Webmin Administrator's Cookbook: Over 100 recipes to leverage the features of Webmin and master the art of administering your web or database servers.

Webmin's user management features are quite sophisticated. You can use Webmin to manage users and groups on your system, decide which of them have access to Webmin, and which modules they will be allowed to see. You can also create special Webmin-only users, who will not have regular accounts on your system, but will still be able to access selected Webmin modules.

If you're the main administrator of a system, you can set up Webmin to allow other administrators to modify only selected parts of your system's configuration. For instance, you can allow sub-administrators to configure the Apache web server but not to change other settings. This particular workflow is so common, in fact, that a sibling product to Webmin called Usermin was developed to allow non-administrators access to a Webmin-like environment through which they can access databases, configure web hosts, set up cron jobs, and read local mail.

The simplest way to grant someone access to Webmin is to create a Webmin user account for him/her. You can regulate which IPs the user will be allowed to log in from and even at what times during the week the access will be open. During account creation, you can specify what modules the user will have access to or which group he/she will belong to.

In this recipe, we will create a new user with access to only one module.

Webmin users should be organized into groups. If you have more then one user whom you would like to equip with the same privileges, creating a group is the way to go. Webmin provides very granular permissions, which you can grant to each group. You can set the following three types of permissions:

Webmin's default settings don't allow regular system users to log in to Webmin, but at least one user is allowed to log in after installation. Depending on the settings included in your Webmin package, that may be any of the following:

In this recipe, we will allow all users of a Unix group to log in to Webmin with limited permissions.

In previous recipes, we talked about creating Webmin users and allowing system users to log in as a chosen Webmin account. You may choose to have a more direct, one-to-one correspondence between Webmin and system accounts. You can achieve this by creating Webmin accounts for selected existing users and setting up account synchronization for users added in the future.

Webmin keeps a log of all the actions performed by users. You can inspect a list of currently open user sessions, check what actions were performed during a session, or close a session, forcing the user to be logged out.

Creating user accounts in Unix is a multistep process: you need to add user data to system configuration files, create a home directory, copy template files to that directory, and set ownership of those files to the new user. Webmin automates this process for you.

Modifying basic information about an existing user is usually quite simple. The exception to this rule is the change of a user's UID. This is sometimes necessary if a user has accounts on two different Unix systems and both systems have to identify him/her as the same person. A typical example of this situation is sharing files over NFS as we will discuss in Chapter 6, Managing Files on Your System.

Changing a UID requires an update of file ownership of all files belonging to that user. This can be quite tedious, but Webmin does the job for us.

If a person stops using your system, it's often a good idea not to delete their account, but rather to disable it. Perhaps you need to preserve data for forensic purposes, the user would need access to your system again in the future or is the owner of files on your system, which you don't want to delete or leave orphaned.

Creating and editing system groups through Webmin is very simple; just follow the steps outlined.

When a user forgets his/her password, he/she will contact you as the system's administrator and request a password reminder. For security reasons, passwords are stored on your system only in the form of cryptographic hashes, not plain text. Because of this, you cannot send passwords to users, but you can reset a password and send the new one to the user. The best practice in such a case is to make the new password usable only once, allowing the user to log in, but requesting that he/she immediately change it to a password of his/her own choice.

In this recipe, we will describe how to reset a user's password to a one-time value.

When you're setting up another server for your organization, you may need to recreate accounts of multiple users on the new system. Webmin's user management module has the ability to export data about existing user accounts to a special batch file, which you can then import into any other system that also runs Webmin. This allows you to recreate multiple accounts quickly and easily.

If you would like to make the basic functionality of your system available to its users through an interface similar to Webmin, you can use Webmin's companion product called Usermin. This environment is just as easy to use as Webmin and provides a number of features that do not require administrative privileges: