Can you clear up some security/https questions?

[christophera]

Hi all,

I’ve been using Virtualmin, either gpl or pro, for decades Love it.

However, I’m always annoyed by the security warning I get when I access it.

I access through the ip address such as https://111.11.11.11:10000 (though I usually change the port number and it redirects to http).

I was switching to a new host so redoing my virtualmin setup, wondered if there were a better way of access it securely, and found this:

Configure SSL for virtualmin dashboard

Who told you that? It’s fine. You can connect to Virtualmin on any domain name you want. It listens on every IP on the system, by default. Names don’t matter. The hostname of the system should not be a name you are hosting with Virtualmin. That’s pretty danged important, but it’s irrelevant to how you connect to Virtualmin.

1. That post indicates that I can access virtualmin through any domain… but how? It doesn’t work to do mydomain.com:10000

2. Also, Joe says there that the system hostname should not be hosted on virtualmin… and says that is important. I always thought the hostname had to be resolvable to the same IP that virtualmin was on. Apparently I’ve had it screwed up for a long time. Should the hostname be resolvable to an ip, and if so… which, if not the same as the server with virtualmin? Doesn’t that play a role in email validation?

Thanks for any enlightenment,

Chris

[Ilia]

Hello, Chris!

@christophera

That post indicates that I can access virtualmin through any domain… but how? It doesn’t work to do mydomain.com:10000

You should request a free Let’s Encrypt SSL certificate for your domain using Manage Virtual Server ⇾ Setup SSL Certificate page.

@christophera

Joe says there that the system hostname should not be hosted on virtualmin… and says that is important. I always thought the hostname had to be resolvable to the same IP that virtualmin was on

This is not what he said. Joe said that you shouldn’t create a domain name in Virtualmin (i.e. Create Virtual Server) that matches your hostname or in particular enable mail for this domain, if created.

[christophera]

You should request a free Let’s Encrypt SSL certificate for your domain using Manage Virtual Server ⇾ Setup SSL Certificate page

My domain does have a cert, all of the domains on the server do, but how do I access the server’s Virtualmin console through the domains?

This is not what he said. Joe said that you shouldn’t create a domain name in Virtualmin (i.e. Create Virtual Server ) that matches your hostname or in particular enable mail for this domain, if created.

Okay, do I understand this correctly? The hostname should point to the server’s ip address, but not have a domain created for it in Virtualmin?

Thanks for the help understanding this Ilia,

Chris

[jimr1]

@christophera

how do I access the server’s Virtualmin console through the domains

Use https://domainname.tld:10000 that works for me

[christophera]

Yep, that has never worked for me, I just get a “this site can’t be reached, took too long to respond” using my domain name and the port like that. Using the ip address and the port brings it right up, but not securely,

Chris

[Ilia]

@christophera

The hostname should point to the server’s ip address

Yes, of course it should point to the server’s IP address.

@christophera

not have a domain created for it in Virtualmin?

Yes, though if you create a domain, don’t enable mail for it.

[Joe]

@christophera

Yep, that has never worked for me, I just get a “this site can’t be reached, took too long to respond” using my domain name and the port like that. Using the ip address and the port brings it right up, but not securely,

That probably means you don’t have DNS A record(s) for those names in the authoritative name servers for the zone. Nothing can work if you don’t have working DNS.

[christophera]

Ah, okay, I’ve never quite known why I would need the dns server turned on in Virtualmin when I use Cloudflare to set the dns records.

Is this why, or am I just totally lost on how it works

Chris

[Joe]

@christophera

Ah, okay, I’ve never quite known why I would need the dns server turned on in Virtualmin when I use Cloudflare to set the dns records.

Oh.

Cloudflare. sigh.

You do not need DNS in Virtualmin, you just need DNS. But, Cloudflare is a proxy and it does not proxy for port 10000. You’ll have to move Webmin to another port or setup some names that are not being proxied through a proxy that does not proxy port 10000.

You should really mention that you’re behind a proxy when posting questions like this. It matters a lot. (This is mentioned in the guidelines: https://forum.virtualmin.com/guidelines)

Edit: Sorry I’m being grumpy. My frustration should actually be directed at Cloudflare rather than Cloudflare users. They aren’t very upfront about proxying being what they’re doing, and so we get a lot of users not understanding that by using Cloudflare they are behind a proxy and they need to understand the implications of running services behind a proxy.

[christophera]

Apologies accepted, I was picking up on some grumpiness from both you and Ilia and was a bit embarrassed in the first place to admit that I’ve had this question for over a decade and I’m just now trying to understand it.

And yeh, I’ve been using Virtualmin for probably close to two decades, so it’s been a looooong time since I looked at the forum guidelines

I knew that Clouldflare was a proxy, but did not know the implications of how it affected the console access.

My goal was just to ask and learn, and I’ve done that, and I appreciate the help and the software, I’ll probably be picking up a pro license again soon,

Chris

[christophera]

Oh, interesting…

After some Googling, I found that Cloudflare allows access to port 2083 so that people can use it for accessing cpanel.

I switched Virtualmin to listen on that port and I can access it through my (https) domain with :2083 appended and that appears to work.

Do you see any issues or anything I should be aware of using it like that?

Chris

edit: there are some other open https ports as well: Network ports · Cloudflare Fundamentals docs

[Joe]

That should be fine. Webmin doesn’t care what port it’s on.

You should be aware that fast API calls won’t work across a proxied connection, so if you have multiple Webmin servers that are working together on something, you’ll need to either give them hostnames that aren’t being proxied or disable fast RPC.

I’m also curious if the Terminal works through a proxied connection? I think the way Jamie implemented it will work (I think it’s a local socket and Webmin is proxying the WebSockets connection to it), but I’m not sure if it needs any other ports.

[christophera]

Thanks Joe,

It’s just me and sites I manage, so slow API calls are not an issue.

I just tested the Terminal and it does not work connecting this way (it was earlier when I was just using the ip and used it to check on something). I get:

“Failed loading terminal : WebSocket connection error.”

I use a desktop terminal most of the time anyway (termius), so that’s not really a concern for me, but I’m sure it would be for some.

Thanks again,

Chris

[Joe]

@christophera

it was earlier when I was just using the ip and used it to check on something

The IP is not proxied.

[christophera]

Yep, I just wanted to make clear that was the only difference, it works with the unproxied ip, not with the proxied domain name

Chris

[forlotto]

Couldn’t you setup your domain in your hosts file from the PC you are accessing it from to have the domain point to that IP and have it work just the same errr IDK I would think it would work but don’t have the problem.