| SYSTEM INFORMATION | |
|---|---|
| OS type and version | Ubuntu 24.04.5 LTS (GNU/Linux 6.8.0-139-generic x86_64) |
| Usermin version | 2.570 |
| Webmin version | 2.670 |
| Virtualmin version | 8.2.0 GPL |
| Webserver version | nginx/1.24.0 (Ubuntu) |
| Related packages | awstats 7.9 (build 20230108) |
Hi all,
As always. Thanks for great software. 
Just posting an issue here following on from a prior thread, where it was noticed /awstats links were not being protected.
I think the core issue is that Virtualmin does not add the requisite nginx conf by default, and hence the issue still exists for new domains added.
I can reproduce on fresh server with specs above: Newly added domains leave awstats exposed to the world/unprotected, even though “password protect Awstats web page” is set to Yes in Virtualmin → System Settings → Server Templates → Default Settings → Website for Domain:
Virtualmin → Web Configuration → Protected Directories is empty after creating new domain:
And the nginx conf for the added domain misses the required auth block:
rewrite /awstats/awstats.pl /cgi-bin/awstats.pl;
instead of
rewrite /awstats/awstats.pl /cgi-bin/awstats.pl;
location /awstats {
auth_basic awstats;
auth_basic_user_file /home/foo/public_html/awstats/.htpasswd;
location ~ "/\.htpasswd$" {
deny all;
}
}
It’s either confusing/misleading from UI perspective that new sites don’t have password protection deployed when using this template and require manual configuration afterwards (if this is indeed intentional), or, it’s a bug. 