This guide presents a catalog of security-relevant configuration settings for Webmin. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at

.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for Webmin, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Applicable platforms

Version: 0.1.31

Revision history

  • draft (as of 2017-03-27)

1. Remediation functions used by the SCAP Security Guide Project

XCCDF form of the various remediation functions as used by remediation scripts from the SCAP Security Guide Project

2. Introduction

The purpose of this guidance is to provide security configuration recommendations and baselines for the Webmin application. Recommended settings for the basic application are provided. The guide is intended for system administrators. Readers are assumed to possess basic system administration skills for Unix-like systems, as well as some familiarity with the product's documentation and administration conventions. Some instructions within this guide are complex. All directions should be followed completely and with understanding of their effects in order to avoid serious adverse effects on the system and its security.

2.1. How to Use This Guide

Readers should heed the following points when using the guide.

2.1.1. Read Sections Completely and in Order

Each section may build on information and recommendations discussed in prior sections. Each section should be read and understood completely; instructions should never be blindly applied. Relevant discussion may occur after instructions for an action.

2.1.2. Test in Non-Production Environment

This guidance should always be tested in a non-production environment before deployment. This test environment should simulate the setup in which the system will be deployed as closely as possible.

2.1.3. Root Shell Environment Assumed

Most of the actions listed in this document are written with the assumption that they will be executed by the root user running the /bin/bash shell. Commands preceded with a hash mark (#) assume that the administrator will execute the commands as root, i.e. apply the command via sudo whenever possible, or use su to gain root privileges if sudo cannot be used. Commands which can be executed as a non-root user are are preceded by a dollar sign ($) prompt.

2.1.4. Formatting Conventions

Commands intended for shell execution, as well as configuration file text, are featured in a monospace font. Italics are used to indicate instances where the system administrator must substitute the appropriate information into a command or configuration file.

3. Required User Account Settings

To support a secured and compliant configuration, a number of user account settings need to be modified from there default configuration.

3.a. Use PAM for Unix authentication.

Webmin must use the OS-provided Password Authentication Module for validating passwords.

Security identifiers

  • CCE-

3.b. Use passwd for changing passwords.

Webmin must use passwd for password changes so that password requirements configured in the operating system are enforced on new password selections.

Security identifiers

  • CCE-

3.c. Enable the ability for a user to change an expired password.

Webmin must enable a user to change their password when it has expired.

Security identifiers

  • CCE-

4. Session Security

To support secured access to webmin.

4.a. Display approved login banner prior to login.

Display approved login banner prior to login.

Security identifiers

  • CCE-

4.b. Configure approved webmin port.

Configure approved webmin port.

Security identifiers

  • CCE-

4.c. Prevent the ability for a user to save their login credentials for future access.

Prevent the ability for a user to save their login credentials for future access.

Security identifiers

  • CCE-

4.d. Use approved ciphers for encryption.

Use approved ciphers for encryption.

Security identifiers

  • CCE-

4.e. Encryption is enabled and enforced.

Encryption is enabled and enforced.

Security identifiers

  • CCE-

4.f. Sessions are closed after idling a specified number of minutes.

Sessions are closed after idling a specified number of minutes.

Security identifiers

  • CCE-

5. Required log file configurations

To support accountability of access to the system, required log file configurations must be applied.

5.a. Log actions performed by users.

Log actions performed by users.

Security identifiers

  • CCE-

5.b. Logs must not be accessible to unauthorized users.

Logs must not be accessible to unauthorized users.

Security identifiers

  • CCE-

5.c. Prevent users from covering their trail.

Prevent users from covering their trail.

Security identifiers

  • CCE-

5.d. Log access attempts to the webmin.

Log access attempts to the webmin.

Security identifiers

  • CCE-

5.e. Logs must not be accessible to unauthorized users.

Logs must not be accessible to unauthorized users.

Security identifiers

  • CCE-

5.f. Prevent users from covering their trail.

Prevent users from covering their trail.

Security identifiers

  • CCE-

6. Required patches

To support combating known weaknesses, the webmin application must be up to date.

6.a. The Webmin application installed on the system is updated.

The Webmin application installed on the system is updated.

Security identifiers

  • CCE-

7. Webmin Modules

The following sections contain information on security-relevant choices for configuring Webmin modules in an IA compliant manner.

7.1. UserAdmin Module Required Settings

To support a secured and compliant configuration, a number of user account settings need to be modified from there default configuration.

7.1.a. Configure new accounts to create their home directory with a default permission setting of 750.

New users created through the UserAdmin Webmin module must have the default permissions of 750 applied to their home directory when created.

Security identifiers

  • CCE-

7.1.b. Configure new accounts to lock out after a number of days of no activity.

New users created through the UserAdmin Webmin module must include required account expiration criteria.

Security identifiers

  • CCE-

7.1.c. Configure new accounts to expire their password after a maximum number days.

New users created through the UserAdmin Webmin module must include required maximum password life criteria.

Security identifiers

  • CCE-

7.1.d. Configure new accounts to prevent changing passwords more than once per the minimum number of days defined.

New users created through the UserAdmin Webmin module must include required minimum password life criteria.

Security identifiers

  • CCE-

7.1.e. Configure new accounts to warn the user about their password expiring.

New users created through the UserAdmin Webmin module must include required account password expiration warning criteria.

Security identifiers

  • CCE-

7.1.f. Configure the UserAdmin Webmin module to store passwords created using a specified hashing algorithm.

Passwords generated through the UserAdmin Webmin module must be stored using the specified hashing algorithm.

Security identifiers

  • CCE-

7.1.g. Configure the UserAdmin Webmin module to require a minimum number of characters in passwords defined.

Passwords created through the UserAdmin Webmin module must include the minimum defined number of characters in the password.

Security identifiers

  • CCE-

7.1.h. Configure the UserAdmin Webmin module to require at least 1 upper-case character, 1 lower-case character, 1 numeric character, and 1 special character.

Passwords created through the UserAdmin Webmin module must include at least 1 upper-case character, 1 lower-case character, 1 numeric character, and 1 special character.

Security identifiers

  • CCE-

7.1.i. Configure the UserAdmin Webmin module to require passwords to not include dictionary words.

Passwords created through the UserAdmin Webmin module must not include dictionary words.

Security identifiers

  • CCE-

7.1.j. Configure the UserAdmin Webmin module to require passwords to be different from the previously configured password.

Passwords created through the UserAdmin Webmin module must not be the same as the previous password used.

Security identifiers

  • CCE-

7.1.k. Configure the UserAdmin Webmin module to mask the password characters entered with stars.

The UserAdmin Webmin module must not display the characters entered for the password in clear text.

Security identifiers

  • CCE-

7.1.l. Configure the UserAdmin Webmin module to display last login information for all users.

User last login information must be displayed to support detecting unauthorized access.

Security identifiers

  • CCE-

Colophon

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.