3

I’m using a vanilla Webmin / Virtualmin 3.93 GPL version on Centos 6. I’ve created a new user that has full privileges on Webmin, so now I want to disallow root from logging in, as obviously it could be a security issue.

Does anyone know how to do this? There must be an option for this somewhere but maybe I can’t see the wood for the trees.

I’ve disabled root SSH login manually, but I still can login to Webmin using the root account.

Palec
  • 12,743
  • 8
  • 69
  • 138
totallyNotLizards
  • 8,489
  • 9
  • 51
  • 85
  • 1
    This is off topic here at Stack Overflow. You probably meant to ask it over on Server Fault or maybe Super User instead. Regardless, Webmin uses its own internal list of valid users. Check out the Webmin Users item under the Webmin category under the left menu (assuming you're using the new theme). You should be able to manage users that can log in from there, including disabling the account named "root." – Charles Aug 16 '12 at 16:15
  • yeah ok it might be off-topic but questions about webmin get downvoted into oblivion on serverfault, which is why I didn't ask it there. I could try on super user, will take a look in a mo – totallyNotLizards Aug 16 '12 at 16:18

3 Answers3

4

Thanks to @Charles for the pointers.

To remove the root user from Webmin, log in as a user with administrator privileges and click on Webmin -> Webmin Users. In the list of users, either delete or remove all privileges from the root user.

After removing that user I could log in as my new administrator user and administer the server but not log in as root.

Problem solved, security through obscurity but still better than nothing.

totallyNotLizards
  • 8,489
  • 9
  • 51
  • 85
  • 5
    I think it is important to note that you should clone the root user first, THEN login as that user before deleting the root. – degenerate Nov 28 '12 at 16:08
4

Click on the Webmin tab, expand the Webmin section and select Webmin User. Then select the root user. Expand Security and Limit Options and select Only allow from listed addresses for IP Access Control. Enter the loopback address(127.0.0.1) into the field. The root user will still exist, but will be unable to login.

Arthur Walker
  • 125
  • 10
0

In Webmin -> Webmin Users click root and rename it to the username you use.

Pete
  • 1,191
  • 12
  • 19