how to install Webmin for Ubuntu 24.04

Wetin you dey build

Webmin na web control panel wey dey put browser front end for whole Linux server — users, packages, cron jobs, firewall, Apache, BIND, disks, and hundred other modules — wey you fit reach via HTTPS for port 10000. The install itself na only three commands and e go take about one minute. The reason why dis guide dey spend most time for second half na because Webmin dey log in as root and e fit do anything wey root fit do. If Webmin open or e no get authentication, e no be "risk to manage"; na full server compromise wey get login page for front. So install am for ten minutes, then use the rest of the hour make sure say na only you fit reach am.

Prerequisites and one honest warning

Fresh Ubuntu 24.04 KVM VPS wey get root or sudo user. Webmin na Perl and e light — 1 GB of RAM plenty and e dey idle well under a quarter of a gigabyte. E dey listen for TCP 10000 through its own bundled web server (miniserv.pl), no be Apache or nginx, so you no need to install anything else first.

Two things you must decide before you start. First, the account wey you wan use log in: Webmin dey use PAM authenticate Unix accounts, so you go log in as root or a user for sudo group using that account Unix password. Cloud images dey usually use key-only and dem no dey set password for default user, and Webmin no fit log in to account wey no get password. Set password with sudo passwd youruser first, otherwise login go fail even if you type everything correct.

Second, and dis one na the warning: no just open port 10000 to the internet and leave am. Decide now if you wan reach Webmin through SSH tunnel (we recommend dis, nothing go dey exposed) or if you wan restrict am to your own IP. Dis decision go affect every step wey follow, so read both options before you touch the firewall.

Install Webmin from the official repository

Webmin get one signed apt repository. The setup script go add the repo and its GPG signing key so that next time you run apt upgrade, e go pull Webmin like any other package. This way, you go get authenticated updates instead of downloading one .deb wey no fit patch itself.

curl -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
sudo sh webmin-setup-repo.sh

The script go print wetin e wan do and e go ask Setup repository? (y/N) — answer y. Once e finish, install the package. The --install-recommends flag go pull all the common Perl and SSL module dependencies so that individual modules no go fail later with missing-library errors.

sudo apt-get install --install-recommends webmin

Webmin don change the name of this script before — old guides dey talk about setup-repos.sh — so if the raw URL give you 404, grab the current one-liner straight from webmin.com/download instead of to pin one name. If install correct, e go end with one line like Webmin install complete. You can now login to https://your-host:10000/ as root. The service dey enabled and e dey run, config dey under /etc/webmin, requests dey log for /var/webmin/miniserv.log, and failed logins dey go syslog — for Ubuntu 24.04, e dey go systemd journal.

Confirm say e dey actually up and listening before you open browser:

sudo systemctl status webmin --no-pager
sudo ss -tlnp | grep 10000

You need to see active (running) status and one line wey show miniserv.pl bound to 0.0.0.0:10000 — that address go change to 127.0.0.1:10000 once you use the tunnel route below. If ss no show anything for 10000, Webmin no start; read journalctl -u webmin -n 50 before you continue.

First login, and the certificate warning

Point your browser to https://YOUR_SERVER_IP:10000. Two things dey happen for new box.

If ufw dey active — Ubuntu original server image dey ship am inactive, but many providers dey pre-enable am — the page no go load at all, we go talk about that one for the failure modes below. If the port open, your browser go show full-page block: "Your connection is not private" with code NET::ERR_CERT_AUTHORITY_INVALID for Chrome, or SEC_ERROR_UNKNOWN_ISSUER / "Warning: Potential Security Risk Ahead" for Firefox. This one na normal thing and e no mean say person dey hack you. Webmin don generate self-signed certificate when you install am (/etc/webmin/miniserv.pem), and because no certificate authority dey vouch for am, the browser no go trust am. The connection still dey encrypted; e just say nobody vouch for am. Click through (Advanced, then Proceed) for now — we go replace this certificate properly later down.

Log in with root or your sudo user and its Unix password, and you go land for System Information dashboard. One common mistake for here na to type http:// instead of https://. miniserv dey answer plain HTTP for that port with this exact text "This web server is running in SSL mode. Try the URL https://..." — the fix na just to change http to https for the address bar.

The security decision: how you go take reach Webmin?

Now na the part wey matter. Any panel wey get root-level access no suppose dey open internet dey answer login attempts from every scanner for the whole world. You get two options wey safe, wey I don arrange from best to worst.

Option B wey use SSH tunnel na the best one, because e no dey expose anything at all. Option A wey use IP allowlist dey okay if your address na static. If you no do any of dem, na that mistake dis whole guide dey try make sure say you no do am. If you prefer to reach Webmin through private network instead of those two, put the box behind a self-hosted WireGuard VPN and bind Webmin to the tunnel address instead of the public one.

Option A: restrict Webmin to your IP

Inside the panel, open Webmin, then Webmin Configuration, then IP Access Control. Select "Only allow from listed addresses" and type your public IP. You fit find your IP by running curl ifconfig.me for your laptop. Click Save. Webmin go write this inside /etc/webmin/miniserv.conf for the allow= line and restart itself.

The trap: if your home IP dey change (dynamic) or if you type the address wrong, you go lock yourself out. The browser go show "Access denied for <your IP>" and no login form go appear, and you no go fit use web path enter again. You must fix am from server console via SSH or your provider VNC:

sudo nano /etc/webmin/miniserv.conf
# find the line that begins  allow=
# correct your IP, or delete the whole line to allow all again
sudo systemctl restart webmin

If you delete the allow= line, access go open again. Use this method only to recover, then immediately set correct value.

Option B: bind to localhost and tunnel over SSH (recommended)

Better pass any allowlist na to no listen on the public interface at all. Tell miniserv say make e bind only to loopback, then reach am through an encrypted SSH tunnel wey you don already trust.

Edit /etc/webmin/miniserv.conf and add, or change, one line:

bind=127.0.0.1

Restart with sudo systemctl restart webmin. Webmin no dey reachable from the internet again — port scan for 10000 no go find anything, and the ss check wey you do before go show say e bind to 127.0.0.1:10000. From your laptop, open one tunnel:

ssh -L 10000:localhost:10000 youruser@YOUR_SERVER_IP

Leave that session open and browse to https://localhost:10000. The traffic dey travel inside SSH, wey your key don already authenticate and encrypt, so you fit safely accept the self-signed certificate for here — SSH layer dey do the real protection. Close the SSH session and Webmin go vanish. No need to allowlist anything, nothing dey exposed, and no extra service to harden.

If you set bind=127.0.0.1 and you forget the tunnel, remote access go just stop — na the feature dey work, no be fault. Recover am the same way as Option A: from the console, remove the bind line or set bind=0.0.0.0, then restart. This na the same tunnelling habit wey you dey use reach a remote development box running Claude Code in tmux — one SSH session, everything private, nothing extra dey listen on the public interface.

Dey replace the self-signed certificate with one real one

If you dey use Webmin for one hostname under Option A, use real Let's Encrypt certificate take remove that browser warning. You need DNS name — like panel.example.com — with A record wey point to the server, and something wey go answer the port-80 HTTP challenge during validation.

Webmin get this one inside: Webmin, then Webmin Configuration, then SSL Encryption, then the Let's Encrypt tab. Enter the hostname, point the "website root directory" to one path wey dey serve for port 80 for that domain, and request am. Webmin go get the certificate, update the certfile= and keyfile= lines for miniserv.conf for you, and e go renew am automatically before e expire. Reload the page and the padlock go clean.

The only real wahala: Webmin server dey run for 10000, no be 80, so the http-01 challenge need real web server — Apache or nginx — wey dey answer for panel.example.com for port 80, or you fit use DNS-based validation instead. For one box wey only get Webmin and nothing dey on port 80, the request go fail with validation error until you give Let's Encrypt way to reach the challenge file. The way e dey work — DNS records, the port-80 challenge, and renewal — na the same way as when you dey issue certificate for any website. If you want know more, the Let's Encrypt TLS certificates with Certbot and nginx guide go explain the validation flow and DNS setup well-well. If you use SSH-tunnel method, you fit skip this section entirely: the self-signed certificate dey fine for inside SSH, and real certificate wey you get for panel.example.com go only give you name-mismatch warning when you visit https://localhost:10000 anyway.

Turn on two-factor authentication

Password alone no strong enough to protect root panel, so add second factor. Open Webmin, then Webmin Configuration, then Two-Factor Authentication. Pick Google Authenticator provider — na standard TOTP, so e go work with Authy, 1Password, or any authenticator app — and save. Webmin go install the small Perl module wey e need (Authen::OATH plus QR generator) and e go enable the feature; this step alone no protect any account yet.

Every account must enrol its own device. Once 2FA don enable, open Webmin, then Webmin Users, pick the account, choose Enable Two-Factor For User, and Webmin go show QR code; scan am with the app and enter one code wey e generate to confirm. From that time, when you wan login, e go ask for the six-digit token after the password. Enrol before you log out — if 2FA dey required but your account never scan any code, you fit still clear the requirement from the console, but e go hard pass if you no enrol first.

Add Fail2ban to ban brute-force logins

Even if login endpoint dey restricted, e must punish people wey dey try many times without success. Webmin dey report failed logins to syslog for webmin[12345]: Invalid login as root from 10.0.0.9 format, or Non-existent login as ... if the username no be Unix account — for Ubuntu 24.04, those lines dey go inside systemd journal, because stock image no get /var/log/auth.log. Fail2ban come with stock webmin-auth filter wey fit catch those two lines exactly, and the jail below dey set backend = systemd itself, so you no need custom regex or log path.

Create /etc/fail2ban/jail.d/webmin.local:

[webmin-auth]
enabled  = true
port     = 10000
filter   = webmin-auth
backend  = systemd
maxretry = 4
bantime  = 1h

Reload with sudo systemctl restart fail2ban, then confirm say the jail dey work:

sudo fail2ban-client status webmin-auth

You go see the jail for list with ban counter wey dey zero at first (for journal backend, no File list: line dey). To check if everything dey work well, try fail login on purpose few times from another network, then run status command again and watch Currently banned dey climb. If e no dey climb, make sure say you no dey test from address wey dey inside Fail2ban ignoreip, and run journalctl SYSLOG_IDENTIFIER=webmin for server to confirm say Invalid login lines dey really write. If you never install Fail2ban for this box, the Fail2ban on Ubuntu 24.04 for SSH guide go show you how to install and how to run the SSH jail alongside this one.

Restrict wetin each Webmin user fit touch

No be everybody wey need access to panel go need root access to everything. Under Webmin, then Webmin Users, create new Webmin logins and give each one only the modules wey dem need — for example, person wey dey handle backups go only see cron and filesystem modules. When you edit user, you go see checklist of every module; if you uncheck one, e go remove am from that user menu and block the underlying URLs. This na defence in depth: even if somebody steal low-privilege Webmin session, dem no go fit rewrite /etc/shadow if Users module no dey for their list.

How to keep Webmin updated

Because you use the apt repository, sudo apt update && sudo apt upgrade go pull new Webmin releases together with the rest of your system. Update fast — hackers like to target control panels. Webmin fit update itself if you go Webmin, then Webmin Configuration, then Upgrade Webmin, but the apt way better for Ubuntu because e dey keep all your versions consistent with your other package management. No play with this one: many past Webmin CVEs na remote-code-execution bugs, and the only thing wey dey separate "patched" from "compromised" na how fast admin run the upgrade.

Failure modes, with the strings you will see

"Your connection is not private" / NET::ERR_CERT_AUTHORITY_INVALID. E go show for first time wey you load am. Cause: the self-signed certificate Webmin generate when you install am no get trusted issuer. No be attack; the channel encrypted, but nobody vouch for am. Fix: just proceed through the warning for now, then issue real Let's Encrypt certificate, or just accept am permanently if you dey use SSH tunnel reach Webmin.

"This web server is running in SSL mode. Try the URL https://..." You type http://server:10000. miniserv only dey speak TLS for that port and e dey tell you so for plain text. Fix: change http to https for address bar.

Page times out — ERR_CONNECTION_TIMED_OUT / "This site can't be reached". The request no reach Webmin at all. For Ubuntu, na almost always ufw dey drop port 10000. Confirm am with sudo ufw status; if 10000 no dey list, either open am with sudo ufw allow 10000/tcp or, better, leave am closed and use SSH tunnel from Option B. Note the difference: timeout mean say firewall dey drop packets silently, while ERR_CONNECTION_REFUSED mean say port dey reach but Webmin no dey run — check sudo systemctl status webmin.

"Access denied for <your IP>." You set IP Access Control under Option A and your current address no dey on the allow list — maybe your dynamic IP change, or you make typo. No way to enter through browser. Fix from the console: edit the allow= line for /etc/webmin/miniserv.conf, correct or delete am, then run sudo systemctl restart webmin.

"Login failed. Please try again." with credentials you know are correct. The account no get Unix password, which na standard for cloud images wey only use key. Webmin dey use PAM authenticate against the Unix password, and that password no dey for the user. Fix: run sudo passwd youruser for server, then log in. If /var/webmin/miniserv.log show Non-existent login as ..., you dey type username wey no be Unix account at all.

For more than a couple of servers, automation dey scale better than to use control panel for every box: your first Ansible playbook na where that one start.

FAQ

E dey safe to expose Webmin for public internet?

Treat any Webmin wey dey face internet like root shell wey get login page, because na wetin e be. E dey safe enough only if you use layers: real certificate, two-factor authentication, Fail2ban, and either tight IP allowlist or, better, no public exposure at all. The setup wey get lowest risk na to bind Webmin to 127.0.0.1 and reach am through SSH tunnel, so port 10000 no go answer anybody for open internet.

How I go take remove Webmin certificate warning?

The warning (NET::ERR_CERT_AUTHORITY_INVALID) dey show because Webmin dey come with self-signed certificate. Issue real one from Webmin, Webmin Configuration, SSL Encryption, Let's Encrypt, use DNS name wey point to server wey fit serve port-80 challenge for validation. If you only dey reach Webmin through SSH tunnel to localhost, the warning no dey harm anything — SSH don already encrypt and authenticate the connection — so you fit safely accept the self-signed certificate.

How I go restrict Webmin to only my IP address?

Go Webmin, Webmin Configuration, IP Access Control, choose "Only allow from listed addresses", and enter your public IP from curl ifconfig.me. Webmin dey store this inside allow= line for /etc/webmin/miniserv.conf. Watch out for dynamic home IP: if e change, you go lock yourself out and you go must repair the allow= line from server console, so static address or SSH-tunnel method dey more reliable for practice.

Why my login dey fail even when I use correct password?

Webmin dey use PAM authenticate against your Unix password, and cloud images dey usually use key-only without password set for default account — so nothing for PAM to match and the login go reject. Run sudo passwd youruser for server to set password, then log in. If you see Non-existent login as ... line for /var/webmin/miniserv.log, e mean say the username itself no be real Unix account.

Wetin Webmin dey do wey plain SSH no fit do?

Webmin na layer for easy discovery and convenience. E dey useful for to browse log files, manage users and cron, edit firewall rules, and see disk and service state without need to memorize every command — e dey handy for admins wey no dey do am every day or mixed-skill teams. Plain SSH faster, e dey easy to script, and e no expose much attack surface for routine work. Many admins dey run both: SSH for daily driving, and Webmin bound to localhost behind a tunnel for the occasional point-and-click job.