Package: webmin
Version: 1.180-1
Severity: important
There isn't sufficient instructions in the README.Debian file explaining
how to change the root password. It says the following:
"Be sure to set the access controls as soon as possible. By default an account
called root is setup with your real root password. It is a very good idea to
change this username/password to something completely different so on the
remote chance someone is able to crack webmin, they will not have root access
to your server.
See update-webmin(8) for additional information."
The manual page for update-webmin has almost nothing in it, and definitely
nothing that explains anything about how to set a password.
I next tried looking at the webmin interface itself:
Webmin 1.180 on charly.exon.dyndns.org (Debian GNU/Linux 3.0)
Webmin 1.180 on charly.exon.dyndns.org (Debian GNU/Linux 3.0) Debian
GNU/Linux
Version 1.180 on charly.exon.dyndns.org (Debian GNU/Linux 3.0)
_________________________________________________________________
Webmin System Networking Hardware Others
Change Language and Theme
Usermin Configuration
Webmin Actions Log
Webmin Configuration
Webmin Servers Index
Webmin Users
_________________________________________________________________
Logout
Hmm, no optoin to change a password there. Let's try "Webmin Configuration":
Webmin Configuration (p1 of 2)
Webmin Index
Module Config
W e b m i n C o n f i g u r a t i o n
Webmin version 1.180
_________________________________________________________________
IP Access Control
Ports and Addresses
Logging
Proxy Servers
User Interface
Webmin Modules
Operating System and Environment
Language
Index Page Options
Upgrade Webmin
Authentication
Reassign Modules
Edit Categories
Webmin Themes
Trusted Referrers
Anonymous Module Access
File Locking
SSL Encryption
Certificate Authority
_________________________________________________________________
Start at boot time (*) Yes ( ) No Change this option to control
whether Webmin is started at boot time or not. If it is not currently
started at boot and Yes is chosen, a new init script will be created.
Restart Webmin Click this button to re-start the Webmin server
process. This may be necessary if you have recently upgraded Perl.
_________________________________________________________________
Wow, still nothing about passwords. Let's try "Authentication":
Authentication (p1 of 3)
Webmin Index
Module Index
A u t h e n t i c a t i o n
_________________________________________________________________
When enabled, password timeouts protect your Webmin server from
brute-force password cracking attacks by adding a continuously
expanding delay between each failed login attempt for the same user.
When session authentication is enabled, each logged in users' session
will be tracked by Webmin, making it possible for idle users to be
automatically logged out. Be aware that enabling or disabling session
authentication may force all users to re-login.
Authentication and session options
( ) Disable password timeouts
(*) Enable password timeouts
[X] Block hosts with more than 3___ failed logins for 300_
seconds.
[X] Log blocked hosts, logins and authentication failures to syslog
( ) Disable session authentication
(*) Enable session authentication
[X] Auto-logout after 5_________ minutes of inactivity
[X] Offer to remember login permanently?
[X] Show hostname on login screen?
[ ] Show real hostname instead of name from URL?
(*) No pre-login page ( ) Show pre-login file
______________________________ [BUTTON]
(*) Always require username and password
( ) Allow login without password for matching users from localhost
(*) Use PAM for Unix authentication, if available
( ) Never use PAM for Unix authentication
If PAM is unavailable or disabled, read users and passwords from
file ____________________ columns __ and __
When using Unix authentication ..
(*) Always deny users with expired passwords
( ) Always allow users with expired passwords
( ) Prompt users with expired passwords to enter a new one
External squid-style authentication program
________________________________________
(*) Use standard Unix crypt encryption for Webmin passwords
( ) Use MD5 encryption for Webmin passwords (allows long passwords)
Save
_________________________________________________________________
Lots of stuff about passwords, but no way to *change* them. As you
say in the README.Debian, it really is crucial that users set this stuff
up properly. If they're clueless, they really can't be left to flounder
around for themselves, because they'll just get it wrong and leave their
machine open to be 0W|\|3D by any twat who can use Google. And then we
all get the spam relayed through their machine.
-- System Information:
Debian Release: 3.1
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (i586)
Kernel: Linux 2.6.8-2-386
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
Versions of packages webmin depends on:
ii debconf 1.4.30.11 Debian configuration management sy
ii libauthen-pam-perl 0.14-1 This module provides a Perl interf
ii libnet-ssleay-perl 1.25-1.1 Perl module for Secure Sockets Lay
ii libpam-runtime 0.76-22 Runtime support for the PAM librar
ii openssl 0.9.7e-2 Secure Socket Layer (SSL) binary a
ii perl 5.8.4-6 Larry Wall's Practical Extraction
-- debconf information:
* webmin/passwordexplanation:
* webmin/hostname: webmin
webmin/upgradewarning:
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
