One danger when using a web-based administration interface like Webmin is that a link from another website may point to a program on your Webmin server. For example, a malicious site could include HTML code like:
<a href=http://localhost:10000/proc/run.cgi?cmd=rm+*>click me</a>
Clicking on this harmless-looking link would cause Webmin's Running Processes module to run a command that deletes files on your system! Assuming that you have already logged into Webmin, no password would be required. Worse still, a similar URL could be used in an <img> tag for an image, which is fetched automatically by your browser as soon as you open a page that seems innocuous.
Fortunately, there is a solution. Most browsers send the full URL of the page from which a link came in their HTTP requests. By default, Webmin compares the hostname in this URL with the one used to access the current page and displays a warning if they do not match. This blocks links from other websites to your Webmin server, except for those that do not specify a program, such as http://localhost:10000/cron/, and are therefore harmless.
Sometimes, however, you will want to allow such links, such as from an internal Intranet web server that you maintain and trust. For this reason, Webmin can be configured to allow links where the referrer is from a list of trusted hosts. The following steps explain how.
1. | |
2. | To turn off referrer checking entirely (which is not a good idea), change the Referer checking enabled? field to No. |
3. | |
4. | In some cases, the browser will not provide any referrer information at all, possibly because it does not support that HTTP feature. When the Trust links from unknown referrers box is checked, Webmin will allow requests in this case. If you are paranoid and know that your browser always does supply referrer information, turn this option off. |
5. |
Webmin does not simply deny links from untrusted sites. Instead, it displays a warning and gives the user a chance to continue with the link. This warning form contains a checkbox labeled Don't show this warning in future, which if selected effectively, changes the Referrer checking enabled? field to No.
18.222.166.105