{"id":14356,"date":"2025-12-17T15:10:15","date_gmt":"2025-12-17T09:40:15","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=14356"},"modified":"2025-12-24T16:13:15","modified_gmt":"2025-12-24T10:43:15","slug":"how-to-monitor-secure-webmin-on-linux","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/how-to-monitor-secure-webmin-on-linux","title":{"rendered":"How to Monitor &#038; Secure Webmin on Linux Server"},"content":{"rendered":"\n<p>To monitor and secure Webmin on a Linux server, restrict network access (firewall and allowlists), enforce HTTPS with a valid certificate, harden authentication (disable root login, enable 2FA, rate-limit logins), keep Webmin updated, and continuously monitor logs with alerting (journalctl, miniserv.log, Fail2Ban). These steps dramatically cut attack surface and improve uptime.<\/p>\n\n\n\n<p>Securing a Webmin installation is non-negotiable because it exposes powerful server controls via a web interface. In this guide, I\u2019ll show you how to <a href=\"https:\/\/www.youstable.com\/blog\/how-to-monitor-secure-mongodb-on-linux\/\">monitor and secure Webmin<\/a> on Linux servers using proven, production-ready steps. You\u2019ll learn network hardening, TLS, authentication best practices, logging, Fail2Ban, and update hygiene\u2014all in beginner-friendly language.<\/p>\n\n\n\n<p>The primary keyword for this tutorial is \u201csecure Webmin on Linux server,\u201d and we\u2019ll also cover related topics like Webmin monitoring, Fail2Ban protection, changing the Webmin port, and enabling SSL with Let\u2019s Encrypt. Everything below is based on real-world hosting experience and follows modern Google EEAT principles.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"what-is-webmin-and-why-it-needs-hardening\"><strong>What Is Webmin and Why It Needs Hardening<\/strong><\/h2>\n\n\n\n<p>Webmin is a browser-based control panel for Linux servers. It\u2019s powerful and popular\u2014but because it\u2019s reachable over HTTP\/HTTPS, it\u2019s also a target for bots and credential-spraying attacks. Default installs often run on port 10000 with broad accessibility. Hardening Webmin reduces attack surface and prevents configuration drift or compromise.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"quick-security-checklist-tldr\"><strong>Quick Security Checklist (TL;DR)<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Change the default Webmin port and bind to a specific IP.<\/li>\n\n\n\n<li>Restrict access via firewall and IP allowlists; prefer private access or SSH tunnels.<\/li>\n\n\n\n<li>Force HTTPS with Let\u2019s Encrypt, disable weak TLS versions\/ciphers.<\/li>\n\n\n\n<li>Disable root login, create a non-root admin, enable 2FA (TOTP).<\/li>\n\n\n\n<li>Enable login rate-limiting and Fail2Ban for Webmin.<\/li>\n\n\n\n<li>Monitor service health and logs; set alerts for suspicious activity.<\/li>\n\n\n\n<li>Keep Webmin and OS packages updated; remove unused modules.<\/li>\n\n\n\n<li>Back up Webmin configuration regularly.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"preparation-and-baseline\"><strong>Preparation and Baseline<\/strong><\/h2>\n\n\n\n<p>Before changes, record your environment: distro (Ubuntu\/Debian or Rocky\/Alma\/CentOS), server IPs, SSH access, and Webmin version. Ensure you can access the server via SSH in case you misconfigure Webmin networking.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Check service and version\nsystemctl status webmin\n\/usr\/share\/webmin\/webmin.pl version 2&gt;&amp;1 || grep -i webmin \/etc\/*release\n<\/code><\/pre>\n\n\n\n<p>Note the key paths:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Config: \/etc\/webmin\/<\/li>\n\n\n\n<li>Main config: \/etc\/webmin\/miniserv.conf<\/li>\n\n\n\n<li>Logs: \/var\/webmin\/miniserv.log and \/var\/webmin\/miniserv.error<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"lock-down-network-access\"><strong>Lock Down Network Access<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"change-the-default-port-and-bind-to-an-interface\"><strong>Change the Default Port and Bind to an Interface<\/strong><\/h3>\n\n\n\n<p>Changing the default port won\u2019t stop a motivated attacker, but it cuts automated noise. Binding to a private IP or loopback ensures Webmin isn\u2019t exposed on every interface.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Edit miniserv.conf\nsudo nano \/etc\/webmin\/miniserv.conf\n\n# Recommended changes\nport=10443\nbind=YOUR_SERVER_IP\n# or bind=127.0.0.1 if you will use an SSH tunnel only\n\n# Save and restart Webmin\nsudo systemctl restart webmin\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"firewall-rules-ufw-or-firewalld\"><strong>Firewall Rules (UFW or firewalld)<\/strong><\/h3>\n\n\n\n<p>Allow only trusted IPs to the Webmin port. Replace 10443 with your chosen port and 203.0.113.10 with your admin IP.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># UFW (Ubuntu\/Debian)\nsudo ufw allow from 203.0.113.10 to any port 10443 proto tcp\nsudo ufw deny 10443\/tcp\n\n# firewalld (RHEL\/Rocky\/Alma)\nsudo firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"203.0.113.10\" port protocol=\"tcp\" port=\"10443\" accept'\nsudo firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" port protocol=\"tcp\" port=\"10443\" drop'\nsudo firewall-cmd --reload\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"access-via-ssh-tunnel-preferred-on-public-clouds\"><strong>Access via SSH Tunnel (Preferred on Public Clouds)<\/strong><\/h3>\n\n\n\n<p>If you bound Webmin to 127.0.0.1, connect over SSH and forward a local port:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># From your workstation\nssh -N -L 10443:127.0.0.1:10443 user@server-ip\n\n# Then browse\nhttps:&#47;&#47;127.0.0.1:10443\/\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"enforce-https-and-modern-tls\"><strong>Enforce HTTPS and Modern TLS<\/strong><\/h2>\n\n\n\n<p>Never run Webmin over plain HTTP. Use a valid certificate and harden TLS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"enable-ssl-and-lets-encrypt-in-webmin\"><strong>Enable SSL and Let\u2019s Encrypt in Webmin<\/strong><\/h3>\n\n\n\n<p>Webmin has built-in SSL and Let\u2019s Encrypt support:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Navigate: Webmin > Webmin Configuration > SSL Encryption.<\/li>\n\n\n\n<li>Choose Let\u2019s Encrypt tab, set hostname, webroot or DNS method, and request a certificate.<\/li>\n\n\n\n<li>Enable \u201cRedirect non-SSL to SSL\u201d.<\/li>\n\n\n\n<li>Set automatic renewal.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"disable-weak-protocols-and-ciphers\"><strong>Disable Weak Protocols and Ciphers<\/strong><\/h3>\n\n\n\n<p>Harden miniserv.conf to allow only modern TLS. Examples below may vary by version; adjust to your environment.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/webmin\/miniserv.conf\n\nssl=1\n# Prefer strong ciphers and order\nssl_honorcipherorder=1\n# Optional cipher list example (OpenSSL syntax):\nssl_cipher_list=ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384\n\n# Disable old protocols (if supported by your Webmin\/OpenSSL build)\nno_ssl2=1\nno_ssl3=1\nno_tls1=1\nno_tls1_1=1\n\nsudo systemctl restart webmin\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"harden-authentication\"><strong>Harden Authentication<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"create-a-non-root-admin-and-disable-root-login\"><strong>Create a Non-Root Admin and Disable Root Login<\/strong><\/h3>\n\n\n\n<p>Never administer Webmin as root over the internet. Create a dedicated Webmin user mapped to a sudo-capable Unix account, and then disable root login in Webmin.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Webmin > Webmin Users > Create a new user (map to existing Unix user with sudo).<\/li>\n\n\n\n<li>Webmin > Webmin Configuration > Authentication > \u201cAllow root to login?\u201d = No.<\/li>\n\n\n\n<li>Set \u201cEnforce password strength\u201d to strong.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"enable-two-factor-authentication-totp\"><strong>Enable Two-Factor Authentication (TOTP)<\/strong><\/h3>\n\n\n\n<p>Use built-in 2FA with authenticator apps.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Webmin > Webmin Configuration > Two-Factor Authentication.<\/li>\n\n\n\n<li>Choose \u201cTime-based One-Time Password (TOTP)\u201d.<\/li>\n\n\n\n<li>Scan QR code with your authenticator (e.g., Authy, Google Authenticator).<\/li>\n\n\n\n<li>Store recovery codes securely.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"session-timeout-login-throttling-and-ip-blocklist\"><strong>Session Timeout, Login Throttling, and IP Blocklist<\/strong><\/h3>\n\n\n\n<p>Enable automatic blocking after failed attempts and shorten idle sessions.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># miniserv.conf examples\nsession_timeout=15\nblockhost_failures=5\nblockhost_time=3600\n# Optional allow\/deny lists (comma separated)\nallow=203.0.113.10\ndeny=all\n\nsudo systemctl restart webmin\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"monitor-webmin-service-and-logs\"><strong>Monitor Webmin Service and Logs<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"service-health-checks\"><strong>Service Health Checks<\/strong><\/h3>\n\n\n\n<p>Use systemd to monitor and auto-start Webmin:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl is-enabled webmin || sudo systemctl enable webmin\nsystemctl status webmin\njournalctl -u webmin -f\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"inspect-access-and-error-logs\"><strong>Inspect Access and Error Logs<\/strong><\/h2>\n\n\n\n<p>Review Webmin logs regularly and set alerts for anomalies.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tail -F \/var\/webmin\/miniserv.log \/var\/webmin\/miniserv.error\ngrep -i \"failed\" \/var\/webmin\/miniserv.log | tail -n 50\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"protect-webmin-with-fail2ban\"><strong>Protect Webmin with Fail2Ban<\/strong><\/h3>\n\n\n\n<p>Fail2Ban reads logs and blocks IPs that show malicious signs. Create a filter and jail for Webmin.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Install\nsudo apt-get install fail2ban -y     # Debian\/Ubuntu\n# or\nsudo dnf install fail2ban -y         # RHEL\/Rocky\/Alma\n\n# Filter: \/etc\/fail2ban\/filter.d\/webmin-auth.conf\n&#91;Definition]\nfailregex = ^\\S+ \\S+ webmin\\&#91;\\d+\\]: Invalid login as \\S+ from &lt;HOST&gt;\n            ^\\S+ \\S+ webmin\\&#91;\\d+\\]: Non-existent login as \\S+ from &lt;HOST&gt;\nignoreregex =\n\n# Jail: \/etc\/fail2ban\/jail.d\/webmin.local\n&#91;webmin]\nenabled = true\nport    = 10443\nfilter  = webmin-auth\nlogpath = \/var\/webmin\/miniserv.log\nmaxretry = 5\nfindtime = 600\nbantime  = 3600\naction = %(action_mwl)s   # emails you with logs; adjust as needed\n\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client reload\nsudo fail2ban-client status webmin\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"keep-webmin-updated-and-minimize-modules\"><strong>Keep Webmin Updated and Minimize Modules<\/strong><\/h2>\n\n\n\n<p>Updates patch known vulnerabilities. Only enable modules you truly need\u2014every enabled module expands your attack surface.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Debian\/Ubuntu (if Webmin repo is configured)\nsudo apt-get update &amp;&amp; sudo apt-get upgrade webmin\n\n# RHEL\/Rocky\/Alma\nsudo dnf check-update webmin &amp;&amp; sudo dnf upgrade webmin\n\n# In Webmin UI:\n# Webmin &gt; Webmin Configuration &gt; Upgrade Webmin\n<\/code><\/pre>\n\n\n\n<p>Disable or remove unused modules via Webmin &gt; Webmin Configuration &gt; Webmin Modules. Less is more.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"optional-reverse-proxy-with-nginx-or-apache\"><strong>Optional: Reverse Proxy with Nginx or Apache<\/strong><\/h2>\n\n\n\n<p>For advanced setups, put Webmin behind Nginx\/Apache on 443 with a trusted certificate, and keep miniserv bound to localhost. Then IP-restrict at the proxy level and add WAF features if available.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Example Nginx snippet\nserver {\n    listen 443 ssl http2;\n    server_name webmin.example.com;\n\n    ssl_certificate     \/etc\/letsencrypt\/live\/webmin.example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/webmin.example.com\/privkey.pem;\n\n    location \/ {\n        proxy_pass https:\/\/127.0.0.1:10443;\n        proxy_set_header Host $host;\n        proxy_set_header X-Forwarded-For $remote_addr;\n        proxy_ssl_verify off;  # talking to local self-signed\n        allow 203.0.113.10;\n        deny all;\n    }\n}\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"backups-auditing-and-compliance\"><strong>Backups, Auditing, and Compliance<\/strong><\/h2>\n\n\n\n<p>Back up Webmin configuration, schedule periodic audits, and verify recovery.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Backup config directory: \/etc\/webmin\/<\/li>\n\n\n\n<li>Use Webmin > Backup Configuration Files to automate module config backups.<\/li>\n\n\n\n<li>Run security audits with tools like lynis and review results.<\/li>\n\n\n\n<li>Log retention: rotate \/var\/webmin logs and forward to a SIEM if available.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code># Simple config backup\nsudo tar czf \/root\/webmin-config-$(date +%F).tar.gz \/etc\/webmin\n\n# Lynis (example)\nsudo apt-get install lynis -y || sudo dnf install lynis -y\nsudo lynis audit system\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"common-mistakes-to-avoid\"><strong>Common Mistakes to Avoid<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving Webmin on the default port 10000 exposed to the internet.<\/li>\n\n\n\n<li>Allowing password-only root logins without 2FA.<\/li>\n\n\n\n<li>Running Webmin over HTTP or with an expired\/self-signed cert on public hosts.<\/li>\n\n\n\n<li>Ignoring logs and failing to detect brute-force attempts.<\/li>\n\n\n\n<li>Neglecting updates or enabling every module \u201cjust in case.\u201d<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"real-world-monitoring-playbook\"><strong>Real-World Monitoring Playbook<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Availability: systemd watchdog, external HTTP(S) check from a monitoring service to \/ on the Webmin port.<\/li>\n\n\n\n<li>Security: Fail2Ban jail for Webmin, alert on repeated bans, 2FA enforced for all admins.<\/li>\n\n\n\n<li>Integrity: Daily diff of \/etc\/webmin\/ with alerts on unexpected changes.<\/li>\n\n\n\n<li>Performance: Track CPU\/memory of the webmin process; investigate abnormal spikes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"how-youstable-can-help\"><strong>How YouStable Can Help<\/strong><\/h2>\n\n\n\n<p>At YouStable, we host and manage Linux servers for businesses that need secure, reliable uptime. Our engineers implement the hardening steps above by default\u2014firewall allowlists, TLS, 2FA, monitoring, and patch management\u2014so your Webmin stays fast and safe. If you prefer a managed solution, our team can audit and secure your existing stack without downtime.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" class=\"wp-block-heading\" id=\"faqs-how-to-monitor-and-secure-webmin-on-linux-server\"><strong>FAQs: How to Monitor &amp; Secure Webmin on Linux Server<\/strong><\/h2>\n\n\n\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"is-it-safe-to-expose-webmin-to-the-public-internet\">Is it safe to expose Webmin to the public internet?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>It\u2019s safer to restrict Webmin to private networks or localhost and use an SSH tunnel or VPN. If exposure is required, enforce IP allowlists, HTTPS with a valid certificate, 2FA, and Fail2Ban. Keep it patched and monitor logs.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-do-i-change-the-default-webmin-port\">How do I change the default Webmin port?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Edit \/etc\/webmin\/miniserv.conf and change \u201cport=10000\u201d to a custom port (e.g., 10443). Optionally set \u201cbind=YOUR_SERVER_IP\u201d. Restart Webmin and update your firewall rules to only allow trusted IPs to the new port.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"how-can-i-enable-https-for-webmin\">How can I enable HTTPS for Webmin?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Go to Webmin > Webmin Configuration > SSL Encryption and request a Let\u2019s Encrypt certificate. Enable \u201cRedirect non-SSL to SSL.\u201d Alternatively, place Webmin behind Nginx\/Apache with a certificate and keep miniserv on localhost.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"what-logs-should-i-monitor-for-webmin-activity\">What logs should I monitor for Webmin activity?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Monitor \/var\/webmin\/miniserv.log and \/var\/webmin\/miniserv.error for logins and issues, and journalctl -u webmin for service events. Pair logs with Fail2Ban to auto-block suspicious IPs and send email alerts on bans.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h3 id=\"can-i-use-2fa-with-webmin-users\">Can I use 2FA with Webmin users?<\/h3>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Yes. Webmin supports TOTP-based two-factor authentication under Webmin Configuration &gt; Two-Factor Authentication. Enforce it for all admin accounts and store recovery codes securely to avoid lockouts.<\/p>\n\n\n\n<p>By applying the steps above, you\u2019ll secure Webmin on a Linux server with layered defenses and continuous monitoring. Keep it simple, keep it updated, and keep it watched.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\n<script type=\"application\/ld+json\">\n\t{\n\t\t\"@context\": \"https:\/\/schema.org\",\n\t\t\"@type\": \"FAQPage\",\n\t\t\"mainEntity\": [\n\t\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Is it safe to expose Webmin to the public internet?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>It\u2019s safer to restrict Webmin to private networks or localhost and use an SSH tunnel or VPN. If exposure is required, enforce IP allowlists, HTTPS with a valid certificate, 2FA, and Fail2Ban. Keep it patched and monitor logs.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How do I change the default Webmin port?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Edit \/etc\/webmin\/miniserv.conf and change \u201cport=10000\u201d to a custom port (e.g., 10443). Optionally set \u201cbind=YOUR_SERVER_IP\u201d. Restart Webmin and update your firewall rules to only allow trusted IPs to the new port.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"How can I enable HTTPS for Webmin?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Go to Webmin > Webmin Configuration > SSL Encryption and request a Let\u2019s Encrypt certificate. Enable \u201cRedirect non-SSL to SSL.\u201d Alternatively, place Webmin behind Nginx\/Apache with a certificate and keep miniserv on localhost.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"What logs should I monitor for Webmin activity?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Monitor \/var\/webmin\/miniserv.log and \/var\/webmin\/miniserv.error for logins and issues, and journalctl -u webmin for service events. Pair logs with Fail2Ban to auto-block suspicious IPs and send email alerts on bans.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"Can I use 2FA with Webmin users?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Yes. Webmin supports TOTP-based two-factor authentication under Webmin Configuration &gt; Two-Factor Authentication. Enforce it for all admin accounts and store recovery codes securely to avoid lockouts.<\/p><p>By applying the steps above, you\u2019ll secure Webmin on a Linux server with layered defenses and continuous monitoring. Keep it simple, keep it updated, and keep it watched.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t\t\t\t]\n\t}\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>To monitor and secure Webmin on a Linux server, restrict network access (firewall and allowlists), enforce HTTPS with a valid [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":14509,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"iawp_total_views":4,"footnotes":""},"categories":[350],"tags":[2192,2141],"class_list":["post-14356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledgebase","tag-how-to-monitor-secure-webmin-on-linux","tag-linux-server"],"acf":[],"featured_image_src":"https:\/\/www.youstable.com\/blog\/wp-content\/uploads\/2025\/12\/How-to-Monitor-Secure-Webmin-on-Linux-Server.jpg","author_info":{"display_name":"Prahlad Prajapati","author_link":"https:\/\/www.youstable.com\/blog\/author\/prahladblog"},"_links":{"self":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/14356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/comments?post=14356"}],"version-history":[{"count":2,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/14356\/revisions"}],"predecessor-version":[{"id":14583,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/posts\/14356\/revisions\/14583"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media\/14509"}],"wp:attachment":[{"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/media?parent=14356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/categories?post=14356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.youstable.com\/blog\/wp-json\/wp\/v2\/tags?post=14356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}