> other server.
>>>
>>>>> And the files are only readable by root, so
>>>>> there is no security risk from normal users..
>>>>
>>>> As I read the vulnerability discovered in webmin 1.29- would allow a=
ny
>>>> anonymous user to read any system file whatever the permissions are.=
 In
>>>> such cases the administrator need some time to provide the patch.
>>>> Afterall, this is why the system root password is not only kept in
>>>> non-readable by everyone shadow file but also kept encrypted.
>>>
>>> Keeping it one-way encrypted like in the shadow file is OK for=20
>>> validating
>>> users, but not for automatically logging into other systems like Webm=
in
>>> does..
>>
>> I don't know how webmin works but isn't there there any way to=20
>> encrypt it=20
>> while not losing webmin features?
>
> It could at least be encrypted with a private key and then decrypted=20
> inside Webmin to pass to the other systems. This would add to the=20
> inconvenience of abusing the password, should it be viewed, but any=20
> impression of this being a secure solution is an illusion.
> Even using asymmetric keys, as in ssh, Webmin would still hold some=20
> credential which could be copied and abused.
> It's an intractable problem.
> --r
Private keys are a one way incription mechanism. You have to know the=20
original password, and then encrypt it with the public key to see if the=20
result is the same. In our case, we want a method that will allow webmin=20
to know the password. There is no simple anwer here. If Webmin encrypts=20
the password, then any potential hacker can use the encrypription method=20
from Webmin to retrieve it. Just a waste of time.

Re: [webmin-l] Webmin security risk!

[Russ F. <ru...@to...>]

On 25 Aug 2006, at 11:59, Munzir Taha (=D9=85=D9=86=D8=B0=D8=B1 =D8=B7=D9=87=
) wrote:

> On Friday 25 August 2006 08:47, Jamie Cameron wrote:
>> On 24/Aug/2006 22:30 Munzir Taha wrote ..
>>
>>> On Thursday 24 August 2006 18:38, Jamie Cameron wrote:
>>>> On 24/Aug/2006 05:07 Munzir Taha wrote ..
>>>>
>
>>> The real problem is having the root password on this file
>>> /etc/webmin/servers/1108941386.serv
>>> May be this is because I am monitoring another server from webmin.
>>
>> That's right .. the master Webmin needs to store the password of the
>> other server.
>>
>>>> And the files are only readable by root, so
>>>> there is no security risk from normal users..
>>>
>>> As I read the vulnerability discovered in webmin 1.29- would =20
>>> allow any
>>> anonymous user to read any system file whatever the permissions =20
>>> are. In
>>> such cases the administrator need some time to provide the patch.
>>> Afterall, this is why the system root password is not only kept in
>>> non-readable by everyone shadow file but also kept encrypted.
>>
>> Keeping it one-way encrypted like in the shadow file is OK for =20
>> validating
>> users, but not for automatically logging into other systems like =20
>> Webmin
>> does..
>
> I don't know how webmin works but isn't there there any way to =20
> encrypt it
> while not losing webmin features?

It could at least be encrypted with a private key and then decrypted =20
inside Webmin to pass to the other systems. This would add to the =20
inconvenience of abusing the password, should it be viewed, but any =20
impression of this being a secure solution is an illusion.
Even using asymmetric keys, as in ssh, Webmin would still hold some =20
credential which could be copied and abused.
It's an intractable problem.
--r


Russ Ferriday - Topia Systems - multilingual content management
contact: ru...@to... - (+44) (0)2076 1777588 - skype: ferriday
a member of the
evenios group

[webmin-l] removing Webmin users from command line

[Silver S. <si...@ul...>]

Hi.

Is it possible to remove Webmin users from command line? Where does Webmin 
keep its users? I see file webmin.acl, but I suspect it's for some other 
purpose ;)

Silver

Re: [webmin-l] Webmin security risk!

[Munzir T. ( ) <mun...@gm...>]

On Friday 25 August 2006 08:47, Jamie Cameron wrote:
> On 24/Aug/2006 22:30 Munzir Taha wrote ..
>
> > On Thursday 24 August 2006 18:38, Jamie Cameron wrote:
> > > On 24/Aug/2006 05:07 Munzir Taha wrote ..
> > >

> > The real problem is having the root password on this file
> > /etc/webmin/servers/1108941386.serv
> > May be this is because I am monitoring another server from webmin.
>
> That's right .. the master Webmin needs to store the password of the
> other server.
>
> > > And the files are only readable by root, so
> > > there is no security risk from normal users..
> >
> > As I read the vulnerability discovered in webmin 1.29- would allow any
> > anonymous user to read any system file whatever the permissions are. In
> > such cases the administrator need some time to provide the patch.
> > Afterall, this is why the system root password is not only kept in
> > non-readable by everyone shadow file but also kept encrypted.
>
> Keeping it one-way encrypted like in the shadow file is OK for validating
> users, but not for automatically logging into other systems like Webmin
> does..

I don't know how webmin works but isn't there there any way to encrypt it 
while not losing webmin features?

-- 
Munzir Taha
Telecommunications and Electronics Engineer
Maintainer of Fedora Arabic Translation Project
https://listman.redhat.com/mailman/listinfo/fedora-trans-ar
Maintainer of the OpenBugs project page at
http://www.arabic-fedora.org/munzir/OpenBugs.html
Master CIW Designer, ICDL, MOUS, Linux+, LPI 101
Riyadh, SA

[webmin-l] Can I do this?

[Barry <we...@i1...>]

Am I crazy if I wanted to use FC5 rpms to want to update a CentOS 4.3 
system?

Current candidates include dovecot and php. the system is x86_64, and 
yum is not showing the latest and greatest. Probably not because of the 
x86_64 part but because of the RHEL 4 part, huh?

Best,

Barry

Re: [webmin-l] Installing Webmin on Windows XP Pro Problem

[<ge...@gm...>]

Just a guess, I have not tried to do it myself, however... Have you tried to
install under cygwin?

http://www.cygwin.com/

rgrds,
Braulio Gergull

2006/8/22, Terry Allen <hm...@oz...>:
>
> Hi again,
>         I posted to the list over the weekend & it may have been lost
> amongst the other threads, so I'll try again.
>         I have run Webmin on OSX & other *nix variants for a long
> time, n problems with installation etc.... However, I have a client
> who needs an automated method to administer password protected
> directories on Apache under Windows XP Professional & I cannot find
> any other tool to do it for Windows other than Webmin, which is my
> preferred choice anyway.
>         However, I have been as yet unable to get Webmin installed,
> with the same errors as other people have posted but I have been
> unable to find a solution.
>         The process to get it installed so far is as follows:
>
> 1 - Install Activestate Perl - latest version
> 2 - Download/extract Webmin .zip file to C:\webmin
> 3 - On a command prompt enter - perl setup.pl
> 4 - Output from Webmin setup script is:
>
> Perl seems to be installed OK
> This is followed by:
>
>   a number of 'The system cannot find the path specified', followed by
>
> 'Failed to create temp directory C:\DOCUMEN~1\Owner\LOCALS~1\Temp
>
>         At Jamie's suggestion, I have tried changing the path to temp
> to C:\temp & also tried c:\tmp, but the error stays pretty much the
> same - an empty directory gets created in C:\etc\ called Webmin &
> also C:\var\ - so the script begins to run it's course, but something
> is hanging it up.
>         To answer the first question, yes, I am running as an
> administrator user & I have also logged in as Administrator just to
> see if that worked but no luck yet.
>
>         Has anyone successfully overcome these obstacles & if so,
> could they please post to the list or to my address directly - I have
> been unable to find any further answers to this - any help is very
> much appreciated.
> --
>
>         Bye for now, Terry Allen
>
>         ___________________________________________________________________
> hEARd
>
> Postal Address:
>         hEARd, 26B Glenning Rd, Glenning Valley, NSW 2261, Australia
> Internet -
>         WWW: http://heard.com.au http://itavservices.com
> EMAIL: hm...@oz...
> Phone: Australia - 02 4388 1400 / International - + 61 2 43881400
> Mobile: Australia - 04 28881400 / International - 61 4 28881400
> -----------------------------------------------
> Non profit promotion for new music - since 1994
> -----------------------------------------------
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> -
> Forwarded by the Webmin mailing list at
> web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>

Re: [webmin-l] Webmin security risk!

[Jamie C. <jca...@we...>]

On 24/Aug/2006 22:30 Munzir Taha (=?utf-8?q?=D9=85=D9=86=D8=B0=D8=B1?=  =?utf-8?q?_=D8=B7=D9=87?=) wrote ..
> On Thursday 24 August 2006 18:38, Jamie Cameron wrote:
> > On 24/Aug/2006 05:07 Munzir Taha wrote ..
> >
> > > Hi,
> > > I noticed that webmin stores passwords unencrypted in its configuration
> > > files. This is a security risk. If someone manage to find any
> > > vulnerability to read those files, he won't need to waste any time
> trying
> > > to crack them which is a serious issue.
> >
> > That is true - in some cases, Webmin needs to store passwords (like the
> > mysql login) in a file. This is needed because connecting to mysql requires
> > knowledge of the plain text password.
> 
> That's fine with me. After all one can secure mysql to to only accept 
> connections from localhost.
> 
> > Fortunately, the mysql and postgresql modules are the only two I can
> think
> > of that have this requirement.
> 
> The real problem is having the root password on this file
> /etc/webmin/servers/1108941386.serv
> May be this is because I am monitoring another server from webmin.

That's right .. the master Webmin needs to store the password of the
other server.

> > And the files are only readable by root, so 
> > there is no security risk from normal users..
> 
> As I read the vulnerability discovered in webmin 1.29- would allow any
> anonymous user to read any system file whatever the permissions are. In
> such cases the administrator need some time to provide the patch. Afterall,
> this is why the system root password is not only kept in non-readable by everyone
> shadow file but also kept encrypted.

Keeping it one-way encrypted like in the shadow file is OK for validating users,
but not for automatically logging into other systems like Webmin does..

 - Jamie