This PR addresses privately reported issue and tries to restricts root/UID 0 user mutations and Custom Commands definition editing to full, non-safe Webmin admins.
This closes privilege-escalation paths for restricted operators while preserving execution of pre-approved Custom Commands under existing cmds ACLs.
ⓘ Prevent Webmin from swallowing Certbot's key-path output when extracting PEM paths, while preserving IPv6 cert-name support and adding regression coverage.
ⓘ Create and configure missing bond devices with ip link, attach partner interfaces before assigning addresses, avoid legacy module auto-creation when ip is available, and add regression coverage.
Ref.: https://github.com/webmin/webmin/pull/2777
This PR fixes an issue where, after an unclean exit, Webmin can leave `miniserv.pid` behind.
If the kernel later reuses that PID for an unrelated process, the startup guard only checked that the PID was alive and refused to start with “Webmin is already running”.
With systemd restart handling, this can leave Webmin permanently down until the PID file is manually removed.
This change verifies that the live PID actually belongs to `miniserv.pl` running the same config before treating it as an active Webmin instance.
On Linux, it reads `/proc/<pid>/cmdline`, checks the miniserv script, and compares the config file by inode so symlinked paths still match and Usermin is correctly distinguished.
If the PID is confirmed unrelated, the stale PID file is removed and startup continues. If the process cannot be inspected, the previous conservative behavior is preserved.
Also hardens PID-file parsing with chomp and numeric validation, and adds tests for unrelated PID reuse, matching config, symlinked config, different miniserv config, and unreadable command-line fallback.
This PR ensure proxied WebSocket backend writes complete the full buffer for both TLS and plain TCP connections.
Fail backend handshakes cleanly if writes cannot be completed, preventing truncated headers or frames from corrupting linked WebSocket tunnels.
Originally hinted by this code review: d1d1bad4ae (r189931785)
ⓘ Display Webmin-managed SSH public keys from the configured real home directory for automatic home accounts, matching the save path and avoiding accidental blank key fields.
ⓘ Default packaged unit files to read-only, keep drop-ins as the safe override path, hide boot controls for protected base units, and reject [Install] sections in drop-in overrides.
ⓘ Add a disabled-by-default module option for deleting packaged systemd unit files, while keeping local unit deletion allowed and enforcing the policy in both UI and backend paths.
ⓘ Use the existing scheduled websocket cleanup path for linked-server ws-link routes and expire unopened temporary routes after five minutes.
This limits how long credential-bearing proxy routes can remain in `miniserv.conf` while leaving active and normal websocket cleanup behavior unchanged.
ⓘ Remove single-use ws-link routes when backend setup fails or after the backend handshake is consumed, with final loop cleanup kept as a fallback.
This prevents failed linked websocket retries from leaving temporary credential-bearing routes in `miniserv.conf`.
ⓘ Only store `backend_session` for xterm websocket routes when there is no real browser session and a one-time backend key is needed. Normal xterm sessions continue using the browser session directly.
ⓘ Require websocket routes to opt in with allow_basic_ws before Basic auth is accepted in session mode. Mark linked ws-link routes and no-cookie backend-session routes as allowed, while leaving normal session-backed routes unmarked.
ⓘ Correct linked-server WebSocket proxy registration for parent-prefixed URLs, rebuild backend Host/Origin from the child server, and prevent duplicate rewrites from invalidating tokens.
ⓘ Check OpenSSL's pending buffer before `select()` in the websocket forwarding loop so TLS-backed linked websocket streams do not stall during bursty backend output.
This PR adds general WebSocket proxying for linked Webmin servers, allowing modules such as `xterm` to work when opened through `servers/link.cgi`.
As requested in https://github.com/webmin/webmin/issues/1866.
This PR adds SSH public key management to the Users and Groups edit flow for existing Unix users.
Webmin stores its managed key with a readable marker in `authorized_keys`, validates submitted public keys, preserves unrelated keys, supports rename/update/remove flows, and performs user `.ssh` file operations as the target Unix user.
https://github.com/webmin/webmin/issues/1827
Expose missing prefork, worker, and event MPM tuning directives under Apache Processes and Limits, including MaxRequestWorkers, ServerLimit, ThreadLimit, ThreadsPerChild, and spare-thread controls.
https://github.com/webmin/webmin/issues/1821
Add an opt-in SMART module config option for manually listing hardware RAID passthrough devices, expose configured physical disks to smartctl, and document the option.
https://github.com/webmin/webmin/issues/1704
- When the system hostname domain changes, update `localhost.<old-domain>` in Postfix `mydestination` to `localhost.<new-domain>`.
- This sits alongside the existing hostname/FQDN updates for Postfix destinations.
Previous behavior:
`save_dns.cgi` only updated Postfix `mydestination` entries that exactly matched:
- the old short hostname, like `host`
- the old FQDN, like `host.old-domain.test`
It did **not** update:
- `localhost.old-domain.test`
So if you changed:
```text
host.old-domain.test
```
to:
```text
host.new-domain.test
```
Postfix could become:
```text
mydestination = host.new-domain.test, host, localhost.old-domain.test
```
After this hunk, it also updates that localhost domain entry:
```text
localhost.old-domain.test
```
to:
```text
localhost.new-domain.test
```
