Webmin-virtualmin-password-recovery replacement fallout

Operating system|Ubuntu Linux 22.04.5|

|Webmin version|2.630|

|Usermin version|2.530|

Virtualmin version| 8.1.0 Professional|

Authentic theme version 26.30

I recently posted on here with concern about the virtualmin 7.x → 8.x upgrade which has rid of the

webmin-virtualmin-password-recovery

package which is now integrated into webmin, thats what I think Joe said.

What has it been replaced by and how do I use it?

After upgrading to vmin 8.x last night, we now have a non-working “Forgot your webmin password?” button on our vmin login page. Users get the error:

File not found — /virtualmin-password-recovery/

I’ve already had a bit of a dig and I think I’ve found its replacement under:

WebminWebmin ConfigurationAuthentication. → Allow forgotten password recovery

After changing that to “Yes” I now have 2 password reset buttons on my vmin login page, one that says “Forgot your webmin password?” and one that just says “Forgot password?”.

Any Webmin user, or a user created in Virtualmin with an email address set, can reset their password unless the password reset option is disabled on the “Webmin ⇾ Webmin Configuration: Authentication” page.

You can check if a Webmin user (created by Webmin or Virtualmin) has an email address set on the “Webmin ⇾ Webmin Users: username” page.

How do I remove the old v7.x password reset button on the login screen?

You just need to uninstall this module using the package manager, for example:

apt-get purge webmin-virtualmin-password-recovery

or

dnf remove wbm-virtualmin-password-recovery

I’ve tried that but it hasn’t fixed it. I have fully rebooted this machine since that package was removed and I upgraded.

Here’s what my vmin login looks like

I’ve just tried to reset the password of a regular vmin domain user and I got the error

**Error**
Failed to reset password : The user either does not exist or does not have a recovery email configured.

The user does still exist and they can login OK so where do I configure their recovery email?

Their recovery email will be the same address as the users email. The user has a valid contact email (their email) configured.

The user should have an email address configured which you can check in “Webmin ⇾ Webmin Users” page.

What does this mean? What have you tried so far? Was the package removed? What output did you get when you ran the package remove command, as I showed earlier?

Hi Ilia

OK I have tested that the new user password reset feature works but it only works once the users email is added to the Webmin users page and currently none of our users have this email field configured apart from the one test user I just tried.

I want all users to be able to reset their own passwords so I need a script that will copy every users contact email from Virtualmin → Virtual Server Details to Webmin ⇾ Webmin Users. I should be able to work that out but maybe this should be a feature in virtualin or webmin?

How should I be creating new vmin users so that this email field gets populated?

What does this mean? What have you tried so far? Was the package removed? What output did you get when you ran the package remove command, as I showed earlier?

I mean that I tried running

apt-get purge webmin-virtualmin-password-recovery

Yet it said there was nothing to do because the package had already been removed and doing a purge (vs just a remove, which is what I presume happened during the vmin upgrade) didn’t make any difference although I know purge should also remove settings files related to a package.

I might’ve ended up modifying one of the config files for the old password reset module so maybe that config file is lingering somewhere and doesn’t get cleaned up by doing a purge?

Where is the documentation for using webmin from the command line? webmin doesn’t seem to have a man page or any help text it you run it without arguments so I have no idea what valid sub-commands it has.

Really I just need to know how I configure a users webmin password using a webmin command so that I can write a script to add this to all webmin users and enable all users to reset their passwords.

I might’ve ended up modifying one of the config files for the old password reset module so maybe that config file is lingering somewhere and doesn’t get cleaned up by doing a purge?

I’ve checked my notes and the file I was thinking of used to be at

/usr/share/webmin/virtualmin-password-recovery/lang/en

but the /usr/share/webmin/virtualmin-password-recovery dir no longer exists so that’s not the problem causing the extra password reset button to linger.

Yes, sure, it’s this simple:

virtualmin disable-feature --webmin --all-domains
virtualmin enable-feature --webmin --all-domains

Thanks! I think this has fixed users being able to reset their own passwords so now I just need to work out how to disable the unneeded

“Forgot your Webmin password?”

button?

I had a file called /etc/webmin/custom-lang that was the cause of the extra button. I renamed that and all is well with the login screen.

I’m glad to hear you were able to figure it out! I will make this ticket as solved now.