I just had someone gain access to the webmin interface of my firewall (version 3.383). It was due to a config error, but I believe there should be a little protection from such F#$kups.
OK. What what caused it. I just set up astaro with PPPoE and enabled MASQ of the internal network. I added a rule to allow HTTPS to go from ANY to INTERNAL WEB SERVER (a specific internal address). All good so far. I however forgot to add the DNAT/SNAT rule to redirect port 443 to go to this internal address. So rather than dropping the packets the fw accepted them itself and presented the webmin interface to the outside world (this is BAD). Maybe a few checks need to be added to prevent this occuring.
Regards
Simon.
