Webmin Safe Connection

[danyyel]

Hello,
I have been trying to set up a safe https connection to my Webmin browser GUI.
I have made some work using ssl certificates. Is it the right way? Do I need a CA certificate in order to have my wish fulfilled?

Help is appreciated in the form of commentary, links or pointing to the right material to read.

Best Regards

[Ilia]

@danyyel

Is it the right way?

Yes.

@danyyel

Help is appreciated in the form of commentary, links or pointing to the right material to read.

Simply request legit certificate from CA (Let’s Encrypt) for free. You can use your own cert with out any problems but browser will throw a warning.

[danyyel]

I have read and seen a lot about this issue and am starting now to understand more or less how it works.

Your reply is very appreciated.

[meabert]

you might need a ‘chained’ certificate depending on the issuer. - my two cents

[craigh]

My two cents is that this thread might help you:

LE certificate for Virtualmin installation

Thanks for your suggestion Mik, but I think you missed the part where I said I had no problem with the domains in Virtualmin, but the problem was with the sub-domain I was using for access Virtualmin itself. After poking around some I found the answer: The place to do this is at Webmin → Webmin Configuration → SSL Encryption → Let’s Encrypt. However, there is a bug there: the default entry in the “Website root directory for validation file” field is: “/var/www/html” This includes the quote…

[danyyel]

Is it possible to secure Webmin or any other Web Gui without a domain? Making it secure locally using only (ip:port number)?
I do not like to have Webmin Gui open in the internet. I am trying to Vpn to my Lan and acess it locally.

Share your thougts please.

[DrCarsonBeckett]

Even with just an IP its open in the Internet, so it doesnt matter if its accessible via Domain or just via IP.
You can limit access to it with the firewall.
And what I read about LE (Let’s Encrypt) id that they dont offer certificates for IPs. Meaning only for DNS names. But I could be wrong about that.

[danyyel]

I can acess Webmin Gui using “hostname:10000”.

I have tried to use apache to create a virtual host and then fo forward with LE proceadure. I don’t know if it is the correct way, nor if it is possible that LE would accept a local request.

I am also trying to get nome knowledge on Webmin Forums…

[DrCarsonBeckett]

If the hostname is reachable via DNS, then it should be possible.

[scotwnw]

IF you have ssh access to the machine, you can close public webmin port all together and access it through ssh forwarding.

For ssh, connect to the server with the -D:port option.
ssh -D:2000 username@public-ip
Then set your browser to proxy all traffic via socks5 and 127.0.0.1:2000. All traffic will be forwarded through the ssh to the server. Will be able to access any ip on the server since all your traffic looks like “localhost” traffic to the server. So you’d access webmin via the servers ip:10000. If works, close port 10000 in the firewall to block public access.

[danyyel]

Let me just clarify that i can acess Webmin Gui using a webbrowser on a local machine. My question’s purpose is to understand more about the process itself. I am a computer engineer, not a software one. I have much interest in this matter for my ongoing projects. I am learning a lot on how to create a website and host it on a local server.

When I installed Webmin, I had acess using https://ip:10000. Back then the browser still didn’t recognize the original certificate as being a trusted one, but the HTTPS worked regardless.

One time I have fiddled with the certificate creation in the “Webmin Configuration/ SSL Encription”. I began not to have acess to the Webmin GUI. In order to get it back up, i “nanoed” /etc/webmin/miniserv.conf and removed SSL option. Now I can access the GUI using HTTP://ip:10000.

What I wish is to find out if there is a possibility to have Webmin or Pi-Hole GUI with HTTPS and browser safety recognition. Everything accessable at local network even when my internet connection is down.

I feel my question hasn’t gone through yet, maybe my conception of how it works is not yet still good enough.Anyhow, your time and help is being appreciated.

[DrCarsonBeckett]

The SSL connection still worked, because its self-signed and depending on the browser configuration you can still use https with that (even though you get a warning).
If you want to know more about encryption and how it works, simply google (or other search enginges) letsencrypt. Their website actually tells you a lot about that. That should do as first basics.
If you want a ssl cert, which will be recognized as legit by default you either need a domain for that or a paid ssl cert (some companies offer certs for direct IP usage, at least in the past).

[danyyel]

Nice! Just what I was looking for.

Thank you Dr.