Congrats on CloudMin !

On which server should we install it ?

Any server you want. It will manage any server it can reach via ssh or Webmin RPC. Cloudmin does not care. Jamie really outdid himself on Cloudmin...it's really quite astonishing some of the things it can do already, though we still have a long way to go before we consider it "finished".

Does the Cloudmin server have to run webmin and virtualmin(Pro) too ?

It is, like Virtualmin, a module of Webmin. So, it has to have Webmin. It's actually quite a bit simpler than Virtualmin, since the stack is dramatically simpler. The RHEL/CentOS installer will setup the Xen kernel, but mostly the install just installs Webmin and Cloudmin and the framed theme. It's much less complicated than Virtualmin. It can be installed manually very easily as well. That's probably something I should document in a hurry, because the meaning of "supported" is much closer to Webmin in Cloudmin, because it is agnostic about almost everything. Put it on pretty much any box with the right Perl modules and Webmin, and it will be happy. You'll have to then point it at boxes with the right kinds of kernel for virtualization, like Xen or vserver or Zones (and soon OpenVZ!).

Can the server be a highly secured server behind the "big corporate firewall" ?

Yes, we think that'd be swell. Though, to really get the most out of it, you'll want it to be accessible to your users as well...possibly just through your own wrapper of the API. Cloudmin is a toolkit for building cloud services...and if your users can't start, stop, re-image, etc. it's only half a cloud service. We're not entirely finished with all of the "user-level" capabilities (live resizing of Xen instances, and a few other niceties aren't in yet, I don't think). ;-)

But, you could have this in your own support UI and make calls to your locked down Cloudmin server from within the private network, if you wanted to. All sorts of possibilities.

Must the server be accessible from the Internet ? if yes on which ports and from where ? Which ports should the server have access to to the Internet and to where ?

Depends on how you use it. If your customers have access (as it is designed for), then they'll need to be able to get to it from the Internet.

Port 10000, just like Virtualmin. Webmin fast RPC needs ports 10001-10010, I think, but only to your other servers, not from outside.

Having read the catastrophic (and sadly extremely dramatically ended story) of another central VPS management system this week, we definitely want to make the Cloudmin installation extremely protected as it will be controlling all servers...

Yes, we're spending a lot of time thinking about this as well. We've occasionally made mistakes over the past 11 years that broke folks data on a small scale, and it is truly heartbreaking when it happens. So, we definitely advise caution moving forward...I don't want to brag, or be negative about LXLabs products at all (security is hard, and we all make mistakes), but I can say that Webmin has a much longer security history, and it's pretty solid. The last serious exploit was over three years ago. Knock on wood, and all.

There are some solutions, but I'm afraid in the very low end hosting environment that was effected in this case, it wouldn't be cost effective. It basically boils down to keeping really good offline backups. I've been talking to a friend who runs tarsnap.com and is a FreeBSD developer and pretty famous security guy about this exact problem (obviously, we're concerned). His service actually can provide protection against this, as well, as it provides the ability to have "write only" backups. That is, you can only write to it, until you give it a read or delete/overwrite key, at which time you can read back out or overwrite or delete the existing data. So, Cloudmin and Virtualmin could be completely unable to read or damage previously backed up data. Adding support for tarsnap is in our plans, but it could be used immediately, if you don't mind getting your hands dirty (at least, I think anyone can sign up for the beta). It's reasonably priced for secure backups, and I trust Colin to get it right, so I'm enthusiastic about tarsnap. I don't know of any other backup service that offers this level of protection, and I can't think of many people who I'd trust to get security right enough to really trust it to be secure.

Docs are coming soon! I'm hoping to launch Cloudmin.com tomorrow as early as possible, and then Eric and I can start importing the old docs.