this post was submitted on 28 Oct 2026
44 points (90.7% liked)

Selfhosted

63469 readers
554 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
44
Is webmin safe to have accesible over the web (sh.itjust.works)
submitted 4 days ago* (last edited 4 days ago) by DrunkAnRoot@sh.itjust.works to c/selfhosted@lemmy.world
45 comments fedilink hide all child comments
 

As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.

you are viewing a single comment's thread
view the rest of the comments
[–] slazer2au@lemmy.world 48 points 4 days ago (1 children)

It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.

[–] Andres4NY@social.ridetrans.it 7 points 4 days ago (2 children)
[–] slazer2au@lemmy.world 12 points 4 days ago (1 children)

OK, but if your threat landscape is someone burning 2 zero days (one tail scale, one webmin) you aren't likely to be posting here for answers you will have security people on call.

Geofencing is always a good option for remote access, no point in allowing someone from Spain to login when you are in Germany.

[–] Andres4NY@social.ridetrans.it 5 points 4 days ago

@slazer2au I'm just pointing out that tailscale isn't immune to security issues either. Maybe sticking webmin behind tailscale is the correct way to go, or maybe it's better to set up a heavily-restricted reverse proxy and keep the webmin user(s) off of the OP's private tailscale network.