## Guide to the Secure Configuration of Webmin

> with profile Common Profile for Webmin system administration tool

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide
This guide presents a catalog of security-relevant configuration settings for Webmin. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the `scap-security-guide` package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for Webmin, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Title | Common Profile for Webmin system administration tool
Profile ID | xccdf_org.ssgproject.content_profile_common

## Revision History

Current version: 0.1.31

- draft (as of 2017-08-11)

## Platforms

## Table of Contents

1. Required User Account Settings
2. Session Security
3. Required log file configurations
4. Required patches
5. Webmin Modules

1. UserAdmin Module Required Settings

## Checklist

contains 28 rules

### Required User Account Settings [ref]group

To support a secured and compliant configuration, a number of user account settings need to be modified from there default configuration.

contains 3 rules

#### Use PAM for Unix authentication. [ref]rule

Webmin must use the OS-provided Password Authentication Module for validating passwords.

Rationale:

Severity: medium

Identifiers: CCE-

References: SA-2(b), 612

#### Use passwd for changing passwords. [ref]rule

Webmin must use passwd for password changes so that password requirements configured in the operating system are enforced on new password selections.

Rationale:

Severity: medium

Identifiers: CCE-

References: SA-2(b), 612

#### Enable the ability for a user to change an expired password. [ref]rule

Webmin must enable a user to change their password when it has expired.

Rationale:

Severity: medium

Identifiers: CCE-

References: SA-2(b), 612

### Session Security [ref]group

To support secured access to webmin.

contains 6 rules

#### Display approved login banner prior to login. [ref]rule

Display approved login banner prior to login.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Configure approved webmin port. [ref]rule

Configure approved webmin port.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Prevent the ability for a user to save their login credentials for future access. [ref]rule

Prevent the ability for a user to save their login credentials for future access.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Use approved ciphers for encryption. [ref]rule

Use approved ciphers for encryption.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Encryption is enabled and enforced. [ref]rule

Encryption is enabled and enforced.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Sessions are closed after idling a specified number of minutes. [ref]rule

Sessions are closed after idling a specified number of minutes.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

### Required log file configurations [ref]group

To support accountability of access to the system, required log file configurations must be applied.

contains 6 rules

#### Log actions performed by users. [ref]rule

Log actions performed by users.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Logs must not be accessible to unauthorized users. [ref]rule

Logs must not be accessible to unauthorized users.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Prevent users from covering their trail. [ref]rule

Prevent users from covering their trail.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Log access attempts to the webmin. [ref]rule

Log access attempts to the webmin.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Logs must not be accessible to unauthorized users. [ref]rule

Logs must not be accessible to unauthorized users.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Prevent users from covering their trail. [ref]rule

Prevent users from covering their trail.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

### Required patches [ref]group

To support combating known weaknesses, the webmin application must be up to date.

contains 1 rule

#### The Webmin application installed on the system is updated. [ref]rule

The Webmin application installed on the system is updated.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

### Webmin Modules [ref]group

The following sections contain information on security-relevant choices for configuring Webmin modules in an IA compliant manner.

contains 12 rules

### UserAdmin Module Required Settings [ref]group

To support a secured and compliant configuration, a number of user account settings need to be modified from there default configuration.

contains 12 rules

#### Configure new accounts to create their home directory with a default permission setting of 750. [ref]rule

New users created through the UserAdmin Webmin module must have the default permissions of 750 applied to their home directory when created.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Configure new accounts to lock out after a number of days of no activity. [ref]rule

New users created through the UserAdmin Webmin module must include required account expiration criteria.

Rationale:

Severity: medium

Identifiers: CCE-

References: AC-2(2), AC-2(3), 16, 17, 795

#### Configure new accounts to expire their password after a maximum number days. [ref]rule

New users created through the UserAdmin Webmin module must include required maximum password life criteria.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f), IA-5(g), IA-5(1)(d), 180, 199

#### Configure new accounts to prevent changing passwords more than once per the minimum number of days defined. [ref]rule

New users created through the UserAdmin Webmin module must include required minimum password life criteria.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f), IA-5(1)(d), 198

#### Configure new accounts to warn the user about their password expiring. [ref]rule

New users created through the UserAdmin Webmin module must include required account password expiration warning criteria.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Configure the UserAdmin Webmin module to store passwords created using a specified hashing algorithm. [ref]rule

Passwords generated through the UserAdmin Webmin module must be stored using the specified hashing algorithm.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Configure the UserAdmin Webmin module to require a minimum number of characters in passwords defined. [ref]rule

Passwords created through the UserAdmin Webmin module must include the minimum defined number of characters in the password.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f), IA-5(1)(a), 205

#### Configure the UserAdmin Webmin module to require at least 1 upper-case character, 1 lower-case character, 1 numeric character, and 1 special character. [ref]rule

Passwords created through the UserAdmin Webmin module must include at least 1 upper-case character, 1 lower-case character, 1 numeric character, and 1 special character.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f), IA-5(1)(a), 205

#### Configure the UserAdmin Webmin module to require passwords to not include dictionary words. [ref]rule

Passwords created through the UserAdmin Webmin module must not include dictionary words.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f), IA-5(1)(a), 205

#### Configure the UserAdmin Webmin module to require passwords to be different from the previously configured password. [ref]rule

Passwords created through the UserAdmin Webmin module must not be the same as the previous password used.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f), IA-5(1)(a), 205

#### Configure the UserAdmin Webmin module to mask the password characters entered with stars. [ref]rule

The UserAdmin Webmin module must not display the characters entered for the password in clear text.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

#### Configure the UserAdmin Webmin module to display last login information for all users. [ref]rule

User last login information must be displayed to support detecting unauthorized access.

Rationale:

Severity: medium

Identifiers: CCE-

References: IA-5(f)

Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.