In order to isolate my test server, I limited Linux access to only communicating within my internal network, obviously after installing Virtualmin. I noticed that it freezes at certain times, especially when creating new domains. Does the control panel send unnecessary data to external sources? This is understandable during upgrades, checking for and downloading updates, or creating SSL certificates and some, some others, but it’s strange when simply creating a new domain. What is the policy regarding this? Since the Panel is free, does it collect user information and send it somewhere? Or does it send statistics?
Use top or htop to see whats happening. I know webmin does using a bit of resources when you load in a browser, never noticed any freezing when creating a domain, how much ram and are you using a powerful CPU or is it a old machine?
Is this a new test server? I recently got a Beelink SER5 box for testing, and found that the Realtek 8125 network chipset has some BAD issues using linux… namely, freezing every few seconds. It detects the 8125 as 8169 so I had to use ethtool to limit the speed to 1000 and all was well.
My English is very poor when I try to explain certain things, let me explain better what alerted me: I installed Virtualmin on an extra machine I have, 32GB RAM, 1TB SSD NVMe, so new and good. This machine is just to test things… okay, after installing and configuring everything, I unplugged the machine from the network (isolated without internet). Then, every time I click the button to create a new Virtual or Domain, before filling in the information, just showing the intention, it STOPS, the red line at the top keeps passing as if it were trying to access some IP or URL but can’t, then after a few seconds (20) it shows the fields to continue. I mean, with the machine isolated I obviously won’t have access to updates or new plugins, but then it stops to try to access something external in the middle of a domain or email account creation process… I found it very strange and suspicious. If I plug it back into the network, it’s working perfectly again. Do you understand my point? That’s why I asked about privacy. But I got discouraged about Virtualmin after I started testing it on Postfix using the available security settings. If I have to manually edit main.cf or master.cf every time I install a new machine, it loses its purpose for me. I’m still testing…
Virtualmin tries to get a Let’s Encrypt TLS certificate when creating a domain. In order to do that, a bunch of things have to work: DNS resolution, IP is reachable from the web, etc.
If you don’t want the internet touching your server, you can’t get Let’s Encrypt certs. And, Virtualmin’s various tests to make sure a request to get a cert will be successful will fail…but only after a timeout.
So, you’d need to disable all SSL/TLS-related stuff in Virtualmin. I think you can probably just disable the Apache SSL Website Feature in Features and Plugins.
But, your browser isn’t going to like interacting with anything on the server, since nothing will have certs.
We absolutely do not collect user information beyond what is in our terms. We see your IP address, and if you have a license we see what IP address is associated with a license. We do not sell that information, and we do not make it available to anyone, and we don’t do anything with it other than troubleshoot problems.
You may note we don’t even use any surveillance bugs on our website (Facebook and Google are not gathering data on you while you visit this forum and our website). We switched to self-hosted Matomo for our own website analytics a while back, specifically for that reason.
And, I’ll also point out that Virtualmin is Open Source and in no way obfuscated. You can look at the source code to see exactly what data we collect and send home (nothing but IP and license info, if any).
We don’t spam, we don’t track, and we don’t share with those who do.
Edit: Oh, also, the connectivity check API also sees the domain name (to test DNS resolution before hitting Let’s Encrypt), but we don’t store that information. I should update our privacy policy to indicate that, though. It’s relatively new, in response to seemingly infinite people asking “why doesn’t Let’s Encrypt validation work” and it always being the same three problems (DNS or redirect/proxy rules that don’t exclude .well-known or VirtualHost misconfiguration causing the wrong site to be served). The connectivity check tries to give a very short error that people will read rather than the long one Let’s Encrypt sends (which also tells why it failed, but it’s long and scares people so they don’t read it).
Alerting about what: The cpanel trying to fix problems on your (purposely broken) connection ?
strange
What was strange there: The cpanel trying to reach internet ? (Isn’t it its job ?)
Suspicious
Suspicious: Waiting to see if there is a way or another to make sure your platform is reachable ?
Virtualmin doing most of what it should the right way. You proven it perfectly works .
Everything here is normal. Lastly concerning privacy, as Stefan said, simply read the privacy policy and you shall be fixed. Virtualmin does not make any money on personnal datas. You would be better to be suspicious on most of other Cpanel available.
No harm , but this topic was, according to me, kinda strange
Strange as well as accusatory. Someone who understands enough about networking to monitor connections cannot feign ignorance about simpler matters and ask loaded questions. Something is amiss.
.
other Cpanel available.