Prevent creation of Extra Admin with blank password?

Help! (Home for newbies)
1

Virtualmin allowed me (and what I regard as domain-only level extra admins) to add an extra admin with no password. And that login then worked.

Is there a “don’t allow the creation of admin accounts without passwords” checkbox that I missed somewhere?

Thanks.

SYSTEM INFORMATION
OS type and version Ubuntu 24.0.5
Virtualmin version 2.670
2

Oh, that should be impossible. That’s a bug. It shouldn’t be an option.

That said, what do you mean by “And that login worked”? It worked where? In Webmin?

3

Yes. I tested with a new browser using “testextraadmin@the-domain.com” and entering no password. It logged me in to the-domain.com:10000 as the extra admin.

4

OK, I’ll ask @Jamie or @Ilia to take a look. That should always be impossible.

5

Thanks, Joe! It’s fixed now:

6

I remember there are Password Restriction options in webmin’s settings (under Webmin Users). Shouldn’t these same settings be applied for every user?
These users are technically logging in with the same webmin infrastructure, right?