webadmin-list — Webmin users mailing list

RE: [webmin-l] Webmin Shorewall manual

[Rouke de J. <rou...@gm...>]

Hi Jamie,

Sorry, looked over your post. Yes of course it's all right to link to it.
I'm trying to get some more stable hosting for this and some other manuals,
if the link gets updated (which I hope will be done next week), shall I just
put the new url here?

-----Oorspronkelijk bericht-----
Van: web...@li...
[mailto:web...@li...] Namens Jamie Cameron
Verzonden: zaterdag 17 september 2005 8:23
Aan: web...@li...
Onderwerp: Re: [webmin-l] Webmin Shorewall manual

Hi Rouke,

Your documentation is quite impressive, and much needed as I don't think
any of the webmin books cover shorewall. Do you mind if I link to it
from www.webmin.com ?

 - Jamie

On Fri, 2005-09-16 at 22:55, Rouke de Jong wrote:
> Hiya
> 
>  
> 
> First time ever posting on the list, so let me introduce myself first,
> I?m Rouke de Jong, Shorewall and Webmin user J. I have been working
> with Shorewall for quite some time now to much satisfaction. I love
> the way Shorewall administration is integrated in Webmin, but
> unfortunately I?ve never been able to find a proper manual how to
> configure Shorewall using Webmin. So I took it upon myself to make it,
> as is common in the linux world, it?s not totally finished, but I
> wanted to ask some of you about your opinion regarding my work so far.
> The link is
> http://130.89.226.17/hd3/shorewall%20webmin/Shore-Webmin.htm but
> please be gentle, my connection is not up to massive visits. Well,
> thanks in advance.
> 
>  
> 
> Rouke
> 
> 



-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
-
Forwarded by the Webmin mailing list at web...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

RE: [webmin-l] Understanding daily "LogWatch"?

[Vern <ve...@cw...>]

> Thanks for the detailed instructions! 

Bear in mind this will not block your attacks, it will only block an attacker from 
logging into Webmin, it is better to block the IP from your box all together.

RE: [webmin-l] Understanding daily "LogWatch"?

[Vern <ve...@cw...>]

> What can anyone gain by getting into my server by this method? 
> Is it simply vandalism, or is there some sort of point to it? 
> For instance, does it allow the "hackers" to use my server to 
> run their own websites or email/spam programs? 

All of the above and more. Some do it just to say they did it, some do it to "own" as 
many machines as they can, so do it to attack other computers, there are a myriad of 
reasons why and your guess would be as good as mine as to why people waste their's and 
our time, but they do and since they do it is your obligation to secure and patch your 
box, so that your machine once rooted or infected doesn't do damage to others. Your 
ISP can even shut you down for not doing so. 

It's a mean cruel cyberspace out there...

RE: [webmin-l] Understanding daily "LogWatch"?

[<pr...@pr...>]

From: Prodos
To: David Coley

Dear David,

Thanks for the detailed instructions!

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com




> -------- Original Message --------
> Subject: RE: [webmin-l] Understanding daily "LogWatch"?
> From: dav...@da...
> Date: Mon, September 19, 2005 10:10 am
> To: <web...@li...>
>
> Warning:  Be careful you can block YOUR access if you do not do this right!
>
>
> Webmin Configuration -> IP Access Control
>
> Change the dot to "Deny from listed addresses", this will set up a Do Not
> Allow list. Now if you know your only going to access it from one IP you can
> do allow, but I find this to be to inclusive for my use.
>
> Once you have it to Deny From Listed Addresses and type in the 220 IP
> address from your last e-mail.
>
> Click Save.
>
> This will prevent that IP from accessing webmin at all.
>
> Now if you had a firewall setup on the machine, you could set it up to deny
> all access from that IP...
>
> David Coley
> Codecipher
>

RE: [webmin-l] Understanding daily "LogWatch"?

[<pr...@pr...>]

From: Prodos

Greetings


Vern wrote:
> These are attempted hacks (logon failures) into your box. Many are created by
> dictionary password crack programs that are used to attempt to figure out user name
> and passwords on your box. I used to get these and figured the best thing to do is to
> block the ssh port (tcp port 22) and only allow specific IP addresses, that I specify,
> access to that port.

I see.

Thanks for that information.

Sorry to ask such a dumb question but:

What can anyone gain by getting into my server by this method?

Is it simply vandalism, or is there some sort of point to it?

For instance, does it allow the "hackers" to use my server to
run their own websites or email/spam programs?


Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Craig W. <cra...@az...>]

On Sun, 2005-09-18 at 18:29 -0500, Joe Cooper wrote:
> Roger B.A. Klorese wrote:
> > Joe Cooper wrote:

> 
> And, of course, no one is gonna force you to use Usermin just because 
> you're using Webmin and Virtualmin.  It's not a law, they just happen to 
> work really well together.  Feel free to grab Horde/IMP, as Craig so 
> eloquently campaigned for, or OpenWebmail, or one of the dozens of other 
> projects that do webmail.  Let us know what problems you run into and 
> we'll try to help.  (But also let us know what you feel is lacking in 
> Usermin...we'd like to fix it.)
----
I didn't do any campaiging for Horde/IMP - it's available elsewhere and
packaging it into something else would be a nightmare.

I was suggesting that it seemed logical to me that more LDAP stuff, a
better cyrus-imapd implementation and virtual users support (non-shell,
non-home directory), might be very useful for your client base but it's
not my job to identify your client base and I'm not even a potential
client since I don't do virtual hosting.

In the Horde/IMP vein, I was suggesting that 'ingo' the filter manager
for Horde, was the best implementation for user level editing of
sieve/procmail filters that I had seen to date and suggested that you
check out that implementation.

Usermin - I have had little use for on the networks that I
administrate...have set it up on 2 of them and have yet to field a
question or notice any user even checking it out.

Craig


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

RE: [webmin-l] Understanding daily "LogWatch"?

[Vern <ve...@cw...>]

>=A0Also webmin has a feature that prevent brute force attacks.

Where?

RE: [webmin-l] Understanding daily "LogWatch"?

[Vernon J. S. <ve...@ve...>]

I have a custom perl script that might help block ssh brute force attacks.
Also webmin has a feature that prevent brute force attacks.

------------------------------------------
Vernon J. Spangler
http://www.vernonspangler.org/
(520) 512-8410 Home
(520) 990-1863 Cell
ve...@ve...
------------------------------------------
  Powered by Windows XP Professional
    Sent by Microsoft Outlook 2003

-----Original Message-----
From: dav...@da... [mailto:dav...@da...] 
Sent: Sunday, September 18, 2005 4:33 PM
To: web...@li...
Subject: RE: [webmin-l] Understanding daily "LogWatch"?

Do you know who this IP address belongs to?  Otherwise it may be some "hack"
program trying to get into your system using common names and "idiot"
passwords.  If you look at the pattern they are all 'common' first names,
most being hit for 5 times.

If the IP address isn't one you work with, I'd consider blocking the IP all
together.

David Coley
Codecipher

-----Original Message-----
From: web...@li...
[mailto:web...@li...] On Behalf Of
pr...@pr...
Sent: Sunday, September 18, 2005 7:23 PM
To: web...@li...
Subject: [webmin-l] Understanding daily "LogWatch"?

From: Prodos (Melbourne, Australia)

Good morning.

I receive a daily email from my WEBMIN server
called "LogWatch for prodos"

It starts off like this ....

- - -
################### LogWatch 4.3.2 (02/18/03) ####################
      Processing Initiated: Mon Sep 19 04:02:04 2005
      Date Range Processed: yesterday
    Detail Level of Output: 0
         Logfiles for Host: prodos
################################################################
- - -


... and then lists all sorts of things, such as this ....



- - -
sshd:
  Invalid Users:
     Unknown Account: 2614 Time(s)
  Authentication Failures:
     mail (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time(s)
     unknown (220.229.161.171 ): 2211 Time(s)
     root (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 85 Time(s)
     sshd (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time(s)
     nobody (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5
Time(s)
     nobody (220.229.161.171 ): 3 Time(s)
     sshd (220.229.161.171 ): 9 Time(s)

[etc.]
- - - -



And this ....



- - - -
--------------------- SSHD Begin ------------------------


Failed logins from these:
  Aaliyah/password from 200.102.192.82: 5 Time(s)
  Aaron/password from 200.102.192.82: 5 Time(s)
  Aba/password from 200.102.192.82: 5 Time(s)
  Abel/password from 200.102.192.82: 5 Time(s)
  Chicago/password from 220.229.161.171: 6 Time(s)
  Christ/password from 220.229.161.171: 3 Time(s)
  Dakota/password from 220.229.161.171: 6 Time(s)
  Jewel/password from 200.102.192.82: 5 Time(s)
  Jordan/password from 220.229.161.171: 6 Time(s)

[etc.]
- - -


And this ...


- - -
**Unmatched Entries**
Illegal user zena from 220.229.161.171
Illegal user zena from 220.229.161.171
Illegal user purple from 220.229.161.171
Illegal user purple from 220.229.161.171

[etc.]
- - -


Some of the lists are VERY long!

Is there a reference guide somewhere that can help
me interpret what the different categories and listed
items mean and what action is advisable in each case?


Thanks for any help on this.

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com









-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
-
Forwarded by the Webmin mailing list at web...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.11.1/104 - Release Date: 9/16/2005
 



-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
-
Forwarded by the Webmin mailing list at web...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

RE: [webmin-l] Understanding daily "LogWatch"?

[<dav...@da...>]

Warning:  Be careful you can block YOUR access if you do not do this right!


Webmin Configuration -> IP Access Control

Change the dot to "Deny from listed addresses", this will set up a Do Not
Allow list. Now if you know your only going to access it from one IP you can
do allow, but I find this to be to inclusive for my use.

Once you have it to Deny From Listed Addresses and type in the 220 IP
address from your last e-mail.

Click Save.

This will prevent that IP from accessing webmin at all.

Now if you had a firewall setup on the machine, you could set it up to deny
all access from that IP... 

David Coley
Codecipher

-----Original Message-----
From: web...@li...
[mailto:web...@li...] On Behalf Of
pr...@pr...
Sent: Sunday, September 18, 2005 7:50 PM
To: web...@li...
Subject: RE: [webmin-l] Understanding daily "LogWatch"?

From: Prodos
To: David Coley

Dear David,

Good morning.


> Do you know who this IP address belongs to?  Otherwise it may be some
"hack"
> program trying to get into your system using common names and "idiot"
> passwords.  If you look at the pattern they are all 'common' first names,
> most being hit for 5 times.


No, I don't know who the IP address(es) belong to.
I haven't even noticed whether it's the same ones every day or not.


> If the IP address isn't one you work with, I'd consider blocking the IP
all
> together.
> 

Thanks for the advice.
Is blocking the IP something that I can do from within my WEBMIN control
panel?

Could you (or any other list member) point me to what section within 
WEBMIN is used for doing this please?

Thanks!

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com









-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
-
Forwarded by the Webmin mailing list at web...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.11.1/104 - Release Date: 9/16/2005
 

RE: [webmin-l] Understanding daily "LogWatch"?

[Vern <ve...@cw...>]

What I do is I go to Networking > Linux Firewall and I create a rule to D=
rop the=20
source IP, but as I mentioned before, most of these attacks are directed =
at ssh and if=20
you block the ssh port this will more than likely resolve your issue. If =
you need to=20
access the server through ssh then create a rule that allows your IP to a=
ccess it.=20
Just be careful using Linux Firewall because if you don;t know what your =
doing you=20
could lock everyone, including yourself out of the box.

---------- Original Message -----------=20
From: "pr...@pr..." <pr...@pr...>=20
To: web...@li...=20
Sent: Sun, 18 Sep 2005 16:49:31 -0700=20
Subject: RE: [webmin-l] Understanding daily "LogWatch"?

> From: Prodos=20
> To: David Coley=20
>=20
> Dear David,=20
>=20
> Good morning.=20
>=20
> > Do you know who this IP address belongs to? =A0Otherwise it may be so=
me "hack"=20
> > program trying to get into your system using common names and "idiot"=
=20
> > passwords. =A0If you look at the pattern they are all 'common' first =
names,=20
> > most being hit for 5 times.=20
>=20
> No, I don't know who the IP address(es) belong to.=20
> I haven't even noticed whether it's the same ones every day or not.=20
>=20
> > If the IP address isn't one you work with, I'd consider blocking the =
IP all=20
> > together.=20
> >=20
>=20
> Thanks for the advice.=20
> Is blocking the IP something that I can do from within my WEBMIN contro=
l=20
> panel?=20
>=20
> Could you (or any other list member) point me to what section within=20
> WEBMIN is used for doing this please?=20
>=20
> Thanks!=20
>=20
> Best Wishes,=20
>=20
> PRODOS=20
>=20
> http://prodos.thinkertothinker.com=20
>=20
> -------------------------------------------------------=20
> SF.Net email is sponsored by:=20
> Tame your development challenges with Apache's Geronimo App Server. Dow=
nload=20
> it for free - -and be entered to win a 42" plasma tv or your very own=20
> Sony(tm)PSP. =A0Click here to play: http://sourceforge.net/geronimo.php=
=20
> -=20
> Forwarded by the Webmin mailing list at web...@li...=
.net=20
> To remove yourself from this list, go to=20
> http://lists.sourceforge.net/lists/listinfo/webadmin-list=20
------- End of Original Message -------

RE: [webmin-l] Understanding daily "LogWatch"?

[<pr...@pr...>]

From: Prodos
To: David Coley

Dear David,

Good morning.


> Do you know who this IP address belongs to?  Otherwise it may be some "hack"
> program trying to get into your system using common names and "idiot"
> passwords.  If you look at the pattern they are all 'common' first names,
> most being hit for 5 times.


No, I don't know who the IP address(es) belong to.
I haven't even noticed whether it's the same ones every day or not.


> If the IP address isn't one you work with, I'd consider blocking the IP all
> together.
> 

Thanks for the advice.
Is blocking the IP something that I can do from within my WEBMIN control
panel?

Could you (or any other list member) point me to what section within 
WEBMIN is used for doing this please?

Thanks!

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Re: [webmin-l] Understanding daily "LogWatch"?

[Vern <ve...@cw...>]

These are attempted hacks (logon failures) into your box. Many are create=
d by=20
dictionary password crack programs that are used to attempt to figure out=
 user name=20
and passwords on your box. I used to get these and figured the best thing=
 to do is to=20
block the ssh port (tcp port 22) and only allow specific IP addresses, th=
at I specify,=20
access to that port.=20

---------- Original Message -----------=20
From: "pr...@pr..." <pr...@pr...>=20
To: web...@li...=20
Sent: Sun, 18 Sep 2005 16:22:56 -0700=20
Subject: [webmin-l] Understanding daily "LogWatch"?

> From: Prodos (Melbourne, Australia)=20
>=20
> Good morning.=20
>=20
> I receive a daily email from my WEBMIN server=20
> called "LogWatch for prodos"=20
>=20
> It starts off like this ....=20
>=20
> - - -=20
> ################### LogWatch 4.3.2 (02/18/03) ####################=20
> =A0 =A0 =A0Processing Initiated: Mon Sep 19 04:02:04 2005=20
> =A0 =A0 =A0Date Range Processed: yesterday=20
> =A0 =A0Detail Level of Output: 0=20
> =A0 =A0 =A0 =A0 Logfiles for Host: prodos=20
> ################################################################=20
> - - -=20
>=20
> ... and then lists all sorts of things, such as this ....=20
>=20
> - - -=20
> sshd:=20
> =A0Invalid Users:=20
> =A0 =A0 Unknown Account: 2614 Time(s)=20
> =A0Authentication Failures:=20
> =A0 =A0 mail (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time=
(s)=20
> =A0 =A0 unknown (220.229.161.171 ): 2211 Time(s)=20
> =A0 =A0 root (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 85 Tim=
e(s)=20
> =A0 =A0 sshd (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time=
(s)=20
> =A0 =A0 nobody (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5=20
> Time(s)=20
> =A0 =A0 nobody (220.229.161.171 ): 3 Time(s)=20
> =A0 =A0 sshd (220.229.161.171 ): 9 Time(s)=20
>=20
> [etc.]=20
> - - - -=20
>=20
> And this ....=20
>=20
> - - - -=20
> --------------------- SSHD Begin ------------------------=20
>=20
> Failed logins from these:=20
> =A0Aaliyah/password from 200.102.192.82: 5 Time(s)=20
> =A0Aaron/password from 200.102.192.82: 5 Time(s)=20
> =A0Aba/password from 200.102.192.82: 5 Time(s)=20
> =A0Abel/password from 200.102.192.82: 5 Time(s)=20
> =A0Chicago/password from 220.229.161.171: 6 Time(s)=20
> =A0Christ/password from 220.229.161.171: 3 Time(s)=20
> =A0Dakota/password from 220.229.161.171: 6 Time(s)=20
> =A0Jewel/password from 200.102.192.82: 5 Time(s)=20
> =A0Jordan/password from 220.229.161.171: 6 Time(s)=20
>=20
> [etc.]=20
> - - -=20
>=20
> And this ...=20
>=20
> - - -=20
> **Unmatched Entries**=20
> Illegal user zena from 220.229.161.171=20
> Illegal user zena from 220.229.161.171=20
> Illegal user purple from 220.229.161.171=20
> Illegal user purple from 220.229.161.171=20
>=20
> [etc.]=20
> - - -=20
>=20
> Some of the lists are VERY long!=20
>=20
> Is there a reference guide somewhere that can help=20
> me interpret what the different categories and listed=20
> items mean and what action is advisable in each case?=20
>=20
> Thanks for any help on this.=20
>=20
> Best Wishes,=20
>=20
> PRODOS=20
>=20
> http://prodos.thinkertothinker.com=20
>=20
> -------------------------------------------------------=20
> SF.Net email is sponsored by:=20
> Tame your development challenges with Apache's Geronimo App Server. Dow=
nload=20
> it for free - -and be entered to win a 42" plasma tv or your very own=20
> Sony(tm)PSP. =A0Click here to play: http://sourceforge.net/geronimo.php=
=20
> -=20
> Forwarded by the Webmin mailing list at web...@li...=
.net=20
> To remove yourself from this list, go to=20
> http://lists.sourceforge.net/lists/listinfo/webadmin-list=20
------- End of Original Message -------

RE: [webmin-l] Understanding daily "LogWatch"?

[<dav...@da...>]

Do you know who this IP address belongs to?  Otherwise it may be some "hack"
program trying to get into your system using common names and "idiot"
passwords.  If you look at the pattern they are all 'common' first names,
most being hit for 5 times.

If the IP address isn't one you work with, I'd consider blocking the IP all
together.

David Coley
Codecipher

-----Original Message-----
From: web...@li...
[mailto:web...@li...] On Behalf Of
pr...@pr...
Sent: Sunday, September 18, 2005 7:23 PM
To: web...@li...
Subject: [webmin-l] Understanding daily "LogWatch"?

From: Prodos (Melbourne, Australia)

Good morning.

I receive a daily email from my WEBMIN server
called "LogWatch for prodos"

It starts off like this ....

- - -
################### LogWatch 4.3.2 (02/18/03) ####################
      Processing Initiated: Mon Sep 19 04:02:04 2005
      Date Range Processed: yesterday
    Detail Level of Output: 0
         Logfiles for Host: prodos
################################################################
- - -


... and then lists all sorts of things, such as this ....



- - -
sshd:
  Invalid Users:
     Unknown Account: 2614 Time(s)
  Authentication Failures:
     mail (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time(s)
     unknown (220.229.161.171 ): 2211 Time(s)
     root (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 85 Time(s)
     sshd (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time(s)
     nobody (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5
Time(s)
     nobody (220.229.161.171 ): 3 Time(s)
     sshd (220.229.161.171 ): 9 Time(s)

[etc.]
- - - -



And this ....



- - - -
--------------------- SSHD Begin ------------------------


Failed logins from these:
  Aaliyah/password from 200.102.192.82: 5 Time(s)
  Aaron/password from 200.102.192.82: 5 Time(s)
  Aba/password from 200.102.192.82: 5 Time(s)
  Abel/password from 200.102.192.82: 5 Time(s)
  Chicago/password from 220.229.161.171: 6 Time(s)
  Christ/password from 220.229.161.171: 3 Time(s)
  Dakota/password from 220.229.161.171: 6 Time(s)
  Jewel/password from 200.102.192.82: 5 Time(s)
  Jordan/password from 220.229.161.171: 6 Time(s)

[etc.]
- - -


And this ...


- - -
**Unmatched Entries**
Illegal user zena from 220.229.161.171
Illegal user zena from 220.229.161.171
Illegal user purple from 220.229.161.171
Illegal user purple from 220.229.161.171

[etc.]
- - -


Some of the lists are VERY long!

Is there a reference guide somewhere that can help
me interpret what the different categories and listed
items mean and what action is advisable in each case?


Thanks for any help on this.

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com









-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
-
Forwarded by the Webmin mailing list at web...@li...
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

-- 
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.11.1/104 - Release Date: 9/16/2005
 

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Joe C. <jo...@sw...>]

Roger B.A. Klorese wrote:
> Joe Cooper wrote:
> 
>> On a package manager equipped system (i.e. RPM), this decision is up 
>> to the package manager.  That's not the whole story for Webmin, 
>> though. Webmins RPM is a bit different than a standard RPM because it 
>> has to run on many many many platforms and work correctly on all of 
>> them....It makes a lot of decisions at install (and uninstall) time 
>> that most packages don't make.  But one thing it (or any other RPM) 
>> can't do is ask questions.  RPM has a standing law that a package 
>> install and uninstall must be fully scriptable...and asking a question 
>> kills that capability.
> 
> 
> 
> Then you always preserve data on deinstall, and tell the user that data 
> was kept and can be removed manually by <...>.

Yep.  You're probably quite right, and I hope I didn't come across as 
disagreeing with you.  It just doesn't work that way today.

>> So, in short, there's no way to ask if the user intends to delete 
>> configuration files in an RPM uninstall.  There is probably a way to 
>> make it not delete configuration files, though I'm not sure off-hand 
>> what it is.  Of course, if that had happened you would have 
>> reinstalled only to find you had the same configuration problem you 
>> had before and then you might be complaining because uninstalling 
>> didn't actually uninstall everything!  ;-)
> 
> Um, since the problem was specifically that the previous production 
> version did not properly set Webmin to restart on every boot, perhaps a 
> simple fix for that problem should have been posted instead of "helpful" 
> instructions to deinstall and reinstall.

I certainly didn't recommend that course of action!  I'm sorry someone 
did, and that I missed the chance to correct the bad advice.  I'll write 
up a FAQ about common "can't login", "ACLs are broken", and "you do not 
have access to any modules" problems--the solutions are often similar, 
and at least debugging the problems usually start in the same place.

BTW-Please note the smiley in my above comment.

>> There are a number of very good webmail packages available now (many 
>> of which weren't so good when Usermin first came along), and we'll 
>> likely support some of them in some kind of automated way for folks 
>> who want an alternative, but none of them will ever look/feel/behave 
>> in the same way as Webmin and Virtualmin and thus will always 
>> introduce a new level of complexity to the overall system that doesn't 
>> need to be there.
> 
> Yes, but 99% of the users of email services would never see any other 
> part of Webmin/Virtualmin -- only their web admins would.

Perhaps, though we're not primarily targeting "email services". 
Virtualmin isn't a very good fit on dedicated email servers, though 
Webmin would be very useful there (see the Cyrus/IMAP thread for my 
thoughts on the high volume mail server issue vs. the needs of a virtual 
hosting administration system).  I'm just as concerned with users coming 
up from Usermin as administrators going down from Webmin and Virtualmin 
(i.e. folks who start out as email users but end up being promoted to 
administrators...if they're already familiar with the interface 
conventions, it will be easier to grasp the new privileges).

I'm not saying there's anything wrong with other webmail software or 
that I have any opposition to offering multiple webmail packages, just 
that Usermin has its place, and we'll be doing what we can to insure 
that no one can ever say "This other webmail supports 
<feature-that-I-need> and Usermin doesn't".  So, someone can say "I like 
<blank> webmail better because it is more blue and has a toad for a 
mascot, so it is far superior"...but I'd like to make sure the feature 
set is top-notch.

>> Anyway, Usermin webmail is not a second-string part of the 
>> system...It's going to be getting some pretty big improvements in the 
>> next few weeks.
> 
> I still don't see what it has to do with the "min" part of the name.

Hehehe...The "min" has become tradition.  But it makes sense if you 
remember that Usermin allows a user to administer all of their own 
settings (spam settings, mail filters, auto-replies, address book, 
cronjobs, at jobs, files in their home directory, etc.).  It is still an 
administrative tool, it just doesn't wield the administrative power of 
Webmin.  Of course, the "min" might be intimidating for normal users, 
and simply calling it "Webmail" would be more obvious.  We'll be doing 
some real useability testing before too long (something 
Webmin/Usermin/Virtualmin has never really had to my knowledge), and all 
such questions will be better understood.

And, of course, no one is gonna force you to use Usermin just because 
you're using Webmin and Virtualmin.  It's not a law, they just happen to 
work really well together.  Feel free to grab Horde/IMP, as Craig so 
eloquently campaigned for, or OpenWebmail, or one of the dozens of other 
projects that do webmail.  Let us know what problems you run into and 
we'll try to help.  (But also let us know what you feel is lacking in 
Usermin...we'd like to fix it.)

Regards,
Joe

[webmin-l] Understanding daily "LogWatch"?

[<pr...@pr...>]

From: Prodos (Melbourne, Australia)

Good morning.

I receive a daily email from my WEBMIN server
called "LogWatch for prodos"

It starts off like this ....

- - -
################### LogWatch 4.3.2 (02/18/03) ####################
      Processing Initiated: Mon Sep 19 04:02:04 2005
      Date Range Processed: yesterday
    Detail Level of Output: 0
         Logfiles for Host: prodos
################################################################
- - -


... and then lists all sorts of things, such as this ....



- - -
sshd:
  Invalid Users:
     Unknown Account: 2614 Time(s)
  Authentication Failures:
     mail (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time(s)
     unknown (220.229.161.171 ): 2211 Time(s)
     root (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 85 Time(s)
     sshd (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5 Time(s)
     nobody (200-102-192-82.cslce7005.t.brasiltelecom.net.br ): 5
Time(s)
     nobody (220.229.161.171 ): 3 Time(s)
     sshd (220.229.161.171 ): 9 Time(s)

[etc.]
- - - -



And this ....



- - - -
--------------------- SSHD Begin ------------------------


Failed logins from these:
  Aaliyah/password from 200.102.192.82: 5 Time(s)
  Aaron/password from 200.102.192.82: 5 Time(s)
  Aba/password from 200.102.192.82: 5 Time(s)
  Abel/password from 200.102.192.82: 5 Time(s)
  Chicago/password from 220.229.161.171: 6 Time(s)
  Christ/password from 220.229.161.171: 3 Time(s)
  Dakota/password from 220.229.161.171: 6 Time(s)
  Jewel/password from 200.102.192.82: 5 Time(s)
  Jordan/password from 220.229.161.171: 6 Time(s)

[etc.]
- - -


And this ...


- - -
**Unmatched Entries**
Illegal user zena from 220.229.161.171
Illegal user zena from 220.229.161.171
Illegal user purple from 220.229.161.171
Illegal user purple from 220.229.161.171

[etc.]
- - -


Some of the lists are VERY long!

Is there a reference guide somewhere that can help
me interpret what the different categories and listed
items mean and what action is advisable in each case?


Thanks for any help on this.

Best Wishes,

PRODOS

http://prodos.thinkertothinker.com

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Roger B.A. K. <ro...@qu...>]

Joe Cooper wrote:

> On a package manager equipped system (i.e. RPM), this decision is up 
> to the package manager.  That's not the whole story for Webmin, 
> though. Webmins RPM is a bit different than a standard RPM because it 
> has to run on many many many platforms and work correctly on all of 
> them....It makes a lot of decisions at install (and uninstall) time 
> that most packages don't make.  But one thing it (or any other RPM) 
> can't do is ask questions.  RPM has a standing law that a package 
> install and uninstall must be fully scriptable...and asking a question 
> kills that capability.


Then you always preserve data on deinstall, and tell the user that data 
was kept and can be removed manually by <...>.

> So, in short, there's no way to ask if the user intends to delete 
> configuration files in an RPM uninstall.  There is probably a way to 
> make it not delete configuration files, though I'm not sure off-hand 
> what it is.  Of course, if that had happened you would have 
> reinstalled only to find you had the same configuration problem you 
> had before and then you might be complaining because uninstalling 
> didn't actually uninstall everything!  ;-)


Um, since the problem was specifically that the previous production 
version did not properly set Webmin to restart on every boot, perhaps a 
simple fix for that problem should have been posted instead of "helpful" 
instructions to deinstall and reinstall.


> There are a number of very good webmail packages available now (many 
> of which weren't so good when Usermin first came along), and we'll 
> likely support some of them in some kind of automated way for folks 
> who want an alternative, but none of them will ever look/feel/behave 
> in the same way as Webmin and Virtualmin and thus will always 
> introduce a new level of complexity to the overall system that doesn't 
> need to be there.


Yes, but 99% of the users of email services would never see any other 
part of Webmin/Virtualmin -- only their web admins would.

> Anyway, Usermin webmail is not a second-string part of the 
> system...It's going to be getting some pretty big improvements in the 
> next few weeks.



I still don't see what it has to do with the "min" part of the name.

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Joe C. <jo...@sw...>]

Roger B.A. Klorese wrote:
> Joe Cooper wrote:
> 
>> Hey Roger,
>>
>> I know it's too late for you in this case, but I'd like to chime in 
>> here to state emphatically that one should /never/ uninstall/reinstall 
>> a previously working piece of server software that has be configured 
>> for your environment in order to try to fix a problem with that 
>> software (any problem).  Something like Webmin has dozens of 
>> configuration files that will be removed during the uninstallation 
>> process, and sometimes their removal can be very uncomfortable... 
> 
> Most software products that require configuration files, registry 
> settings, etc. exither explcitly ask if you intend to delete the 
> configuration, or remove only the software and leave the configuration.

On a package manager equipped system (i.e. RPM), this decision is up to 
the package manager.  That's not the whole story for Webmin, though. 
Webmins RPM is a bit different than a standard RPM because it has to run 
on many many many platforms and work correctly on all of them....It 
makes a lot of decisions at install (and uninstall) time that most 
packages don't make.  But one thing it (or any other RPM) can't do is 
ask questions.  RPM has a standing law that a package install and 
uninstall must be fully scriptable...and asking a question kills that 
capability.

So, in short, there's no way to ask if the user intends to delete 
configuration files in an RPM uninstall.  There is probably a way to 
make it not delete configuration files, though I'm not sure off-hand 
what it is.  Of course, if that had happened you would have reinstalled 
only to find you had the same configuration problem you had before and 
then you might be complaining because uninstalling didn't actually 
uninstall everything!  ;-)

>> Losing all of that data is a much bigger problem than the very small 
>> problem of not being able to login.
> 
> 
> 
> Actually, since we don't use subdomains, child sites or email -- 
> basically, use Virtualmin just as a simple website templating -- it was 
> no big calamity.

Good!  I'm glad to hear it.

>> Beyond that, the solution is definitely not blank passwords.  ;-)
> 
> 
> 
> Um, blank passwords ON THE IMPORT.
> 
> The accounts already exist, and we are using Unix authentication.  So 
> the only use for the stored passwords is proper applciaiton to the 
> managed database.  That should be achievable by having the users change 
> their passwords to the current password.

Ah, I see.  Yes, if you're importing them under the control of existing 
users, then all should be fine.  I misunderstood your intention.

> (As for your not usinmg MySQL -- well, sure, I don't use webmail, and 
> for that matter, don't understand why you guys even bothered to include 
> it when there are so many other webmail packages...!)

Integration is a lovely thing.  With Usermin we get common themes, 
common administrative interface, code re-use in a lot of different 
modules, a single set of interface conventions, etc.  A lot of 
useability folks consider consistency to be the single more important 
aspect of ease of use.  So, if every tier of a hosting system is the 
same core software, useability should be much better than if there are 
several different components with different look and feel and different 
usage conventions.  There are a number of very good webmail packages 
available now (many of which weren't so good when Usermin first came 
along), and we'll likely support some of them in some kind of automated 
way for folks who want an alternative, but none of them will ever 
look/feel/behave in the same way as Webmin and Virtualmin and thus will 
always introduce a new level of complexity to the overall system that 
doesn't need to be there.  (BTW-The new Virtualmin-Nuvola theme for 
Usermin makes Usermin look as good as just about any webmail on the 
market...We just need to make sure all of the functionality, which is 
also top-notch, is easy to understand and use.)

Anyway, Usermin webmail is not a second-string part of the system...It's 
going to be getting some pretty big improvements in the next few weeks.

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Roger B.A. K. <ro...@qu...>]

Joe Cooper wrote:

> Hey Roger,
>
> I know it's too late for you in this case, but I'd like to chime in 
> here to state emphatically that one should /never/ uninstall/reinstall 
> a previously working piece of server software that has be configured 
> for your environment in order to try to fix a problem with that 
> software (any problem).  Something like Webmin has dozens of 
> configuration files that will be removed during the uninstallation 
> process, and sometimes their removal can be very uncomfortable...



Most software products that require configuration files, registry 
settings, etc. exither explcitly ask if you intend to delete the 
configuration, or remove only the software and leave the configuration.

> Losing all of that data is a much bigger problem than the very small 
> problem of not being able to login.


Actually, since we don't use subdomains, child sites or email -- 
basically, use Virtualmin just as a simple website templating -- it was 
no big calamity.

> Beyond that, the solution is definitely not blank passwords.  ;-)


Um, blank passwords ON THE IMPORT.

The accounts already exist, and we are using Unix authentication.  So 
the only use for the stored passwords is proper applciaiton to the 
managed database.  That should be achievable by having the users change 
their passwords to the current password.

> I might be wrong about my assertions (I don't manage any servers with 
> heavy, or possibly even any, MySQL usage...so I might be missing some 
> of the nuances of the situation), but I'm sure we can get it all 
> resolved without too much pain or opening up your server to the 
> insecurity of blank passwords (which would still be subject to the 
> same problems temporary passwords would have). 


Again, unless I misunderstand something, importing with a blank 
password, especially when set for Unix authentication, does not provide 
any securiy risk.

(As for your not usinmg MySQL -- well, sure, I don't use webmail, and 
for that matter, don't understand why you guys even bothered to include 
it when there are so many other webmail packages...!)

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Joe C. <jo...@sw...>]

Hey Roger,

I know it's too late for you in this case, but I'd like to chime in here 
to state emphatically that one should /never/ uninstall/reinstall a 
previously working piece of server software that has be configured for 
your environment in order to try to fix a problem with that software 
(any problem).  Something like Webmin has dozens of configuration files 
that will be removed during the uninstallation process, and sometimes 
their removal can be very uncomfortable...While Webmin modules don't 
store a lot of necessary state data in /etc/webmin, Virtualmin does (it 
has to because of what it does--it is a wholly different mindset from 
Webmin's one-to-one presentation of system configuration 
files...Virtualmin is itself a complex piece of software with its own 
configuration and lots of state data that is unique to Virtualmin). 
Losing all of that data is a much bigger problem than the very small 
problem of not being able to login.

If you have backups of /etc/virtualmin, you can restore everything, 
including passwords.  If you don't, getting a good backup policy is your 
first step.

Beyond that, the solution is definitely not blank passwords.  ;-)

You can set temporary passwords for each user, and ask them to login 
with that password to reset to their previous password.  I don't believe 
password syncrhonization will be a problem, even if the user opts to 
change the password to something entirely different, as MySQL user 
passwords are changed by the root user.  There are some situations where 
Virtualmin needs to have the plain text password, but that isn't one of 
them.  Anyway, try it out with one test account and let us know what 
happens.  If password synching does prove to be a problem, we'll 
probably be able to help you resolve it.  I might be wrong about my 
assertions (I don't manage any servers with heavy, or possibly even any, 
MySQL usage...so I might be missing some of the nuances of the 
situation), but I'm sure we can get it all resolved without too much 
pain or opening up your server to the insecurity of blank passwords 
(which would still be subject to the same problems temporary passwords 
would have).

Roger B.A. Klorese wrote:
> Would I be correct in:
> - disabling the option to set the MySQL password to agree with the user 
> password
> - importing the servers with a blank password
> - re-enabling the password synchronization
> - telling users to log in and change their passwords to the current value
> ...so Webmin could save the password for future database uses?
> 
> 
> Vernon J. Spangler wrote:
> 
>> There are actually two different methods I would have attempted but 
>> one that
>> is crucial. First is to always make backup. Since Virtualmin has a backup
>> utility you should use it before you make any changes to your server.
>>
>> When changing the version of Webmin you have two choices you can make.
>> 1. This is to upgrade the by using the Webmin section of the web 
>> interface
>> and going to the Webmin configuration. This is the one I would recommend
>> doing before any sudden changes.
>> 2. Uninstall and re-install Webmin after having made all the backups.
>>
>> You can still recover the Virtualmin accounts by using the import 
>> feature of
>> the module. Granted it may require you to reset the passwords and you may
>> run into errors with the passwords with SQL portion. But you 
>> technically did
>> not loose the users or the actual information. Recovery is a pain staking
>> event but it does teach a vital lesson. Backups and logs are your 
>> friend. I
>> understand that this does not resolve the actual issue with the
>> fail-to-restart but at least you will have a better ideal when 
>> upgrading and
>> some weight off your shoulders on the lost accounts.

Re: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Roger B.A. K. <ro...@qu...>]

Would I be correct in:
- disabling the option to set the MySQL password to agree with the user 
password
- importing the servers with a blank password
- re-enabling the password synchronization
- telling users to log in and change their passwords to the current value
...so Webmin could save the password for future database uses?


Vernon J. Spangler wrote:

>There are actually two different methods I would have attempted but one that
>is crucial. First is to always make backup. Since Virtualmin has a backup
>utility you should use it before you make any changes to your server.
>
>When changing the version of Webmin you have two choices you can make.
>1. This is to upgrade the by using the Webmin section of the web interface
>and going to the Webmin configuration. This is the one I would recommend
>doing before any sudden changes.
>2. Uninstall and re-install Webmin after having made all the backups.
>
>You can still recover the Virtualmin accounts by using the import feature of
>the module. Granted it may require you to reset the passwords and you may
>run into errors with the passwords with SQL portion. But you technically did
>not loose the users or the actual information. Recovery is a pain staking
>event but it does teach a vital lesson. Backups and logs are your friend. I
>understand that this does not resolve the actual issue with the
>fail-to-restart but at least you will have a better ideal when upgrading and
>some weight off your shoulders on the lost accounts.
>
>------------------------------------------
>Vernon J. Spangler
>http://www.vernonspangler.org/
>(520) 512-8410 Home
>(520) 990-1863 Cell
>ve...@ve...
>------------------------------------------
>  Powered by Windows XP Professional
>    Sent by Microsoft Outlook 2003
>
>-----Original Message-----
>From: Roger B.A. Klorese [mailto:ro...@qu...] 
>Sent: Sunday, September 18, 2005 12:24 AM
>To: web...@li...
>Subject: [webmin-l] Virtualmin Deinstall/Install losing configuration
>
>In order to address the fails-to-restart issue, I deinstalled Webmin 
>1.220 and installed 1.226... which then required that I install 
>Virtualmin... which then lost my 60+ defined virtual servers.
>
>Any idea what I did wrong so it doesn't happen again?
>
>
>
>
>
>
>
>
>-------------------------------------------------------
>SF.Net email is sponsored by:
>Tame your development challenges with Apache's Geronimo App Server. Download
>it for free - -and be entered to win a 42" plasma tv or your very own
>Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
>-
>Forwarded by the Webmin mailing list at web...@li...
>To remove yourself from this list, go to
>http://lists.sourceforge.net/lists/listinfo/webadmin-list
>  
>

RE: [webmin-l] Virtualmin Deinstall/Install losing configuration

[Vernon J. S. <ve...@ve...>]

There are actually two different methods I would have attempted but one that
is crucial. First is to always make backup. Since Virtualmin has a backup
utility you should use it before you make any changes to your server.

When changing the version of Webmin you have two choices you can make.
1. This is to upgrade the by using the Webmin section of the web interface
and going to the Webmin configuration. This is the one I would recommend
doing before any sudden changes.
2. Uninstall and re-install Webmin after having made all the backups.

You can still recover the Virtualmin accounts by using the import feature of
the module. Granted it may require you to reset the passwords and you may
run into errors with the passwords with SQL portion. But you technically did
not loose the users or the actual information. Recovery is a pain staking
event but it does teach a vital lesson. Backups and logs are your friend. I
understand that this does not resolve the actual issue with the
fail-to-restart but at least you will have a better ideal when upgrading and
some weight off your shoulders on the lost accounts.

------------------------------------------
Vernon J. Spangler
http://www.vernonspangler.org/
(520) 512-8410 Home
(520) 990-1863 Cell
ve...@ve...
------------------------------------------
  Powered by Windows XP Professional
    Sent by Microsoft Outlook 2003

-----Original Message-----
From: Roger B.A. Klorese [mailto:ro...@qu...] 
Sent: Sunday, September 18, 2005 12:24 AM
To: web...@li...
Subject: [webmin-l] Virtualmin Deinstall/Install losing configuration

In order to address the fails-to-restart issue, I deinstalled Webmin 
1.220 and installed 1.226... which then required that I install 
Virtualmin... which then lost my 60+ defined virtual servers.

Any idea what I did wrong so it doesn't happen again?

[webmin-l] Virtualmin Deinstall/Install losing configuration

[Roger B.A. K. <ro...@qu...>]

In order to address the fails-to-restart issue, I deinstalled Webmin 
1.220 and installed 1.226... which then required that I install 
Virtualmin... which then lost my 60+ defined virtual servers.

Any idea what I did wrong so it doesn't happen again?

Re: [webmin-l] webmin BIND dns setup

[Joe C. <jo...@sw...>]

Hi James,

Vernon's pointer to my books BIND chapter and additional BIND 
documentation will be a good start.  Once you've gotten started, you'll 
have some ideas for what specific questions you need to ask.  It's 
nearly impossible for us to answer such an open-ended question--there 
are books written about configuring BIND because it is a very big topic 
(the indisputable best book being the O'Reilly book "DNS and BIND" by 
Cricket Liu and Paul Albitz, which I highly recommend to every system 
administrator...it's probably the first book a system administrator 
should add to his or her collection).

I also wanted to add that you should upgrade to the latest version of 
Webmin.  1.170 is a bit old.  The latest version 1.220 will have fewer 
bugs, have more features, and possibly have security fixes (though I 
don't recall any specific security issues since that version) over 1.170.

James W. Davis wrote:
> Hi I'm wanting to have my gentoo server also control my DNS for my 
> sites. I was wondering if someone could provide me a secure settings 
> that I could replace the ips from and then let my dns be handled by my 
> server.
> 
> currently i'm using zoneedit for my dns and if they are laging so is my 
> site.
> 
> James
> 
> p.s. in the lower left corner it says "*Version 1.170 on Pro (Gentoo 
> Linux)"*

RE: [webmin-l] webmin BIND dns setup

[Vernon J. S. <ve...@ve...>]

Maybe this will give you some help.

Virtualmin
http://www.swelltech.com/support/virtual-servers/

Webmin
http://www.swelltech.com/support/webminguide-1.0/ch08.html

Bind
http://sxs.thexdershome.com/internet_serving/dns.html
http://www.dns.net/dnsrd/docs/bog/bog.html


------------------------------------------
Vernon J. Spangler
http://www.vernonspangler.org/
(520) 512-8410 Home
(520) 990-1863 Cell
ve...@ve...
------------------------------------------
=A0 Powered by Windows XP Professional
=A0=A0=A0 Sent by Microsoft Outlook 2003
________________________________________
From: James W. Davis [mailto:jam...@gm...]=20
Sent: Saturday, September 17, 2005 6:03 PM
To: web...@li...
Subject: [webmin-l] webmin BIND dns setup

Hi I'm wanting to have my gentoo server also control my DNS for my =
sites. I
was wondering if someone could provide me a secure settings that I could
replace the ips from and then let my dns be handled by my server.

currently i'm using zoneedit for my dns and if they are laging so is my
site.

James

p.s. in the lower left corner it says "Version 1.170 on Pro (Gentoo =
Linux)"=20

[webmin-l] webmin BIND dns setup

[James W. D. <jam...@gm...>]

Hi I'm wanting to have my gentoo server also control my DNS for my sites. I
was wondering if someone could provide me a secure settings that I could
replace the ips from and then let my dns be handled by my server.

currently i'm using zoneedit for my dns and if they are laging so is my
site.

James

p.s. in the lower left corner it says "*Version 1.170 on Pro (Gentoo Linux)=
"
*