| SYSTEM INFORMATION | |
|---|---|
| OS type and version | AlmaLinux 10.1 |
| Webmin version | 2.6.10 |
| Virtualmin version | 7.50.2 GPL |
| Webserver version | Nginx 1.26.3 |
| Related packages | Nginx, Dovecot, Postfix |
I encountered some issues using Virtualmin in production. Hopefully you can use my suggestions to improve the software.
-
when installing with “virtualmin-install.sh -b LEMP” I had to add these packages manually: wbm-virtualmin-nginx wbm-virtualmin-nginx-ssl wbm-jailkit wbm-php-pear
-
in some cases the LetsE SSL certificate contained the domain name mail.$(DOM) while there was no “Mail for domain” feature selected. This has caused me some headaches…
I have not found exactly when this happened, but I think it was at creating a new server using a custom template. I could not find anything in the SSL settings of the template. -
The default security can be improved a lot by:
- Server Templates - SSL website for domain - Default SSL key size = 2048
- Server Templates - SSL website for domain - Default SSL certificate hash = ECC
- Webmin - SSL support - Enforce SSL = Yes, with HSTS header
- Webmin - SSL support - SSL protocol versions to reject = SSLv2 SSLv3 TLSv1.0 TLSv1.1
- Webmin - SSL support - Allowed SSL ciphers = Only strong ciphers with PFS
- Dovecot IMAP/POP3 - SSL Configuration - Disallow plaintext non-SSL mode = Yes
- Postfix Mail Server - SMTP Authentication - Disallow SASL over insecure conns = Yes
- /etc/postfix/main.cf:
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_protocols = >=TLSv1.2
smtp_tls_mandatory_ciphers = high
smtp_tls_mandatory_protocols = >=TLSv1.2
smtpd_tls_dh1024_param_file = /etc/pki/ffdhe4096.pem - /etc/nginx/nginx.conf - http {}:
server_tokens off;
http2 on;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-CHACHA20-POLY1305;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1h;
fastcgi_hide_header X-Powered-By;
add_header Strict-Transport-Security “max-age=31536000; includeSubDomains” always;
The above gives you an A+ rating at the Qualsys SSL test.
-
fastcgi_param SCRIPT_FILENAME and DOCUMENT_ROOT contain a copy of the path to public_html, just as the Nginx root directive. These parameters are not updated when the server root is altered within Virtualmin.
Consider to use $document_root in SCRIPT_FILENAME and DOCUMENT_ROOT to avoid duplication of the entire root in the Nginx configuration, and also avoid issues with escaping and quoting paths. -
virtual servers have no try_files and Nginx has no default. I had to add try_files myself to most servers to get PHP software working.
Consider to always set a decent try_files in the server block: try_files $uri $uri/ /index.php$is_args$args;
So far I only installed simple PHP software and several WordPress sites. More suggestions will likely follow when I start using Nextcloud, Laravel apps and mail services.
