From 65b972e6232a6475d93e06ed57c24ca4b334b90e Mon Sep 17 00:00:00 2001 From: reachableceo Date: Mon, 27 Jul 2026 10:58:10 -0500 Subject: [PATCH] fix(security): actually set Webmin 2FA directives in miniserv.conf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit configure_webmin_2fa used `sed -i ... || echo ... >>` to add twofactor_provider and twofactor to /etc/webmin/miniserv.conf. sed returns 0 even when it matches nothing, so when the directives were absent (the normal case on a fresh Webmin install) the `|| echo` branch never ran. The script printed "Webmin 2FA configuration completed" while leaving 2FA entirely unconfigured — caught by 2fa-validation reporting "Webmin TOTP provider not configured". Guard each directive with grep so it is appended when absent and updated when present. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush --- ProjectCode/Modules/Security/secharden-2fa.sh | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/ProjectCode/Modules/Security/secharden-2fa.sh b/ProjectCode/Modules/Security/secharden-2fa.sh index 7b5584c..48006b7 100644 --- a/ProjectCode/Modules/Security/secharden-2fa.sh +++ b/ProjectCode/Modules/Security/secharden-2fa.sh @@ -219,13 +219,21 @@ function configure_webmin_2fa() { # Stop webmin service systemctl stop webmin || true - # Enable 2FA in Webmin configuration - sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config" || \ - echo "twofactor_provider=totp" >> "$webmin_config" - + # Enable 2FA in Webmin configuration. `sed -i ... || echo` would never + # append, because sed returns 0 even when it matches nothing; guard with + # grep so the directive is added when absent and updated when present. + if grep -q '^twofactor_provider=' "$webmin_config"; then + sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config" + else + echo "twofactor_provider=totp" >> "$webmin_config" + fi + # Enable 2FA requirement - sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config" || \ - echo "twofactor=1" >> "$webmin_config" + if grep -q '^twofactor=' "$webmin_config"; then + sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config" + else + echo "twofactor=1" >> "$webmin_config" + fi # Start webmin service systemctl start webmin || true