Webmin Two-Factor Authentication Setup: Google Authenticator & TOTP Guide

Log in to Webmin at https://yourserver:10000. Go to Webmin → Webmin Configuration → Two-Factor Authentication. If this menu item exists, the module is already installed.

ls /usr/share/webmin/two-factor/ 2>/dev/null || ls /usr/libexec/webmin/two-factor/ 2>/dev/null

If the directory doesn't exist, install or update Webmin to a recent version:

# Debian/Ubuntu
apt-get update && apt-get install --only-upgrade webmin

# RHEL/CentOS/AlmaLinux
yum update webmin

The TOTP module was introduced in Webmin 1.900 — any version released after 2019 includes it.

In Webmin, go to Webmin → Webmin Configuration → Two-Factor Authentication.

From the dropdown, select Google Authenticator (this enables TOTP for any compatible app, not just Google's). Click Save.

After saving, go to Webmin → Change Language and Theme or navigate to your user's profile under Webmin → Webmin Users → [your username] → Two-Factor Authentication. Click Enroll for Two-Factor Authentication.

A QR code appears. Open your authenticator app and scan it. The app will begin generating 6-digit codes that change every 30 seconds.

Enter the current 6-digit code from your app into the verification field in Webmin and click Confirm. If the code is accepted, enrollment is complete.

/usr/share/webmin/two-factor/two-factor.pl --user root --setup totp

This outputs a secret key and a QR code URL. Paste the QR URL into a QR code generator or manually add the secret to your authenticator app using "Enter setup key".

grep "twofactor" /etc/webmin/miniserv.conf
cat /etc/webmin/webmin.acl | grep root

The twofactor entry confirms the feature is enabled at the server level.

Go to Webmin → Webmin Configuration → Two-Factor Authentication. Check the box: Require all users to use two-factor authentication. Click Save.

After this change, any user who hasn't enrolled for 2FA is redirected to the enrollment page on next login — they cannot access the control panel until they complete enrollment.

grep "twofactor_required" /etc/webmin/miniserv.conf
# If not present, add it:
echo "twofactor_required=1" >> /etc/webmin/miniserv.conf
service webmin restart

for user_dir in /etc/webmin/users/*/; do
  user=$(basename "$user_dir")
  if grep -q "twofactor_secret" "$user_dir/config" 2>/dev/null; then
    echo "$user: 2FA enrolled"
  else
    echo "$user: NO 2FA — at risk"
  fi
done

Any user listed as "NO 2FA" should be enrolled immediately or have their account disabled until they complete enrollment.

When you scan the QR code during enrollment, also note the text-format secret key shown below the QR code (e.g., JBSWY3DPEHPK3PXP). Store it in an encrypted password manager. If your phone is lost, you can re-add the account to a new authenticator app using this key.

If you're locked out of Webmin due to a lost 2FA device and no backup, disable 2FA directly on the server via SSH:

# Stop Webmin first
service webmin stop

# Remove the 2FA secret for the locked-out user
sed -i '/twofactor_secret/d' /etc/webmin/users/root/config
sed -i 's/twofactor_provider=.*//' /etc/webmin/miniserv.conf

# Restart Webmin
service webmin start

Log in, re-enroll 2FA, then immediately restore enforcement.

If you're running Fail2Ban alongside Webmin 2FA (which you should — they complement each other), whitelist your management IP to prevent lockout from a mistyped code:

echo "ignoreip = 127.0.0.1/8 YOUR.MANAGEMENT.IP" >> /etc/fail2ban/jail.local
systemctl reload fail2ban

Go to Webmin → Webmin Configuration → IP Access Control. Select Only allow from listed addresses and add your management IP addresses or CIDR ranges. Click Save.

# Allow Webmin only from your IP:
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=YOUR.IP/32 port port=10000 protocol=tcp accept'
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 port port=10000 protocol=tcp drop'
firewall-cmd --reload

Replace YOUR.IP with your actual management IP. If your IP is dynamic, use a VPN with a static exit IP for management access instead.

With TOTP 2FA enabled and enforced, your Webmin installation is protected against credential stuffing, password reuse attacks, and brute force attempts — the three most common vectors used to compromise servers via web-based control panels. Combine 2FA with an IP whitelist and Fail2Ban for a complete defence-in-depth posture. If you manage multiple servers and want 2FA enforcement, access control, and security hardening handled as a managed service rather than a one-time manual setup, CloudHouse's server management team handles this as part of the standard onboarding for every new server.