Webmin Administrator's Cookbook

To install Webmin, perform the following steps:

Webmin provides an online repository with DEB installation packages that are compatible with Debian-based systems. We need to give our system the address of this repository so that it can take advantage of it. The list of available repositories is kept in the /etc/apt/sources.list file as well as other *.list files stored in the /etc/apt/source.list.d/ directory.

Every package is cryptographically signed to ensure that even if someone breaks into the repository and uploads a package pretending to be Webmin, we don't install it by accident. We downloaded the public GPG key needed to verify this signature by using wget and added it to our list of trusted keys by using the apt-key add command.

GNU Privacy Guard (GPG) is an open source alternative to Pretty Good Privacy (PGP), a cryptographic software suite that provides encryption and authentication functions. Every Webmin package contains a GPG cryptographic signature, which could only be generated using a private key that is kept secret by Webmin's author Jamie Cameron. A corresponding public key, which is made freely available, may be used to verify that the signature was generated using that private key. If even a single bit of the package code were modified after the package was signed, the signature would not match anymore. This ensures that nobody tampers with Webmin on its way between the author and your system. APT checks the signature automatically, we just need to provide it with Webmin's public key.

$ sudo apt-key fingerprint
/etc/apt/trusted.gpg
--------------------
pub   1024D/11F63C51 2002-02-28
      Key fingerprint = 1719 003A CE3E 5A41 E2DE  70DF D97A 3AE9 11F6 3C51
uid                  Jamie Cameron <jcameron@webmin.com>

By updating the APT cache, we ensure that our system becomes aware of packages available in the new repository. Then, we can install Webmin. APT not only resolves dependencies and installs more than just the Webmin package, but also other components it needs to run, including the Perl programming language and others.

Webmin also provides a .deb (Debian software package) file that can be downloaded and installed manually. If you want to do it this way for some reason, you would need to follow these steps:

More information about installing Webmin on a Debian-based system and about APT package management in general can be found at the following Webmin and Debian websites:

To install Webmin, perform the following steps:

Installation of Webmin using yum is based on exactly the same principles as installing it using apt-get on Debian. Take a look at the How it works... section in the previous recipe.

Webmin also provides an RPM package that can be downloaded and installed manually. If you wanted to do it this way for some reason, you would need to follow these steps:

$ sudo yast --install webmin-NNN.noarch.rpm

More information about installing Webmin on an RPM-based system can be found at the following Webmin website and wiki:

Before installing Webmin, make sure that you have Perl Version 5 installed on your system. You can verify this using the following command:

$ perl --version

In order to enable SSL encryption of connections, you should install the Perl module Net::SSLeay. You can verify that it's installed by using the following command. It will complain if Net::SSLeay is not installed. If it's installed, the command will generate no output.

$ perl -e "use Net::SSLeay"

Perform the following steps to install Webmin:

Webmin installation script is able to install it on most Unix-like operating systems.

When we were starting the installation script, we indicated that we want to install Webmin's program files in /usr/local/webmin. Use a different path if you want to place it elsewhere.

Webmin asks you a series of questions during installation. For instance, it asks you where to store configuration files (defaults to /etc/webmin/) and log files (defaults to /var/webmin/). These locations may be changed, but the defaults will work well on most systems.

You will also need to specify the username and password of the first Webmin user. This user will have complete control of your system through Webmin and will be able to add more user accounts.

You can find more information about installing Webmin on its website at http://www.webmin.com/tgz.html

Look for a Webmin package for your system. Here are a few links:

The first step is to check the IP address of your server. One way to do it is to run the /sbin/ifconfig command. It will give you lots of information about network interfaces configured on your system, including the IP number for each one under the heading inet addr. You will have at least two network interfaces on your system. One will be called lo or lo0, this is the local loopback interface that is used only for connections originating from the same machine. This will have the IP of 127.0.0.1. The other interface will most likely be named eth0 or en0 and this will be the primary network adapter of your machine. To connect from another computer, note this IP address. You can also set up a DNS entry for this IP, and then you'll be able to connect using a domain name.

You can connect to Webmin by performing the following steps:

On the next screen, you will be asked to provide the login and password of a user with administrative privileges. This is almost always either root or a user who has ALL privileges granted through sudo. Type the username and password and hit the button to log in.

Once you log in, Webmin will greet you with a home screen displaying an overview of your system, similar to the following screenshot:

This welcome screen shows Webmin's main interface. On the left-hand side, we see a sidebar containing a hierarchical menu listing all installed modules organized into categories. To the right, we see an interface of the currently activated module (in this case, it's System Information).

Webmin runs a web server on port 10000 of your server. Since browsers connect to port 80 by default (or port 443 when using HTTPS), we need to specify the port number as part of the URL.

If the Perl module Net::SSLeay is installed on your system, all connections to Webmin are encrypted to avoid eavesdropping or man-in-the-middle attacks. In order to establish an encrypted connection, we instruct the browser to connect using the HTTPS protocol. If you try to connect over regular HTTP, Webmin will provide you with a page redirecting you to the encrypted connection similar to the following screenshot:

The error message we see when we establish an encrypted connection is caused by the fact that the certificate we're using to encrypt communication was generated by Webmin itself and wasn't signed by a commercial, trusted certificate authority. This is not a cause for worry. A self-signed certificate has one important advantage: it's free, and it provides the same encryption as a commercial certificate.

Webmin uses port 10000 by default to host its web server and will accept connections coming in on any network interface. You can change these options if you wish.

Changing Webmin's listening port

Navigate to the Ports and Addresses configuration module by selecting the following options from the menu: Webmin | Webmin Configuration. Then, click the Ports and Addresses icon. You will get the following screen. On this screen, you can change the port on which Webmin listens for connections by specifying it in Listen on port | Specific port. Leave the value of the Bind to IP address field as Any address for now. Consider the following screenshot:

Change the port to 10001 or any unused port number you prefer and click Save.

Tip

You can get a list of used ports by issuing the netstat command. Daemons on your server use some ports to listen for incoming connections. You won't be able to use any of these for Webmin. On Linux, you can use the following command to get a list of listening ports:

$ netstat -ltn

On BSD-based systems, use this instead:

$ netstat -nap tcp | grep LISTEN

Webmin will change its port and redirect you to the new address.

Specifying the IP address on which Webmin listens

You can use the Ports and Addresses screen to select on which IP address Webmin will be listening. This is useful if you have more than one network interface installed on your machine (for instance, one for accessing the Internet and one on a local network). You can also use this option to select the loopback interface and allow only connections originating from the same machine or coming in over an SSH tunnel (refer to the Connecting to Webmin securely over an SSH tunnel recipe in Chapter 3, Securing Your System). To restrict connections only to local traffic, select Bind to IP address | Only address... and enter 127.0.0.1 as shown in the following screenshot:

If you find a good third-party module that doesn't come bundled with Webmin, you can install it by following this recipe. Just a word of warning: a Webmin module will have privileged access to your system; you should never install modules from sources you don't fully trust.

To install additional Webmin modules, perform the following steps:

Webmin will download and decompress the module archive file and place a new module folder on disk in the /usr/share/webmin/ directory. When you reload Webmin, it will scan the modules directory, discover the new module, and add it to its menu.

Each Webmin module can be made available to all users or a selected group. This choice can be made during the installation of the module or it can be done later in Webmin | Webmin users settings. More information about users and access control can be found in Chapter 2, User Management.

Webmin can also download module files from two repositories: the standard module repository hosted at webmin.com and a repository of third-party modules that may be hosted anywhere on the Internet.

In order to take full advantage of Webmin's logging facility, you should enable the monitoring of file changes made though Webmin. This allows you to roll back the changes later.

In order to enable this function, go to Webmin | Webmin Configuration | Logging and set Yes as the answer to these two questions: Log changes made to files by each action? and Record all modified files before actions, for rollbacks?

To monitor what Webmin is doing, perform the following steps:

Webmin records all actions performed by users to the log file /var/webmin/webmin.log. User annotations are stored in the /var/webmin/annotations directory. If monitoring of file changes is enabled, each change is recorded in the /var/webmin/diffs directory. Please note that these directories could potentially grow quite large over time on a busy system.

The Webmin Actions Log interface allows you to search these log files, display them, and use them to revert file changes.

If you enabled monitoring of file changes as described in the Getting ready section of this recipe, you can use Webmin to revert the changes.

Rolling back file changes

As an exercise, go to Webmin | Webmin Configuration | User Interface and set the page background to a light blue color with the RGB hex value of C9DFFF. Go back to Webmin | Webmin Actions Log, and then find your action and view its details. In the section Files changed and commands run, you will see that a change to the file /etc/webmin/config was recorded, as shown in the following screenshot:

Tick the checkbox next to the file change and click the Roll Back Selected Files button. Confirm the rollback and go back to the Action Details page. Notice that the background color changes back to white.

Perform the following steps to check which system services are started at boot:

When your OS starts, it first loads the system kernel and then starts a process called init (short for initialization), which executes various init scripts that start system services. Under Linux, these scripts are stored in one directory (/etc/init.d) and activated by the creation of symbolic links to them in a special directory from which all scripts are executed at boot time. Webmin allows you to control which init scripts are executed by creating or removing these symbolic links or performing other activation functions specific to your system.

The init system described earlier is often referred to as SysV-style init. It's named after the historic UNIX System V that inspired all modern Unix-like operating systems, including Linux and BSD. Many distributions are gradually switching over to more modern alternatives such as Upstart and Systemd. The details of how these systems differ from SysV-init are beyond the scope of this book, but Webmin tries to provide a common interface to all of them. Screenshots in this recipe may differ slightly depending on which init system your distribution uses.

Webmin also allows you to easily create your own init scripts and verify that a started service is actually running.

Creating a custom init script

Most server packages you install will come with their own init scripts and activate them in your init system. If you install a package that doesn't, you can use Webmin to create a simple init script for you.

Navigate to System | Bootup and Shutdown and click the Create a new bootup and shutdown action link.

Note

Depending on the init system you're using, this link may also be named Create a new action, Create a new upstart service, Create a new systemd service, and so on.

You will be asked to specify the name and description of the startup item as well as two commands: one for starting the service and one for shutting it down. Once you fill these out, click Create and Webmin will automatically create a basic init script for you.

Inspecting active processes

Even if a service is successfully started during boot, it could potentially crash. To inspect which services are actually running, go to System | Running Processes. There, you will see a tree of processes sorted in the order in which another process has started them. You can also sort processes by owner or the amount of CPU or RAM they are consuming. Consider the following screenshot:

Click on a process ID for one of Webmin's processes to get more information about it, including those files or network connections the process still has open.

For checking what packages are installed, perform the following steps:

Webmin is able to determine which package management system your OS is using, and provides a unified interface to common tasks such as inspecting, installing, and uninstalling packages. In the background, Webmin will execute the appropriate commands (apt-get, yum, rpm, yast, and so on) for you and display the results in the form of a web page.

Beyond simply viewing the installed packages, it's often useful to check which files were installed by a package. You may also be interested in a particular file on disk and want to check which package installed it. Webmin allows you to gather this information easily.

Identifying which package installed a file

To identify which package has installed a file, perform the following steps:

1. Go to System | Software Packages.

2. In the Identify a file section, type in the name of a file or command or click the ellipsis (...) button to browse your disk.

3. Click the Search For button.

If the file is identified by the package management system, you will see a screen with information about the file, including the name of the package which installed it:

Many web applications depend on an image manipulation library called ImageMagick. Many programs that are used to create, edit, compose, or convert bitmap images such as PNG and JPEG use this library. In this recipe, we will install ImageMagick, but the same procedure may be applied to any other software available in your distribution's repository.

Follow these steps to install a software package using Webmin:

Webmin will download and install ImageMagick along with a long list of its dependencies. On the results screen, you can see the details for all the installed packages.

Webmin determines which package management system your OS uses. It executes the appropriate commands to search available repositories for packages matching your query and installs them along with their dependencies. The same task can be accomplished from the command line, but Webmin abstracts away the command syntax particular to your packaging system so that you can use the same interface regardless of the underlying OS.

Webmin also allows you to install software from a package file that you may have. In order to do that, follow this recipe, but select the From uploaded file radio button and upload your file instead of searching the repository. If your package file is too large to upload with a browser, you can install it from its URL instead.

Please note that this method will require you to install its dependencies manually before installing the package itself.

To update installed packages, perform the following steps:

Webmin determines which package management system your OS uses and queries the package repositories for information about latest available versions. You can trigger this package cache update yourself by clicking Refresh Available Packages. When you select to perform the update, Webmin executes the appropriate package management commands to install latest versions.

Webmin will also notify you if updates are available for any of its own modules. This notice will appear on the System Information page, which is the first page displayed when you log in. If you see it, click Install Updates Now to install the module updates as shown in the following screenshot:

Webmin needs access to a mail server in order to send an e-mail. In Chapter 12, Setting Up an E-mail Server, we will cover setting one up. However, if you don't plan to set up your own mail server or you want to start monitoring your system before you do, you can use an external e-mail service.

Webmin can send e-mail over SMTP, but it doesn't support TLS/SSL encryption. You'll need an account with a provider who allows you to connect via SMTP without encryption.

Perform the following steps to enable Webmin to send e-mails:

Webmin is able to communicate with a remote server over unencrypted SMTP, so your mail will actually be sent from there. Please note that the configuration, including your password is saved in clear text on the server in the /etc/webmin/mailboxes/config file. This file is accessible to all users with administrative privileges on the server, and they will be able to read your e-mail password.

Make sure that Webmin is set up for sending e-mail. Refer to the Enabling Webmin to send an e-mail recipe of this chapter for more information.

To get an e-mail notification when new versions of software become available, perform the following steps:

cron is a system utility, which runs in the background as a daemon and starts tasks that are scheduled to execute at a specific time. When Scheduled checking options is enabled, Webmin adds an entry in the system's cron table to execute its update verification script. The cron daemon will then execute the script once every day (hour or week, depending on the setting). If Webmin discovers available updates, it will send you an e-mail.

You could set up Webmin to automatically install the updates when they become available. This may not be as great idea as it seems, because every update can potentially break something on your system. This should not normally happen, but it's a good practice for a human to monitor the update process and verify that everything works as it should after updates have been applied.

To read the documentation of the installed software, perform the following steps:

Webmin will search through all available documentation and display a list of all manual pages and package notes that mention wget.

Documentation accompanying a package usually consists of the program's manual pages and packaging information. The man pages contain instructions on using the installed software. They are stored in a special format (usually in /usr/share/man, /usr/local/man or similar locations) and displayed using the man command. Package information, on the other hand, may include information about how this package was prepared, how it is intended to be used, and so on. Package docs are usually stored as text or HTML files in /usr/share/doc.

Webmin scans the available man pages, package documentation files, and Perl module documentation for mentions of your search term. It displays all the results in the form of web pages for easy viewing.

Webmin provides another important search form, which is located in the sidebar menu under the list of module categories. This allows you to perform a detailed search of Webmin itself, which scans both its documentation and also the elements of its user interface. For instance, if you use this form to search for the Send test message phrase, Webmin will display a result listing with a link to the Sending E-mail module that allows you to send a test e-mail.