Deployment guide

Webmin

Overview

Webmin is a long-standing, widely used, open-source, browser-based system administration panel for Linux. From a single browser session you can manage users and groups, installed packages, systemd services, cron jobs, the firewall, Apache or nginx, BIND, MySQL/MariaDB, disks and filesystems, and dozens of other aspects of the server, without remembering the underlying command-line syntax for each.

This SecureAnyCloud image installs Webmin from the official .deb package and runs it with its own built-in web server (miniserv). The server serves the admin console directly over HTTPS on port 10000, and Webmin's own login is the only gate in front of it. A minimal nginx instance fronts port 80, serves an unauthenticated health endpoint, and redirects everything else to the HTTPS console on port 10000.

Webmin has full administrative control of the operating system it runs on. It can create and delete users, install and remove packages, edit the firewall, and read and write almost any file on the server. Treat the admin credentials as root-equivalent, and read the security notes in Maintenance before you expose this VM beyond your own management network.

What you get:

Webmin 2.651 installed from the official .deb package, running as the webmin systemd service
Webmin's own HTTPS console and session login directly on port 10000, with a self-signed certificate regenerated per VM on first boot
Port 80 served by nginx: an unauthenticated /healthz endpoint, and a redirect to the HTTPS console for everything else
A unique admin administrator password generated on first boot of every VM and recorded in a root-only file (username admin)
A dedicated Azure data disk at /var/webmin holding Webmin's session cache and action logs
webmin.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point for administering a handful of servers from this panel. Webmin itself is lightweight.

Configure the NSG to allow inbound 22/tcp from your management network only, and 80/tcp for the health probe. Restrict 10000/tcp (the Webmin admin console) to trusted source IP ranges. Do not leave it open to the whole internet, because Webmin has full control of the server.

Port 443/tcp is reserved in case you later front the console with your own reverse proxy and a trusted certificate (see Maintenance). The appliance does not listen on it by default.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Webmin by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80), then add a custom rule for TCP 10000 restricted to your own IP range.

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms, create the VM, and open the Webmin console port:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:webmin-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name webmin \
  --image sac1647283583153:webmin-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name webmin --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name webmin --port 10000 --priority 1020

Restrict the port 10000 NSG rule to your own management IP range instead of leaving it open to *.

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that the Webmin and nginx services are running:

systemctl is-active webmin.service nginx.service

Both services report active:

active active

Webmin runs its own web server (miniserv) bound to all interfaces on port 10000. nginx separately fronts port 80 with a health endpoint and a redirect. The two are independent, and nginx does not proxy Webmin's console.

Step 5 - Retrieve your admin password

On the first boot of your VM, the image generates a unique Webmin administrator password and writes it to a root-only file:

sudo cat /root/webmin-credentials.txt

WEBMIN_URL=https://<vm-ip>:10000/ WEBMIN_USERNAME=admin WEBMIN_PASSWORD=<unique-per-vm-password>

Store the password somewhere safe, because it grants full administrative control of the server. The file is mode 0600 and owned by root, so only an administrator can read it. No default or known password ships in the image, and nobody can log in to Webmin until this file exists.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint on port 80 for load balancers and probes:

curl -s http://localhost/healthz

The endpoint returns ok. A plain request to port 80 for anything else returns HTTP 301 and redirects to the HTTPS console on port 10000:

curl -s -D - -o /dev/null http://localhost/

HTTP/1.1 301 Moved Permanently Server: nginx/1.24.0 (Ubuntu) Location: https://<vm-host>:10000/

The /healthz endpoint never requires authentication, so it is safe to use as an Azure Load Balancer health probe. Webmin's own console on port 10000 returns HTTP 200 for its login page.

Step 7 - Verify authentication from the command line

Webmin's login is a form post to /session_login.cgi over the TLS console port, and it establishes a session cookie. The check below authenticates with the correct per-VM password and receives a redirect with a fresh session cookie, while a wrong password stays on the login page.

The command embeds your unique password, so run it interactively rather than from a script. Substitute the value of WEBMIN_PASSWORD from Step 5 for <WEBMIN_PASSWORD>:

login() { jar=$(mktemp)
curl -sk -o /dev/null -c "$jar" https://127.0.0.1:10000/session_login.cgi status=$(curl -sk -o /dev/null -b "$jar" -c "$jar" -w '%{http_code}' \
  --data-urlencode action=login --data-urlencode user=admin \
  --data-urlencode "pass=$1" --data-urlencode page=/ \
  https://127.0.0.1:10000/session_login.cgi) rm -f "$jar" [ "$status" = 302 ] && echo "authenticated (302 + session cookie)" || echo "rejected ($status)" } login '<WEBMIN_PASSWORD>'

The correct per-VM password prints authenticated (302 + session cookie). A wrong or blank password prints rejected (200), because Webmin re-displays the login form instead of granting a session.

Step 8 - Sign in to the console

Browse to https://<vm-public-ip>:10000/. The appliance uses a self-signed certificate that is unique to your VM, so accept the browser warning. For production, put a trusted certificate in front instead (see Maintenance).

On the Webmin login page, enter the username admin and the password from Step 5.

Step 9 - The system dashboard

After you sign in, you land on the Webmin dashboard. It shows the server's operating system, uptime, CPU and memory load, and disk usage, plus a search box for every module you have access to.

Step 10 - Manage users and groups

Open System -> Users and Groups to create, edit or remove Unix user and group accounts directly from the browser. You can manage home directories, shells and group membership.

Step 11 - Manage running services

Open System -> Bootup and Shutdown (or System -> Running Processes) to see and control every systemd service and process on the server. You can start, stop, enable or disable services without an SSH session.

Step 12 - Confirm data lives on the dedicated disk

Webmin's session cache and action logs are stored under /var/webmin on a dedicated Azure data disk. They survive OS changes, and you can resize the disk independently of the OS disk:

findmnt /var/webmin

TARGET SOURCE FSTYPE OPTIONS /var/webmin /dev/sdc ext4 rw,relatime

Webmin's configuration (/etc/webmin) lives on the OS disk. Its identity state, which is the admin password hash and the TLS certificate, is reset to a locked value on every image build and regenerated fresh on every VM's first boot.

Maintenance

Treat this as a privileged appliance. Webmin can manage users, packages, the firewall and almost any file on this server. Restrict port 10000 in the NSG to trusted source IP ranges, never leave it open to the whole internet, and treat the admin password as root-equivalent.
TLS and your own domain: the appliance ships a per-VM self-signed certificate on port 10000, which always shows a browser warning. For production, either replace /etc/webmin/miniserv.pem with your own certificate and key and restart webmin.service, or put a trusted reverse proxy of your own in front. Port 443 is reserved in the NSG for this.
Password: the admin password is set on first boot. To change it from the command line, use /usr/share/webmin/changepass.pl /etc/webmin admin '<new-password>'. From the console, use Webmin -> Change Language and Theme or the Webmin Users module.
Modules: the admin account is granted every installed Webmin module. To create additional, more restricted accounts for other administrators, use the Webmin Users module (under Webmin).
Storage: Webmin's session cache and logs live under /var/webmin on the dedicated data disk, and its configuration lives under /etc/webmin on the OS disk.
Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically. You can upgrade Webmin itself from within the console (Webmin -> Webmin Configuration -> Software Package Updates) or with apt.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Webmin on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure