Webmin 1.890 Exploit – What Happened?

Re:Webmin 1.890 Exploit – What Happened? by nevi-me on Sunday August 25, 2019 @04:29PM (#20795360)

Wow! This is scary. I used webmin many years ago on one of my servers, and seeing this reminded me that it's still running.

I was running 1.881, and I'm at least glad I never updated to the 1.890. While I haven't needed to change network interfaces or any hardware related change, I still think it's worthwhile keeping it.

Thanks edwintorok for sharing this. I've patched and disabled webmin, I'll temporarily enable it if/when I need it. Yes, I could do everything through the terminal, but a GUI's still useful in the case where I can't remember/don't know the terminal way of doing something.

[ Parent | on HN ]

Re:Webmin 1.890 Exploit – What Happened? by ohyeshedid on Sunday August 25, 2019 @07:35PM (#20796383)

You may want to look into Cockpit.[1]

While there are other panels out there, Cockpit is sponsored by Red Hat. I'm not a fan of panels, but it offers more functionality out of the box than Webmin. Last time I looked there was some pretty large gaps in functionality outside of a Red Hat environment; the Ubuntu package was missing container management.

[1]: https://cockpit-project.org/

[ Parent | on HN ]

Re:Webmin 1.890 Exploit – What Happened? by wazoox on Monday August 26, 2019 @08:18AM (#20799178)

The problem with cockpit is that it lacks almost everything, while webmin has modules for almost everything. I regularly look for webmin alternatives, and though there exist a couple of nicer, cleaner ones none has more than 5% of webmin's functionality.

[ Parent | on HN ]