Virtualmin stores passwords in plain text - this is a serious security violation.

What the security audit found.

My VIrtualmin server was recently compromised - not rooted but a user uploaded a WordPress style with a malicious PHP file in it that was used to relay vast quantities of Spam through it - no fault of Virtualmin at all, let me add.

But I got together with a friend who's also a little knowledgable about security and we did a security audit of the whole server.

We turned up a lot of things (boy, WordPress makes it so easy for users to install, and the default installation is completely insecure!)...

but one glaring thing we saw was that virtualmin stores its passwords in plain text.

Unix protections are inadequate protection.

Now, I see that this has been brought up before on this board, and was reassured away "because of Unix protections". This is not right at all.

My friend and I have been running these servers since the 90s. We've been rooted twice before, once a BIND zero-day exploit and I don't quite remember the other. We've ended up learning quite a bit about security...

and one of the basic rules is that you never store any password in the clear, anywhere, under any circumstances. There are many very good reason that all operating systems used to store passwords in the clear, but not one major operating system does so in 2013.

Relying on your Unix protections to protect your files is false security, because there are so many ways for this to go wrong. Here are ones that have happened to me or friends of mine...

• An attacker gets root for only a few minutes, and grabs everything they can - /etc/ and all the passwords.
• An inept administrator backs up a superdirectory of the password directory using tar.
• A corrupt administrator secretly steals the password file and uses it later.
• An incompetent administrator recursively changes the permissions on an enclosing directory.
• A program running with root privileges retrieves these passwords and sends them back in the clear as email to users on request. Someone gets on the network, files a bunch of bogus "password lost" requests, and snoops many passwords.

In particular, having passwords in the clear means that people can completely silently compromise the system by copy those files. All other means of compromising a system involve changing files - something which can be detected.

Protecting others.

It's also important to remember that you are imperiling other installations other than your own with this policy. It's a sad but true fact that most people tend to use the same password, or one password from a small set of passwords, for all their accounts everywhere. Once a hacker grabs a password file and all of /etc, the first thing they do is hook up those passwords with possible email addresses (very easy to do with virtualmin's very standard file layout!) and then attack pretty well everywhere with those email/password pairs.

(And they have this automated. No one's going through editing /etc/virtual by hand, they dump it into a program that goes from password file to attack bot without humans being involved... this is Big Business!)

Thanks for reading!

I cannot urge you strongly enough to consider how you could remove these unencryptped passwords from Virtualmin. At the very least, please do some research on the hazards of having passwords stored in the clear and try to think of some better way to mitigate this than "directory permissions".