How to Use Webmin: A Web-Based System Administration Tool
Webmin provides a browser-based interface for tasks such as managing users, services, packages, storage, and firewall rules. It normally listens on TCP port 10000 and uses HTTPS, not plain HTTP. Because Webmin can perform privileged system operations, treat its login page like any other administrative interface: install updates promptly, use strong credentials, and restrict who can connect.
Install Webmin
Use your distribution's supported Webmin repository rather than downloading an old standalone package. Repository instructions can change, so confirm them against the official Webmin documentation before installation.
RHEL, Rocky Linux, AlmaLinux, and related systems
Create /etc/yum.repos.d/webmin.repo with the following contents:
[Webmin]
name=Webmin Distribution Neutral
mirrorlist=https://download.webmin.com/download/yum/mirrorlist
enabled=1
gpgkey=https://download.webmin.com/jcameron-key.asc
gpgcheck=1
Then import the signing key and install Webmin:
sudo rpm --import https://download.webmin.com/jcameron-key.asc
sudo dnf install webmin
On older RHEL-family releases, yum may be the available package manager instead of dnf. Do not disable gpgcheck; it verifies that packages came from the configured repository.
Debian, Ubuntu, and related systems
Store the repository key in a dedicated keyring, then connect it to a separate Webmin source file. This is safer than giving the key permission to sign every repository on the system.
sudo install -m 0755 -d /usr/share/keyrings
wget -qO- https://download.webmin.com/jcameron-key.asc | sudo gpg --dearmor --yes -o /usr/share/keyrings/webmin.gpg
echo 'deb [signed-by=/usr/share/keyrings/webmin.gpg] https://download.webmin.com/download/repository sarge contrib' | sudo tee /etc/apt/sources.list.d/webmin.list
sudo apt update
sudo apt install webmin
The sarge value is Webmin's distribution-neutral APT suite name; it does not mean that you are installing the long-obsolete Debian Sarge release. Older instructions using apt-key add are deprecated on current Debian and Ubuntu systems. Likewise, avoid the old /etc/apt/trusted.gpg.d approach when a repository-specific signed-by keyring is available.
Start and enable Webmin
On current systemd-based distributions, enable Webmin at boot and start it now:
sudo systemctl enable --now webmin
sudo systemctl status webmin
Older guides often use sudo /etc/init.d/webmin start. That command is mainly useful on legacy SysV init systems; use systemctl where it is available.
Connect with HTTPS
From an authorized machine, open https://SERVER_IP:10000/, replacing SERVER_IP with the server's reachable address. Use https://localhost:10000/ only when running the browser on the server itself or when forwarding the port. Do not use http://; Webmin's login credentials and session traffic should be encrypted.
A new installation may present a self-signed certificate warning. Verify that you are connecting to the intended server before proceeding. For regular use, configure a certificate for the server's real hostname rather than teaching administrators to ignore certificate warnings.
An SSH tunnel avoids exposing Webmin on the network at all:
ssh -L 10000:127.0.0.1:10000 admin@SERVER_IP
Keep that SSH session open, then browse to https://localhost:10000/. If local port 10000 is already occupied, use -L 11000:127.0.0.1:10000 and browse to https://localhost:11000/ instead. When this method is used, no inbound firewall rule for port 10000 is needed; only SSH must be reachable.
Restrict firewall access to port 10000
Do not expose Webmin directly to the public internet. It is a high-value administrative target: a stolen password or a Webmin vulnerability could give an attacker extensive control of the host. HTTPS protects traffic in transit, but it does not prevent scanning, brute-force attempts, or exploitation. Prefer a VPN or SSH tunnel. If direct LAN access is necessary, allow only a known administrator IP and apply equivalent restrictions in any cloud security group or upstream firewall.
Avoid older broad rules such as ufw allow 10000 or firewall-cmd --add-port=10000/tcp, which allow connections from every reachable source. For UFW, scope the rule instead:
sudo ufw allow from 203.0.113.10 to any port 10000 proto tcp
For firewalld, use a source-specific rich rule and make it persistent:
sudo firewall-cmd --permanent --rich-rule='rule family="ipv4" source address="203.0.113.10/32" port port="10000" protocol="tcp" accept'
sudo firewall-cmd --reload
Replace 203.0.113.10 with your administrator machine's real, stable IP address. If you previously added an unrestricted rule, remove that rule as well; adding a narrow allow rule does not cancel a broader one. Also remove any router port-forwarding or NAT rule that exposes TCP 10000 publicly.
Credentials and updates
Webmin normally authenticates system users. Use a unique, strong password for each authorized administrator, avoid shared logins, and grant only the privileges each person needs. Enable Webmin's two-factor authentication where supported. Changing the default port is not a substitute for these controls.
Keep both Webmin and the underlying operating system updated, especially on supported releases that still receive security fixes:
# Debian/Ubuntu
sudo apt update
sudo apt install --only-upgrade webmin
# RHEL-family systems
sudo dnf upgrade webmin
Review release notes and apply broader OS updates during your normal maintenance window. An unsupported, end-of-life operating system should be upgraded or replaced rather than made reachable through Webmin.
Troubleshooting and common mistakes
If the page will not load, check the service, listener, logs, and firewall in that order:
sudo systemctl status webmin
sudo ss -lntp | grep ':10000'
sudo journalctl -u webmin -n 100 --no-pager
sudo ufw status verbose # UFW systems
sudo firewall-cmd --list-all # firewalld systems
A timeout usually points to a firewall, routing, or cloud security-group problem; a connection refusal usually means Webmin is stopped or not listening on that address. A certificate error is different from either connectivity problem. Finally, check that the URL includes https:// and port 10000, and remember that an unrestricted firewall rule or an outdated installation can make a working login dangerously exposed.
Top comments (0)