SuSe Tumbleweed Webmin checks on Apache

[BlueEyedZebra]

Have not seen that on other OSses: Webmin checks sometimes with loading systeminformation on Apache2.
Apache-log:

My_own_server_IPv6 - - [01/May/2024:05:52:40 +0200] "GET /index.txt HTTP/1.0" 406 3511 "-" "Webmin"

Poking around for a file is not nice, it is the same level like all of the wp(?:admin|login|register)-bots and such from outside. Because the result of that request is not shown anywhere, it is a little bit useless. If people want to check for something on Apache, then tools->filemanager->/srv/www/htdocs is the way to go.

I havent seen it on SuSe 15.3 and earlier and Debian Bookworm.

If it is needed for something, then it should get a switch to turn it off.

,,,^..^(")

[iliajie]

My_own_server_IPv6 - - [01/May/2024:05:52:40 +0200] "GET /index.txt HTTP/1.0" 406 3511 "-" "Webmin"

Poking around for a file is not nice, it is the same level like all of the wp(?:admin|login|register)-bots and such from outside.

What makes you think that this was done by Webmin?

[BlueEyedZebra]

Only other thing would be tumblewwed itself. I control my application by myself and there is no access from outside.
It happens on every 3rd to 4th login into webmin at the same time of the login.

between usual SuSe, Debian and Tumbleweed was nothing changed at all (only everywhere slightly different configs, but the same (Debian is much different)).

I would start a debug file, if I would know, it can be only anyything related to the login or status collection.

,,,^..^(")

[iliajie]

I have dozens of Webmin instances and none of them have logged requests to index.txt. This must originate inside your network; perhaps, you're running Webmin behind proxy?

[BlueEyedZebra]

there is nothing, that crafts a network request with the webmin-UA. It started with the use of Tumbleweed.
The server is directly connected to the internet, somewhere in a datacenter.

I run now a debug log of all modules, might take 2 or 3 days, until a result shows up.

,,,^..^(")

[BlueEyedZebra]

So, I played around (including early morning and wrong password):

Apache access log

X:X:X - - [02/May/2024:06:35:50 +0200] "GET /index.txt HTTP/1.0" 406 3511 "-" "Webmin" 5/5022188
X:X:X - - [02/May/2024:06:38:57 +0200] "GET /index.txt HTTP/1.0" 302 - "-" "Webmin" 0/3696
X:X:X - - [02/May/2024:06:39:16 +0200] "GET /index.txt HTTP/1.0" 302 - "-" "Webmin" 0/3643

X:X:X - - [02/May/2024:08:48:13 +0200] "GET /index.txt HTTP/1.0" 302 - "-" "Webmin" 0/25006

X:X:X - - [02/May/2024:10:02:19 +0200] "GET /index.txt HTTP/1.0" 302 - "-" "Webmin" 0/3130

Webmin debug log

699 [02/May/2024 06:35:00.307956] - - - START "script=record-logout.pl"
699 [02/May/2024 06:35:00.311256] root - - STOP "runtime=0"
697 [02/May/2024 06:35:00.361190] - Y.Y.Y - START "script=session_login.cgi"
697 [02/May/2024 06:35:00.523582] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
697 [02/May/2024 06:35:00.614811] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
697 [02/May/2024 06:35:00.626337] - Y.Y.Y - STOP "runtime=0"
704 [02/May/2024 06:35:00.815128] - Y.Y.Y - START "script=session_login.cgi"
704 [02/May/2024 06:35:00.969854] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
704 [02/May/2024 06:35:01.059877] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
704 [02/May/2024 06:35:01.070819] - Y.Y.Y - STOP "runtime=1"
709 [02/May/2024 06:35:01.258589] - Y.Y.Y - START "script=session_login.cgi"
709 [02/May/2024 06:35:01.435973] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
709 [02/May/2024 06:35:01.526191] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
709 [02/May/2024 06:35:01.538380] - Y.Y.Y - STOP "runtime=0"
714 [02/May/2024 06:35:02.255106] - Y.Y.Y - START "script=session_login.cgi"
714 [02/May/2024 06:35:02.401014] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
714 [02/May/2024 06:35:02.484771] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
714 [02/May/2024 06:35:02.496486] - Y.Y.Y - STOP "runtime=0"
721 [02/May/2024 06:35:16.043011] - - - START "script=record-failed.pl"
721 [02/May/2024 06:35:16.045847] SOMEONE - - STOP "runtime=0"
719 [02/May/2024 06:35:16.085634] - Y.Y.Y - START "script=session_login.cgi"
719 [02/May/2024 06:35:16.231932] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
719 [02/May/2024 06:35:16.317208] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
719 [02/May/2024 06:35:16.328626] - Y.Y.Y - STOP "runtime=0"
727 [02/May/2024 06:35:16.508638] - Y.Y.Y - START "script=session_login.cgi"
727 [02/May/2024 06:35:16.654775] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
727 [02/May/2024 06:35:16.736524] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
727 [02/May/2024 06:35:16.745154] - Y.Y.Y - STOP "runtime=0"
732 [02/May/2024 06:35:17.008184] - Y.Y.Y - START "script=session_login.cgi"
732 [02/May/2024 06:35:17.173911] - Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
732 [02/May/2024 06:35:17.270453] - Y.Y.Y - CMD "cmd=md5sum /etc/webmin/miniserv.pem"
732 [02/May/2024 06:35:17.281592] - Y.Y.Y - STOP "runtime=0"
32616 [02/May/2024 06:33:25.198168] root Y.Y.Y webmin TCP "host=127.0.0.1 port=10000"
739 [02/May/2024 06:35:45.241488] - - - START "script=record-login.pl"
739 [02/May/2024 06:35:45.244983] root - - STOP "runtime=0"
740 [02/May/2024 06:35:45.405076] - Y.Y.Y - START "script=index.cgi"
740 [02/May/2024 06:35:45.433018] root Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
740 [02/May/2024 06:35:45.443047] root Y.Y.Y - STOP "runtime=0"
743 [02/May/2024 06:35:45.642473] - Y.Y.Y - START "script=left.cgi"
743 [02/May/2024 06:35:45.672924] root Y.Y.Y - STOP "runtime=0"
744 [02/May/2024 06:35:45.640455] - Y.Y.Y - START "script=right.cgi"
744 [02/May/2024 06:35:45.744574] root Y.Y.Y webmin HTTP "host=announce.webmin.com port=443 page=/index.txt ssl=1"
744 [02/May/2024 06:35:45.745601] root Y.Y.Y webmin TCP "host=announce.webmin.com port=443"
744 [02/May/2024 06:35:50.765931] root Y.Y.Y net CMD "mode=1 cmd=ip addr"
744 [02/May/2024 06:35:50.778960] root Y.Y.Y net CMD "cmd=/sbin/ethtool ens3 2>/dev/null"
744 [02/May/2024 06:35:51.021273] root Y.Y.Y mount CMD "cmd=df -k /"
744 [02/May/2024 06:35:51.034106] root Y.Y.Y mount CMD "cmd=df -i /"
744 [02/May/2024 06:35:51.060750] root Y.Y.Y system-status CMD "cmd=cat /proc/1/comm 2>/dev/null"
744 [02/May/2024 06:35:51.077581] root Y.Y.Y proc CMD "cmd=LC_ALL='' LANG='' uptime"
744 [02/May/2024 06:35:51.089476] root Y.Y.Y proc CMD "cmd=ps V 2>&1"
744 [02/May/2024 06:35:51.161981] root Y.Y.Y webmin HTTP "host=www.webmin.com port=80 page=/ ssl=0 dest=/tmp/.webmin/821896_744_1_right.cgi"
770 [02/May/2024 06:35:55.362936] - Y.Y.Y - START "script=index.cgi"
770 [02/May/2024 06:35:55.383174] root Y.Y.Y useradmin CMD "cmd=cat /proc/1/comm 2>/dev/null"
770 [02/May/2024 06:35:55.403443] root Y.Y.Y - STOP "runtime=0"
744 [02/May/2024 06:35:51.162191] root Y.Y.Y webmin TCP "host=www.webmin.com port=80"
744 [02/May/2024 06:35:56.165484] root Y.Y.Y - STOP "runtime=11"

32616 [02/May/2024 06:35:40.024757] root Y.Y.Y webmin TCP "host=127.0.0.1 port=10000"

1132 [02/May/2024 06:38:55.995389] SOMEONE Y.Y.Y proc CMD "cmd=vmstat 1 2 2>/dev/null"
1136 [02/May/2024 06:38:56.284101] - Y.Y.Y - START "script=index.cgi"
1136 [02/May/2024 06:38:56.436545] SOMEONE Y.Y.Y change-user CMD "cmd=cat /proc/1/comm 2>/dev/null"
1136 [02/May/2024 06:38:56.461922] SOMEONE Y.Y.Y change-user CMD "cmd=date +"%z""
1136 [02/May/2024 06:38:56.648535] SOMEONE Y.Y.Y - STOP "runtime=0"
1132 [02/May/2024 06:38:57.140517] SOMEONE Y.Y.Y - CMD "cmd=cat /proc/1/comm 2>/dev/null"
1132 [02/May/2024 06:38:57.150618] SOMEONE Y.Y.Y proc CMD "cmd=ps V 2>&1"
1132 [02/May/2024 06:38:57.206392] SOMEONE Y.Y.Y mount CMD "cmd=df -k /"
1132 [02/May/2024 06:38:57.215223] SOMEONE Y.Y.Y mount CMD "cmd=df -i /"
1132 [02/May/2024 06:38:57.226045] SOMEONE Y.Y.Y - STOP "runtime=2"
1075 [02/May/2024 06:38:52.317322] SOMEONE Y.Y.Y webmin TCP "host=announce.webmin.com port=443"
1075 [02/May/2024 06:38:57.336378] SOMEONE Y.Y.Y net CMD "mode=1 cmd=ip addr"
1075 [02/May/2024 06:38:57.349097] SOMEONE Y.Y.Y net CMD "cmd=/sbin/ethtool ens3 2>/dev/null"
1075 [02/May/2024 06:38:57.384513] SOMEONE Y.Y.Y mount CMD "cmd=df -k /"
1075 [02/May/2024 06:38:57.392964] SOMEONE Y.Y.Y mount CMD "cmd=df -i /"
1075 [02/May/2024 06:38:57.459099] SOMEONE Y.Y.Y proc CMD "cmd=LC_ALL='' LANG='' uptime"
1075 [02/May/2024 06:38:57.471795] SOMEONE Y.Y.Y proc CMD "cmd=ps V 2>&1"
1075 [02/May/2024 06:38:57.532183] SOMEONE Y.Y.Y webmin HTTP "host=www.webmin.com port=80 page=/ ssl=0 dest=/tmp/.webmin/285084_1075_1_index.cgi"

1245 [02/May/2024 06:39:11.937413] SOMEONE Y.Y.Y webmin HTTP "host=announce.webmin.com port=443 page=/index.txt ssl=1"
1245 [02/May/2024 06:39:11.938360] SOMEONE Y.Y.Y webmin TCP "host=announce.webmin.com port=443"
1245 [02/May/2024 06:39:16.993372] SOMEONE Y.Y.Y webmin HTTP "host=www.webmin.com port=80 page=/ ssl=0 dest=/tmp/.webmin/119494_1245_1_right.cgi"
1263 [02/May/2024 06:39:17.520243] - Y.Y.Y - START "script=index.cgi"
1263 [02/May/2024 06:39:17.558901] SOMEONE Y.Y.Y webmin CMD "cmd=cat /proc/1/comm 2>/dev/null"
1263 [02/May/2024 06:39:17.586066] SOMEONE Y.Y.Y init CMD "cmd=systemctl list-units"
1263 [02/May/2024 06:39:17.603873] SOMEONE Y.Y.Y init CMD "cmd=systemctl show webmin.service 2>&1"
1263 [02/May/2024 06:39:17.621430] SOMEONE Y.Y.Y - STOP "runtime=0"
1245 [02/May/2024 06:39:16.993599] SOMEONE Y.Y.Y webmin TCP "host=www.webmin.com port=80"
1245 [02/May/2024 06:39:21.996487] SOMEONE Y.Y.Y - STOP "runtime=10"
32705 [02/May/2024 06:37:10.478077] root Y.Y.Y webmin TCP "host=127.0.0.1 port=10000"
1271 [02/May/2024 06:39:29.918256] - Y.Y.Y - START "script=index.cgi"
1271 [02/May/2024 06:39:29.936168] SOMEONE Y.Y.Y acl CMD "cmd=cat /proc/1/comm 2>/dev/null"
1271 [02/May/2024 06:39:29.953936] SOMEONE Y.Y.Y - STOP "runtime=0"
1275 [02/May/2024 06:39:33.144852] - Y.Y.Y - START "script=edit_user.cgi"
1275 [02/May/2024 06:39:33.206463] SOMEONE Y.Y.Y acl CMD "cmd=cat /proc/1/comm 2>/dev/null"
1275 [02/May/2024 06:39:33.404022] SOMEONE Y.Y.Y - STOP "runtime=0"
32616 [02/May/2024 06:37:54.851383] root Y.Y.Y webmin TCP "host=127.0.0.1 port=10000"
1011 [02/May/2024 06:38:31.642298] root Y.Y.Y acl TCP "host=127.0.0.1 port=10000"

1831 [02/May/2024 08:48:08.580820] SOMEONE Y.Y.Y webmin HTTP "host=announce.webmin.com port=443 page=/index.txt ssl=1"
1831 [02/May/2024 08:48:08.581728] SOMEONE Y.Y.Y webmin TCP "host=announce.webmin.com port=443"
1831 [02/May/2024 08:48:13.601017] SOMEONE Y.Y.Y net CMD "mode=1 cmd=ip addr"
1831 [02/May/2024 08:48:13.611046] SOMEONE Y.Y.Y net CMD "cmd=/sbin/ethtool ens3 2>/dev/null"
1831 [02/May/2024 08:48:13.652176] SOMEONE Y.Y.Y webmin HTTP "host=www.webmin.com port=80 page=/ ssl=0 dest=/tmp/.webmin/632443_1831_1_right.cgi"
1831 [02/May/2024 08:48:13.652392] SOMEONE Y.Y.Y webmin TCP "host=www.webmin.com port=80"

2696 [02/May/2024 10:02:14.559514] - Y.Y.Y - START "script=right.cgi"
2696 [02/May/2024 10:02:14.838435] SOMEONE Y.Y.Y webmin HTTP "host=announce.webmin.com port=443 page=/index.txt ssl=1"
2696 [02/May/2024 10:02:14.839350] SOMEONE Y.Y.Y webmin TCP "host=announce.webmin.com port=443"
2696 [02/May/2024 10:02:19.862405] SOMEONE Y.Y.Y net CMD "mode=1 cmd=ip addr"
2696 [02/May/2024 10:02:19.874087] SOMEONE Y.Y.Y net CMD "cmd=/sbin/ethtool ens3 2>/dev/null"
2696 [02/May/2024 10:02:19.915401] SOMEONE Y.Y.Y mount CMD "cmd=df -k /"
2696 [02/May/2024 10:02:19.925723] SOMEONE Y.Y.Y mount CMD "cmd=df -i /"
2696 [02/May/2024 10:02:19.954517] SOMEONE Y.Y.Y system-status CMD "cmd=cat /proc/1/comm 2>/dev/null"
2696 [02/May/2024 10:02:19.969615] SOMEONE Y.Y.Y proc CMD "cmd=LC_ALL='' LANG='' uptime"
2696 [02/May/2024 10:02:19.980093] SOMEONE Y.Y.Y proc CMD "cmd=ps V 2>&1"
2696 [02/May/2024 10:02:20.077200] SOMEONE Y.Y.Y webmin HTTP "host=www.webmin.com port=80 page=/ ssl=0 dest=/tmp/.webmin/64668_2696_1_right.cgi"
2696 [02/May/2024 10:02:20.077390] SOMEONE Y.Y.Y webmin TCP "host=www.webmin.com port=80"
2696 [02/May/2024 10:02:25.080410] SOMEONE Y.Y.Y - STOP "runtime=11"
2716 [02/May/2024 10:02:31.474725] - Y.Y.Y - START "script=index.cgi"
2716 [02/May/2024 10:02:31.498689] SOMEONE Y.Y.Y filemin CMD "cmd=cat /proc/1/comm 2>/dev/null"

miniserv log

Y.Y.Y - - [02/May/2024:06:35:00 +0200] "GET /session_login.cgi?logout=1 HTTP/1.1" 401 4900
Y.Y.Y - - [02/May/2024:06:35:01 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - - [02/May/2024:06:35:01 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - - [02/May/2024:06:35:02 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - - [02/May/2024:06:35:16 +0200] "POST /session_login.cgi HTTP/1.1" 401 4902
Y.Y.Y - - [02/May/2024:06:35:16 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - - [02/May/2024:06:35:17 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - root [02/May/2024:06:35:45 +0200] "POST /session_login.cgi HTTP/1.1" 302 0
Y.Y.Y - root [02/May/2024:06:35:45 +0200] "GET / HTTP/1.1" 200 888
Y.Y.Y - root [02/May/2024:06:35:45 +0200] "GET /left.cgi HTTP/1.1" 200 13104
Y.Y.Y - root [02/May/2024:06:35:46 +0200] "GET /service-worker.js HTTP/1.1" 404 1460
Y.Y.Y - root [02/May/2024:06:35:55 +0200] "GET /useradmin/ HTTP/1.1" 200 69365
Y.Y.Y - root [02/May/2024:06:35:56 +0200] "GET /right.cgi?open=system&auto=status&open=updates&open=common&open=owner&open=reseller&open=vm2limits&open=vm2usage HTTP/1.1" 200 26682
Y.Y.Y - root [02/May/2024:06:35:56 +0200] "GET /service-worker.js HTTP/1.1" 404 1460

Y.Y.Y - - [02/May/2024:06:38:34 +0200] "GET /session_login.cgi?logout=1 HTTP/1.1" 401 4900
Y.Y.Y - - [02/May/2024:06:38:34 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - - [02/May/2024:06:38:35 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - SOMEONE [02/May/2024:06:38:50 +0200] "POST /session_login.cgi HTTP/1.1" 302 0
Y.Y.Y - SOMEONE [02/May/2024:06:38:50 +0200] "GET / HTTP/1.1" 200 74422
Y.Y.Y - SOMEONE [02/May/2024:06:38:50 +0200] "GET /service-worker.js HTTP/1.1" 200 141
Y.Y.Y - SOMEONE [02/May/2024:06:38:51 +0200] "GET /service-worker.js HTTP/1.1" 200 141
Y.Y.Y - SOMEONE [02/May/2024:06:38:51 +0200] "POST /index.cgi HTTP/1.1" 200 502
Y.Y.Y - SOMEONE [02/May/2024:06:38:51 +0200] "POST /index.cgi HTTP/1.1" 200 1
Y.Y.Y - SOMEONE [02/May/2024:06:38:51 +0200] "GET /sysinfo.cgi HTTP/1.1" 200 14272
Y.Y.Y - SOMEONE [02/May/2024:06:38:54 +0200] "GET /stats.cgi?xhr-stats=general&sdata=1 HTTP/1.1" 200 674
Y.Y.Y - SOMEONE [02/May/2024:06:38:56 +0200] "POST /change-user/ HTTP/1.1" 200 25170
Y.Y.Y - SOMEONE [02/May/2024:06:38:57 +0200] "GET /stats.cgi?xhr-stats=general&sdata=1 HTTP/1.1" 200 842

Y.Y.Y - SOMEONE [02/May/2024:06:39:17 +0200] "GET /webmin/ HTTP/1.1" 200 10819
Y.Y.Y - SOMEONE [02/May/2024:06:39:18 +0200] "GET /service-worker.js HTTP/1.1" 404 1460
Y.Y.Y - SOMEONE [02/May/2024:06:39:21 +0200] "GET /right.cgi?open=system&auto=status&open=updates&open=common&open=owner&open=reseller&open=vm2limits&open=vm2usage HTTP/1.1" 200 26347
Y.Y.Y - SOMEONE [02/May/2024:06:39:29 +0200] "GET /acl/ HTTP/1.1" 200 10783
Y.Y.Y - SOMEONE [02/May/2024:06:39:30 +0200] "GET /service-worker.js HTTP/1.1" 404 1460

Y.Y.Y - SOMEONE [02/May/2024:08:48:07 +0200] "POST /session_login.cgi HTTP/1.1" 302 0
Y.Y.Y - SOMEONE [02/May/2024:08:48:07 +0200] "GET / HTTP/1.1" 200 888
Y.Y.Y - SOMEONE [02/May/2024:08:48:08 +0200] "GET /left.cgi HTTP/1.1" 200 8460
Y.Y.Y - SOMEONE [02/May/2024:08:48:08 +0200] "GET /service-worker.js HTTP/1.1" 404 1460
Y.Y.Y - SOMEONE [02/May/2024:08:48:18 +0200] "GET /right.cgi?open=system&auto=status&open=updates&open=common&open=owner&open=reseller&open=vm2limits&open=vm2usage HTTP/1.1" 200 26683
Y.Y.Y - SOMEONE [02/May/2024:08:48:19 +0200] "GET /service-worker.js HTTP/1.1" 404 1460
Y.Y.Y - SOMEONE [02/May/2024:08:48:27 +0200] "GET /acl/list_sessions.cgi HTTP/1.1" 200 2894
Y.Y.Y - SOMEONE [02/May/2024:08:48:28 +0200] "GET /service-worker.js HTTP/1.1" 404 1460
Y.Y.Y - SOMEONE [02/May/2024:08:48:33 +0200] "GET /webmin/ HTTP/1.1" 200 10819
Y.Y.Y - SOMEONE [02/May/2024:08:48:34 +0200] "GET /service-worker.js HTTP/1.1" 404 1460

Y.Y.Y - - [02/May/2024:10:01:35 +0200] "GET /session_login.cgi?logout=1 HTTP/1.1" 401 4900
Y.Y.Y - - [02/May/2024:10:01:35 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - - [02/May/2024:10:01:36 +0200] "GET /service-worker.js HTTP/1.1" 401 4731
Y.Y.Y - SOMEONE [02/May/2024:10:02:14 +0200] "POST /session_login.cgi HTTP/1.1" 302 0
Y.Y.Y - SOMEONE [02/May/2024:10:02:14 +0200] "GET / HTTP/1.1" 200 888
Y.Y.Y - SOMEONE [02/May/2024:10:02:14 +0200] "GET /left.cgi HTTP/1.1" 200 8460
Y.Y.Y - SOMEONE [02/May/2024:10:02:15 +0200] "GET /service-worker.js HTTP/1.1" 404 1460
Y.Y.Y - SOMEONE [02/May/2024:10:02:25 +0200] "GET /right.cgi?open=system&auto=status&open=updates&open=common&open=owner&open=reseller&open=vm2limits&open=vm2usage HTTP/1.1" 200 27018
Y.Y.Y - SOMEONE [02/May/2024:10:02:26 +0200] "GET /service-worker.js HTTP/1.1" 404 1460

Before the last one I changed Webmin update check to local file, but still continues. Because SuSe was always a pain to setup a static dual stack without having any GUI (I managed it only once in 11 years, that Webmin allowed me to setup IPv6 in Network config), there might be some resolution confict, whatever. To solve it, tzhere might be a switch to turn off the requests to webmin.com on 80 and 443. Then I have to take care of updates by myself.

Perhaps Tumbleweed is not 100% compatible. As I said before, with SuSe 13.something to 15.4 and Debian were not such requests.

,,,^..^(")

[iliajie]

X:X:X - - [02/May/2024:06:35:50 +0200] "GET /index.txt HTTP/1.0" 406 3511 "-" "Webmin" 5/5022188

1. X:X:X is one of your IPs?

2. Is Webmin running behind Apache proxy?

3. What is DirectoryIndex set to in your Apache configs? (i.e. grep -Rsi DirectoryIndex /etc)

[BlueEyedZebra]

XXX is the server IP, IPv6 (not the IPv4, why ever)
Webmin is running on its own small webserver.

grep -Rsi DirectoryIndex /etc
grep: /etc/alternatives/mod_autoindex.so: binary file matches
grep: /etc/alternatives/mod_dir.so: binary file matches
/etc/apache2/conf.d/php8-fpm.conf:# DirectoryIndex index.php4
/etc/apache2/conf.d/php8-fpm.conf:# DirectoryIndex index.php5
/etc/apache2/conf.d/php8-fpm.conf:# DirectoryIndex index.php7
/etc/apache2/conf.d/php8-fpm.conf:# DirectoryIndex index.php8
/etc/apache2/conf.d/php8-fpm.conf:# DirectoryIndex index.php
/etc/apache2/httpd.conf:DirectoryIndex Index.php

The default .php4-8 are commented out.

All of the years I followed the rule, that you should not use your own Apache, let webmin do anything, and anything was ok.

,,,^..^(")

[iliajie]

I'm not sure what's a cause of those requests, and I highly doubt they're coming from Webmin. You'll need to dig into this issue deeper!

[BlueEyedZebra]

Fresh install of TW and Webmin, already the second time. There must be something, that creates a HTTP-request with that useragent.
Only possibility is, that there is some loop in the network, so requests get redirected. Possible due to firewall setting, if webmin.com sits in an ASN, that is blocked for incomming traffic.

Is there a way for me to disable the "talk-back" to webmin to test, if it will go away? Plain TW, MariaDB, Apache and PHP freshly installed, should be unable to craft a request to the outside world.

,,,^..^(")

[BlueEyedZebra]

I checked around with tcpflow. Webmin connects to 216.105.38.11:80 and 44.217.106.106:443 at login (else login script or status page). A handcrafted request there for the index.txt brings up a login form.
It seems to be the update checker.
Does that update checker craft a request to those IPs with the useragent "webmin"?
Is there a way to switch it off (temporarily) to make sure, it is that update checker? I'm unable to change the file for updates, the radiobuttons at Webmin Configuration -> Upgrade Webmin always reset to "Latest version from www.webmin.com".

Booth IPs are blocked incomming via ipset because of the usual badness of AS14618 and a route mismatch of AS11320, that might create that issue. I dont want to dig into 150 MB of Webmin source code.

If Webmin creates that requests, then I can live with that.

,,,^..^(")

[BlueEyedZebra]

I should have looked up earlier into a different security wrapper: The request was sent to announce.webmin.com. Somehow that is resolved to myself.
Checking that url manually gives the result "exploit.txt" on an Apache 2.2.15. Calling there the exploit-txt manually gives an outdates security advice for some Webmon 1.9.

The url announce.webmin.com is hardcoded in system_info.pl.
Because it is not used actively used anymore, it can be removed. Or it can be updated to give more recent security advices, but the server there should be updated first.

The file system_info.pl seems to deal only with fetching and computing the answer of that server only.

,,,^..^(")