This PR adds the ability for the logging pages to hand the Miniserv access and error logs, and the Webmin actions log, to logrotate instead of having Miniserv periodically delete them. The generated section uses copy-truncate rotation, since Miniserv only reopens its error log when the file disappears.
The option only appears when the Log File Rotation module is available and configured correctly.
Add a Logging page to the Usermin Configuration module for the access-log settings, guarded by a new "log" ACL.
Also, Webmin and Usermin logging pages add new an "Error log destination" choice on systemd systems. Selecting the journal sets errorlog=- and installs a local StandardError=journal drop-in, leaving the packaged unit untouched.
https://forum.virtualmin.com/t/miniserv-webserver-log-growing-too-big-should-be-rotated/136562/10?u=ilia
ⓘ Prevent Webmin from swallowing Certbot's key-path output when extracting PEM paths, while preserving IPv6 cert-name support and adding regression coverage.
This PR fixes Webmin IP access control handling for IPv6 CIDR prefixes that are not divisible by 8, such as `/29` as mentioned in this https://github.com/webmin/webmin/issues/1570 ticket.
Before Webmin validation rejected non-byte-aligned IPv6 network sizes, and the runtime matcher compared IPv6 networks only by whole bytes. This meant valid IPv6 CIDR prefixes could not be used safely in access control rules.
Changes:
- Allow IPv6 access-control prefixes from `/0` through `/128`, without requiring divisibility by 8.
- Add bit-accurate IPv6 prefix matching for ACL checks.
- Apply the same matching behavior in both `miniserv.pl` and `webmin/webmin-lib.pl`.
- Fix IPv6 canonicalization for `::` and trailing `::` forms used by the matcher.
- Add regression tests for `/0`, `/29`, `/32`, `/63`, `/64`, `/127`, and `/128`.
ⓘ Adds hidden `tempdirname` support and normalizes custom temp paths so Webmin always uses a private final directory like `.webmin`, while keeping the existing permission checks.
The Webmin SSL LE renewal setting is labeled as "Months between automatic renewal", but it was previously saved as a calendar-style cron month expression like `*/N`.
That is not the same as an elapsed renewal interval. Webmin’s cron matcher evaluates month schedules against calendar month numbers, so values like `*/5`, `*/12`, or values above `12` do not reliably mean “renew every N months”. This could cause uneven or dangerously late renewal timing.
This changes the renewal job to use Webmin cron’s elapsed `interval` support instead of calendar-month matching.
- Saves automatic renewal as `renew * 30 * 24 * 60 * 60` seconds.
- Clears the cron time fields so the scheduler uses the interval path only.
- Keeps `months => '*/N'` so the SSL UI can continue to display the saved renewal value.
- Resets the renewal timer only after a newly issued certificate.
- Preserves the existing renewal timer for settings-only saves.
- Migrates existing month-based Let's Encrypt renewal jobs during postinstall.
This fixes saving a custom Webmin temp directory from Webmin Configuration → Advanced Options.
Previously, setting a path like /var/webmin/tmp failed if the directory did not already exist. Users had to create it manually, and it was easy to end up with a bad parent directory such as /var/webmin with 0700, which made the saved temp path unusable.
This change makes Webmin handle the safe parts automatically:
- Creates missing temp directories and parents as 0755
- Validates existing parent directories are traversable by group/other
- Requires the final Webmin temp directory to be root-owned with mode 0755
- Allows shared temp dirs like /var/tmp when root-owned and 1777
- Shows a clear error when existing permissions must be fixed manually
* Note: Adds support for custom ACME directory URLs in Webmin’s SSL certificate flow, including optional EAB credentials, renewal persistence, and compatibility fixes for saved validation modes.
https://github.com/webmin/webmin/issues/2669
Webmin now uses the bundled QRCode::Encoder implementation by default to generate TOTP QR codes locally and inline, without relying on qr.cgi or external services.
This encoder requires Perl 5.24 or newer, so qrencode is no longer included as a recommended package dependency. On older systems where the bundled encoder cannot run, admins can still install qrencode manually to restore QR generation support.
Systems old enough to lack Perl 5.24 are typically already well past their supported security lifecycle, so keeping qrencode preinstalled by default is no longer treated as a packaging requirement. When neither option is available, Webmin falls back cleanly to manual TOTP setup using the shared secret.
https://github.com/webmin/webmin/issues/2667#issuecomment-4247431279
[no-build]
Ilia Ross