Webmin theme open internet facing port 555 ?

[aqueos]

hi,

i just installed a server and saw that the theme is opening port 555

root        6498  0.0  0.0 107400 102964 ?       S    Jul29   8:29 /usr/bin/perl /usr/share/webmin/authentic-theme/stats.pl 555
root      424609  0.0  0.0   2580  1344 ?        S    17:58   0:00  \_ sh -c (vmstat 1 2 2>/dev/null)
root      424610  0.0  0.0   6192  2688 ?        S    17:58   0:00      \_ vmstat 1 2

tcp 0 0 0.0.0.0:555 0.0.0.0:* LISTEN 6498/perl

i just dont saw this comming and i really wonder if this is normal that a theme just open on the whole internet a port that god knows what can be done on a root owned process.

Is it legit, is it a hack ?

I did not activate it so it seems by default. If it is legit this is really concerning.

regards,
Ghislain.

[aqueos]

i dont know if i did something bad, being hack or if this is legit.

[iliaross]

Hello,

Yes, it's totally expected. It's a safe process which collects system stats in the background and then show them on the dashboard UI.

[aqueos]

ouch !

as a sysadmin having a process that open a socket on the net like this for a theme is not something i can understand :)

i have gazillions of question:
why does it need to listen on the public internet ?
why someone in australia can access this process ?
why take this security risk ?
is it possible to shut it down with a command line configuration without the need to connect to each panel one by one ?
should it not be on 127.0.0.1 ?

sorry but from a security standpoint, even if you say that its secure, i would not want that in any case but perhaps that-s just me.

Sorry i am panicking a little here.

best regards,
Ghislain.

[aqueos]

seems
+settings_sysinfo_real_time_status=0;
in /etc/webmin/authentic-theme/settings.js

should do the trick.

[iliaross]

why does it need to listen on the public internet ?
why someone in australia can access this process ?

It isn't available to the public unless you open that specific port range, which is random by nature. Also, unauthenticated users can't access it. A Webmin user session is needed for it to work but not directly. It will only be exportable if Webmin itself can be exploited.

why take this security risk ?

What security risk? Is there anything wrong in particular?

is it possible to shut it down with a command line configuration without the need to connect to each panel one by one ?

You can disable live stats collection in theme configuration or manually by editing /etc/webmin/authentic-theme/settings.js file and setting settings_sysinfo_real_time_status=0.

should it not be on 127.0.0.1 ?

It copies the settings Webmin is set to listen on. If you have Webmin listen on 127.0.0.1, then the stats.pl process will do the same. But again, just don't open port 555 (or any other below 1000) in the firewall, and even if it listens on 0.0.0.0, which is the default, there shouldn't be an issue if it's behind a firewall.

Generally, block everything by default and allow only what you need specifically.

[jcameron]

@iliaross is that connection to stats.pl not made via websockets on port 10000 ?

[iliaross]

@iliaross is that connection to stats.pl not made via websockets on port 10000 ?

It is made via WebSockets.

[jcameron]

It is made via WebSockets.

How is port 555 being used then? I thought with websockets everything was proxied via the main HTTP port.

[iliaross]

See this status output:

... shellserver.pl and stats.pl aren't just listing on 127.0.0.1, they are listing on all IPs.

[jcameron]

Oh I see now - so since this port is being used only for a localhost connection, I would 100% agree that it should only be bound to localhost and not open to the public internet.

[jcameron]

Code to do this in shellserver.pl is like : https://www.google.com/search?q=Net%3A%3AWebSocket%3A%3AServer+listen+on+localhost&sca_esv=66874c16b3ccadbb&sxsrf=AE3TifMMYV8asLIS-9NixxVnmcVVSWmisw%3A1753919373072&ei=ja-KaP-hAv2C0PEPr-27mAs&ved=0ahUKEwi_nMfp4uWOAxV9ATQIHa_2DrMQ4dUDCBE&uact=5&oq=Net%3A%3AWebSocket%3A%3AServer+listen+on+localhost&gs_lp=Egxnd3Mtd2l6LXNlcnAiKk5ldDo6V2ViU29ja2V0OjpTZXJ2ZXIgbGlzdGVuIG9uIGxvY2FsaG9zdEiwGVD0B1jWGHACeACQAQCYAWugAdQNqgEEMTguMbgBA8gBAPgBAZgCAKACAJgDAIgGAZIHAKAH1wayBwC4BwDCBwDIBwA&sclient=gws-wiz-serp

[iliaross]

@aqueos Thanks for reporting this! We will fix it in the next Webmin release.