Hardening questions

Virtualmin
1
SYSTEM INFORMATION
OS type and version RHEL 10
Webmin version latest
Virtualmin version latest
Webserver version Apache latest
Related packages SUGGESTED

Hello everyone,

I’m new to Virtualmin after spending more than 10 years using DirectAdmin. I decided to move to Virtualmin because I wanted a solution that is more open source and gives me more flexibility.

I’m currently deploying a new server on RHEL 10 and I’d like to harden the system configuration before putting it into production.

These are some of the hardening measures that I usually apply on my DirectAdmin servers:

Filesystem mounts

  • /tmp mounted with: defaults,noexec,nosuid,nodev
  • /var/tmp mounted with: defaults,noexec,nosuid,nodev
  • /dev/shm mounted with: defaults,noexec,nosuid,nodev

PHP configuration

expose_php = Off
html_errors = Off

disable_functions = exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname

allow_url_fopen = Off

max_execution_time = 30
max_input_time = 60
default_socket_timeout = 60
memory_limit = 128M
post_max_size = 64M

php_admin_value[open_basedir] = /home/$USER/public_html:/tmp:/var/tmp:/dev/urandom:/usr/share/pear:/usr/share/php

BIND configuration

allow-recursion { localhost; };
allow-query     { any; };

My main question is whether any of these changes, especially the /tmp, /var/tmp and /dev/shm mount options (noexec, nosuid, nodev), could interfere with the normal operation of Virtualmin, Webmin, or any of the services typically managed by Virtualmin.

Are there any known compatibility issues or recommended adjustments when applying these hardening settings on a Virtualmin server?

Thank you for your advice and feedback.

2

At the very least, you can’t make that change until after Webmin and Virtualmin are installed. (And, I doubt this change provides meaningful security.)

3

Just as a follow-up for anyone interested in applying these hardening options:

I’ve been running this exact configuration on my test server for about a week now, and everything has been working flawlessly so far. I haven’t encountered any issues, regressions, or unexpected behavior.

One important note: I applied all of these hardening changes after installing Virtualmin. As Joe mentioned, applying them beforehand prevents the installation from completing successfully.

Of course, every environment is different, so it’s still a good idea to test these changes before deploying them to production. But based on my experience over the past week, this configuration has been stable and reliable.