Filemin access for resellers

Submitted by masterg0g0 on Sat, 06/25/2016 - 04:17 Pro Licensee

Hello,

I realized that the reseller have access to the whole system via the filemin module.. where could i restrict this.

Regards,

Status: 
Closed (works as designed)

Comments

Submitted by andreychek on Sat, 06/25/2016 - 10:18

Hmm, is your reseller able to see the home directory and files of users he isn't the reseller for?

Submitted by masterg0g0 on Sat, 06/25/2016 - 10:57 Pro Licensee

yes, he is able to even modify them.... i think its like a root access he has..

Submitted by andreychek on Sat, 06/25/2016 - 14:28

It sounds like the behavior of the file manager with virtual users (such as resellers) needs to be reviewed.

But you can disable access to those users by going into Webmin -> Webmin -> Webmin Users -> USERNAME -> Available Webmin Modules, and there you can disable access to Filemin.

Submitted by masterg0g0 on Sat, 06/25/2016 - 17:39 Pro Licensee

yea please, this can be considered as a security flaw.. should i raise the important of this ticket?

Submitted by masterg0g0 on Sat, 06/25/2016 - 17:39 Pro Licensee

Priority: Normal » Major

Submitted by JamieCameron on Sat, 06/25/2016 - 20:07

Virtualmin resellers don't get granted access to the Filemin module by default though, so it's not surprising that if one was manually granted access they would have the default (unlimited) permissions.

Submitted by masterg0g0 on Sun, 06/26/2016 - 02:07 Pro Licensee

Thanks Jamie for the clarification.. should we close this ticket?

Submitted by masterg0g0 on Mon, 06/27/2016 - 11:03 Pro Licensee

Status: Active » Closed (works as designed)