Virtualmin — install and configure a free hosting control panel

What is Virtualmin?

Virtualmin is a free, open-source web hosting control panel. It makes it easy to manage websites, domains, mailboxes, databases, SSL certificates and backups on your own VPS or dedicated server. Virtualmin runs on top of Webmin and has been developed for over 20 years: it now manages more than a million domains.

Updated in September 2026 for Virtualmin 8: the current list of supported systems and install command, Let’s Encrypt SSL, phpMyAdmin from the built-in web apps, Fail2Ban and the nftables firewall, two-factor authentication, backups, and a comparison with other panels.

Virtualmin features

Key Virtualmin features include:

1. Virtual host management: Virtualmin lets you create, delete, and modify virtual hosts with a simple and intuitive interface. Each virtual host has a separate directory for files, databases, and mailboxes.
2. Domain management: Virtualmin lets you create, delete, and modify domains and subdomains. You can also manage DNS records and configure mail domains.
3. Mailbox management: Virtualmin provides full control over mailboxes, allowing you to create, delete, and modify them. You can set limits on mailbox and message size, as well as configure spam filters and autoresponders.
4. Database management: Virtualmin supports multiple DBMSs, including MariaDB (or MySQL) and PostgreSQL. You can create, delete, and modify databases, as well as manage database users.
5. SSL certificate management: Virtualmin lets you install and configure SSL certificates for each virtual host and domain.
6. Reporting and monitoring: Virtualmin provides detailed reporting on user activity, as well as monitoring of system resources such as CPU and memory usage.
7. Backup system: Virtualmin lets you create backups of files, databases, and other web server components.
8. FTP account management: Virtualmin lets you create, delete, and modify FTP accounts for each virtual host.

Virtualmin can also issue free Let’s Encrypt certificates with automatic renewal, install WordPress, phpMyAdmin and Roundcube in a couple of clicks, switch PHP versions per site, and migrate sites from cPanel, Plesk and DirectAdmin.

Virtualmin GPL vs Virtualmin Pro

Virtualmin comes in two editions. The free Virtualmin GPL has no limit on domains or sites and covers what most VPS owners need. The paid Virtualmin Pro adds:

• resellers and more flexible resource limits for clients;
• per-domain Podman containers and WP Workbench for bulk WordPress management;
• a larger catalog of one-click web apps;
• backup encryption and additional cloud storage providers;
• ACME SSL providers beyond Let’s Encrypt;
• support from the developers.

For personal projects and small-scale hosting the GPL edition is enough — everything below works in it.

Virtualmin system requirements

Supported systems (official list) — these have the automated installer and an update repository:

• Ubuntu 24.04 LTS and 26.04 LTS — i386, amd64, arm64;
• Debian 12 and 13 — i386, amd64, arm64;
• AlmaLinux and Rocky Linux 8, 9 and 10 — x86_64 and aarch64;
• Red Hat Enterprise Linux 8, 9 and 10 — x86_64 and aarch64.

Ubuntu 20.04/22.04, Debian 10/11 and CentOS 7 from the old version of this guide are no longer supported — pick a current release from the list for a new server.

Recommended server specs:

• minimal install (web only, no mail or DNS) — 1 core and 1 GB of RAM; the installer offers to add swap itself;
• full install with mail, spam and virus filtering — 2+ cores and 4 GB of RAM, more is better;
• comfortable for several sites without local mail — 2 cores and 2–4 GB of RAM.

Hosting:

For hosting, use a VPS from Timeweb Cloud.

Installing Virtualmin

Install Virtualmin with the automated virtualmin-install.sh script on a fresh supported system: no web servers, panels or third-party repositories installed beforehand. Add repositories such as ondrej/php only after installation, if you need a second PHP version.

For a full install with mail, give the server a fully qualified hostname (FQDN) such as host.example.com — but not a domain you will host in the panel. A minimal install does not require it.

Update system packages (Ubuntu and Debian):

apt update && apt -y upgrade

On AlmaLinux, Rocky Linux and RHEL — dnf -y upgrade.

Installing Virtualmin with Nginx (LEMP)

Download the installer:

cd /tmp
curl -fsSL -o virtualmin-install.sh https://download.virtualmin.com/virtualmin-install.sh

Run a minimal install with the Nginx stack and follow the prompts:

sh /tmp/virtualmin-install.sh --bundle LEMP --type mini

The --type mini flag skips local mail, spam and virus filtering, the DNS server, FTP and Jailkit, but installs a complete web stack: Nginx, MariaDB, PHP-FPM, Let’s Encrypt, Fail2Ban and a firewall. You can enable the skipped features later under “System Settings → Features and Plugins”. The old --minimal flag still works, but the docs have replaced it with --type mini. All options are in the installation docs.

After installation, open the address shown at the end of the script output: https://your_server_IP:10000/.

The installer requests a Let’s Encrypt certificate for the hostname automatically. If the hostname points to the server, open https://your-hostname:10000/ and there will be no warnings. If DNS is not set up yet, log in by IP: the browser will warn about a self-signed certificate, which is expected, and you can issue a certificate later. To skip the certificate request during install, add --no-hostname-ssl.

Installing Virtualmin with Apache (LAMP)

Virtualmin cannot run Apache and Nginx at the same time — choose one stack. If you already installed the Nginx variant, skip this step. Apache (LAMP) is the default stack, so the --bundle flag can be omitted:

cd /tmp
curl -fsSL -o virtualmin-install.sh https://download.virtualmin.com/virtualmin-install.sh
sh /tmp/virtualmin-install.sh --type mini

For the full set with a mail server, DNS and FTP, run the script without --type mini. You can set the swap size with --swap 2G or skip it with --no-swap. The rest is the same as the Nginx install: open https://your_server_IP:10000/.

Virtualmin login credentials

After you finish installing Virtualmin, its control panel will be available at https://your_server_ip:10000/

The default login credentials will be as follows:

Username: root or any sudo-capable user

Password: that user’s system password. On cloud VPS images with SSH key login, root often has no password — set one with sudo passwd root or log in as a sudo user.

Virtualmin setup wizard

After installing and signing in to the Virtualmin control panel, you will need to complete its basic setup in the setup wizard.

You can accept the default settings by clicking “Cancel”, or perform a detailed setup for your system with the “Next” button

Below I will describe the setup after clicking “Next” and provide a translation of the install wizard interface with my comments.

The screenshots come from a full install with mail, so they show more steps. With --type mini the questions about mail, ClamAV and SpamAssassin may not appear.

Memory use

The first setting will be memory use,

Virtualmin can be configured to improve user interface performance and email processing, but at the cost of increased memory usage. The best choice depends on how your system will be used.

Preload Virtualmin libraries?

• Yes, faster user interface using more RAM (≈40 MB)
• No, slower user interface with less RAM usage, but higher CPU load

I always choose Yes for this question to get a faster control panel interface.

Run mail domain lookup server?

• Yes, faster mail processing using more RAM (≈70M)
• No, slower mail processing with less RAM usage, but higher CPU load

Choose based on whether you will use your own mail server on your VPS. I usually choose No, since I mostly use third-party mail services for sites.

Using ClamAV antivirus for email

If your system will host domains that receive a large volume of email, scanning incoming messages for viruses can cause high CPU load. Because scanning is done by the ClamAV scanning server, it will consume RAM even when it is not processing email. If your system will not host email, virus scanning can be disabled.

Enable virus scanning with ClamAV?

• Yes, uses up to 2 GB of RAM
• No, email will not be filtered

I choose No, since I do not use my own mail server in Virtualmin.

Spam filtering

If your system will host domains that receive a large volume of email, filtering incoming messages for spam can cause significant CPU load. This is due to SpamAssassin’s CPU usage when it starts, which can be avoided by running the SpamAssassin filtering server spamd in the background. This consumes RAM, but reduces CPU load and speeds up mail processing.

Run SpamAssassin server filter?

• Yes, faster mail processing using more RAM (≈30M) and no per-domain settings
• No, slower mail processing with less RAM usage

I choose No, since I do not use my own mail server in Virtualmin.

Database servers

Virtualmin supports both MariaDB and PostgreSQL database servers, but you can run only one server at a time (or neither) on your system. Each consumes RAM while running, even if they are not in use.

Depending on the websites and applications you plan to host, running only MariaDB may be enough, since most web applications do not support or require PostgreSQL. If your system will be used only for mail or DNS hosting, you do not need to run a database at all.

Run MariaDB database server?

• Yes
• No

Run PostgreSQL database server?

• Yes
• No

I usually run only the MariaDB database (a more performant fork than MySQL). I do not use PostgreSQL for website hosting

MariaDB password

To prevent other users on your system from managing the MariaDB database, you need to set a password for the root user when signing in to MariaDB. Currently the MariaDB password is not set, which is highly insecure.

Set MariaDB password (will be used when signing in to phpMyAdmin)

DNS configuration

For DNS zones created by Virtualmin to be resolvable, the primary nameserver record for each zone must be set to a value that can itself be resolved by other systems on the Internet.

Primary nameserver
Skip resolvability check
Secondary nameservers (optional)

The setup wizard has finished. Click “Return to Virtualmin” and continue with further configuration on your own.

Virtualmin settings

Changing the Webmin language

Click Webmin -> Change Language and Theme.

Select Personal choice and pick your language from the dropdown list. Then click “Make Changes” and reload the page.

Only a partial localization will be applied, because only the Webmin part is translated, while Virtualmin has no translation.

Adding a site

Click the “Create Virtual Server” button in the left Virtualmin panel

Enter your domain name and a password for FTP access to the site folder. If you do not need mail for the site on your server, uncheck “Accept mail for domain” and “Setup spam filtering”

Then click the create button. If it reads “Create $1”, that is a translation glitch in some interface languages and does not affect the result.

Wait for the settings to be applied.

Deleting a site

Click the “Disable and Delete” button in the left Virtualmin panel

Then confirm deletion by clicking “Yes, Delete” in the center of the dialog that appears.

Wait for deletion to finish and click “Return to virtual servers list”

Let’s Encrypt SSL certificate for a site

First point the domain’s A record (and AAAA if you use IPv6) to the server IP and wait for DNS to update. Then:

1. Select the site in the left menu and open “Manage Virtual Server → Setup SSL Certificate”.
2. Go to the SSL Providers tab and check the domain list — usually the domain and www.
3. Choose Let’s Encrypt as the provider, enable “Automatically renew certificate” and “Check connectivity first”.
4. Click Request Certificate and wait for it to be issued.
5. Turn on the HTTP-to-HTTPS redirect under “Web Configuration → Website Options”.

Do not enable the HTTPS redirect before the certificate is issued: Let’s Encrypt validates the domain over HTTP. A certificate for the panel itself is enabled under “System Settings → Virtualmin Configuration → SSL settings”. More in the Virtualmin SSL docs.

Changing the PHP version

Official guide — Configuring Multiple PHP Versions.

If you have multiple PHP versions installed, Virtualmin lets you choose the execution mode and PHP version used for a given domain. Available execution modes are FPM (recommended) and CGI/FCGId. The latter mode lets you set different PHP versions for each directory.

That means you need to additionally install the required PHP version.

For Ubuntu

Add the repository from ondrej/php:

env LC_ALL=C.UTF-8 add-apt-repository -y ppa:ondrej/php && apt-get update

Install the PHP version you need with extensions — replace php8.4 with your version:

apt-get install php8.4-{cgi,cli,fpm,gd,mbstring,mysql,opcache,curl,intl,xml,zip}

For Debian

Add the repository from sury/php:

apt-get -y install lsb-release ca-certificates curl
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
dpkg -i /tmp/debsuryorg-archive-keyring.deb
sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
apt-get update

Install the PHP version you need with extensions — replace php8.4 with your version:

apt-get install php8.4-{cgi,cli,fpm,gd,mbstring,mysql,opcache,curl,intl,xml,zip}

On AlmaLinux, Rocky Linux and RHEL, extra PHP versions come from the Remi repository — see the commands in the Virtualmin docs.

Configuring a second PHP version in Virtualmin

After you have finished installing a second PHP version on your server, you can verify that Virtualmin sees it by signing in to Virtualmin and clicking «System Settings» → «Re-Check Configuration» in the left panel. You should see something like this:

The following PHP versions are available : 8.3.6 (/usr/bin/php-cgi8.3), 8.4.12 (/usr/bin/php-cgi8.4)
The following PHP-FPM versions are available : 8.3.6 (php8.3-fpm), 8.4.12 (php8.4-fpm)

You can configure which of these PHP versions will be used by default on new virtual servers. By default, the newest available version is used. You can change this default under «System Settings» → «Server Templates» → «PHP Options».

Configuring PHP for individual sites (virtual servers)

You can configure the PHP version used for a specific virtual server by selecting «Web Configuration» → «PHP Options».

Installing phpMyAdmin

The easiest way is the built-in web app installer — it is available in the free edition too:

1. Select the site that will host phpMyAdmin and open “Manage Web Apps”.
2. On the available apps tab, choose phpMyAdmin, set a path (for example, /pma) and click “Install”.
3. Open https://your-domain/pma/ and sign in with a database user.

This way phpMyAdmin is updated from the panel and served over the site’s HTTPS. Below is a manual option on a separate port, if you want to keep phpMyAdmin apart from your sites.

Manual phpMyAdmin install on a separate port

Download the archive with the install files from the official phpmyadmin.net site

Extract the downloaded archive into the /var/www/pma folder

Create /etc/nginx/sites-available/pma.conf for the new nginx virtual host

The contents of /etc/nginx/sites-available/pma.conf should be as follows:

server {
    listen ip_servera:10050 ssl default_server;
    server_name _;

    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    root /var/www/pma;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

Replace ip_servera with your VPS external IP, and set fastcgi_pass to your PHP version’s socket: see /run/php/ (Ubuntu 24.04 ships PHP 8.3 by default, Debian 12 — 8.2, Debian 13 — 8.4). Port 10050 is within the 10000–10100 range that the Virtualmin firewall opens by default.

Create self-signed certificates in /etc/nginx/ssl/:

mkdir /etc/nginx/ssl && cd /etc/nginx/ssl && openssl req -newkey rsa:2048 -nodes -keyout server.key -x509 -days 365 -out server.crt

Check the nginx configuration for errors:

nginx -t

If there are no errors, reload nginx:

systemctl reload nginx

PhpMyAdmin should be available at: https://ip_servera:10050/

Instead of ip_servera, specify the external IP of your VPS server.

Updating Virtualmin

Click the “Dashboard” button in the left Virtualmin panel, then click next to “Package Updates”

From the console, Virtualmin is updated along with the system: apt update && apt upgrade on Ubuntu and Debian or dnf upgrade on AlmaLinux, Rocky Linux and RHEL.

Webmin and phpMyAdmin security settings

Security settings for Webmin, phpMyAdmin, and Nginx may vary depending on the requirements of a specific project, but here are some general recommendations:

1. Webmin

• Turn on two-factor authentication for Webmin sign-in.
• Restrict panel access to your IP addresses or VPN subnet.
• Do not sign in as root — create a separate administrator.
• Change the default port 10000 to reduce automated attacks.
• Make sure Fail2Ban and the firewall are enabled.

2. phpMyAdmin

• Change the login name to something other than “admin” or “root”;
• Set a strong password for signing in to phpMyAdmin;
• Block external access to phpMyAdmin, for example with a firewall;
• Use HTTPS to encrypt traffic between the browser and the server;
• Restrict access to phpMyAdmin to specific IP addresses only;
• Keep phpMyAdmin updated to the latest version and watch for security updates.

These recommendations can be expanded depending on the specific security requirements of your project.

Changing the default Webmin port

To change the Webmin port via the web interface, follow these steps:

1. Sign in with an account that has administrator privileges and open Webmin in your web browser.
2. In the left panel, select the “Webmin” section and then select “Webmin Configuration”.
3. In the “Webmin Configuration” menu, select “Ports and Addresses”.
4. Find the “Listen on IP addresses and ports” option and select “Specific port..” (if it is not already selected).
5. Enter the new port number in the “Specific port..” field, for example “8080”.
6. Also change the port to the new one in the “Listen for broadcasts on UDP port” field
7. Click “Save” to save the changes.
8. Restart the Webmin service to apply the changes. To do this, select “Webmin” in the left panel, then “Webmin Configuration”, and click “Restart Webmin”.

After saving, the panel opens on the new port. The Virtualmin firewall opens the 10000–10100 range by default; if you chose a port outside it, open the port in the “Linux Firewall” module first (see below), or you will lose access to the panel.

Changing the root user

To change the root user to a new one in Webmin, follow these steps:

1. Sign in to Webmin with an account that has administrator privileges.
2. In the left panel, select the “Webmin” section and then select “Webmin Users”.
3. Find the “root” account in the user list and click its name.
4. In the “root” account settings, select “Copy”.
5. Enter the new username in the “Username” field.
6. Set a new password for the new user in the “Password” field.
7. Set the required permissions for the new user by selecting the appropriate options in the “Available Webmin modules” list.
8. Click “Create” to create the new account.
9. Sign out of Webmin and sign in again with the new user account to make sure everything works correctly.
10. Return to the “Webmin Users” section from step 2 and delete the “root” user.

After completing these steps, you will be able to use the new account instead of the “root” account to access Webmin. Note that the new user must have sufficient privileges to manage your system.

Two-factor authentication in Webmin

1. Open “Webmin → Webmin Configuration → Two-Factor Authentication”, choose the Google Authenticator provider (any TOTP app works: Aegis, 2FAS, Google Authenticator) and save. If Webmin asks to install a Perl module, agree.
2. Go to “Webmin → Webmin Users”, open the “Two-Factor Authentication” tab and enroll your user by scanning the QR code with the app.
3. Sign out and back in — Webmin will now ask for a one-time code.

Allow Webmin access only from specific IPs

The simplest way does not depend on the firewall: open “Webmin → Webmin Configuration → IP Access Control”, choose “Only allow from listed addresses” and list your addresses or subnets. For example, to allow the panel only from your WireGuard network, enter 10.2.0.0/24. Be sure to include the address you are working from now, or you will lock yourself out after saving.

Fail2Ban in Virtualmin

You do not need to install Fail2Ban separately: the Virtualmin 8 installer installs and configures it. /etc/fail2ban/jail.local enables protection for SSH, Webmin sign-in, Postfix and Dovecot, plus ProFTPD and Usermin on a full install. Logs are read from the systemd journal, and bans are enforced via nftables.

Check which jails are active:

fail2ban-client status
fail2ban-client status sshd

In Webmin, Fail2Ban is managed in the “Fail2Ban Intrusion Detector” module — look for it under “Networking” or “Un-used Modules”.

Do not overwrite the jail.local created by Virtualmin: its settings are tuned for the systemd journal and nftables. To make bans stricter, create a separate file:

nano /etc/fail2ban/jail.d/custom.local

[DEFAULT]
# 3 attempts within 3 hours — banned for a day
maxretry = 3
findtime = 3h
bantime = 1d
# your own addresses that must never be banned
ignoreip = 127.0.0.1/8 ::1 10.2.0.0/24

Replace 10.2.0.0/24 with your VPN subnet or home IP. Apply the settings and check that the service started without errors:

systemctl restart fail2ban
systemctl status fail2ban

The old config from this guide with the sshd-ddos filter and the ufw action does not fit modern systems: recent Fail2Ban versions no longer ship sshd-ddos, and the service fails to start with it.

The nftables firewall in Virtualmin

Virtualmin 8 sets up an nftables firewall: the installer creates a hosting profile with SSH, web, mail, DNS, FTP and Webmin (10000–10100) ports open, and stops and disables FirewallD, iptables and UFW so the rules do not conflict.

• Rules are edited in Webmin: “Networking → Linux Firewall”. There you can close unneeded ports — for example, mail and FTP if you used --type mini — and block an IP or subnet.
• To check the current rules from the console: nft list ruleset.
• Do not install UFW on top of the Virtualmin nftables profile: the two rule sets will conflict and you may lose access to the server.
• Servers installed before Virtualmin 8 use FirewallD by default — manage it in the Webmin “FirewallD” module. Do not combine it with UFW either.

To hide the panel from the internet entirely, the easiest way is to connect to the server over a VPN and allow Webmin sign-in only from the VPN subnet via “IP Access Control” (see above).

Backups in Virtualmin

Virtualmin backs up entire sites: files, databases, web server, DNS and mail settings. Schedule them:

1. Open “Backup and Restore → Scheduled Backups” and add a new schedule.
2. Choose the sites (or all of them) and the features to back up.
3. Pick a destination: a local directory, another server over SSH or FTP, or cloud storage such as an S3-compatible service.
4. You can use the date in the path, for example /backup/%Y-%m-%d, to keep several days of backups, and set up deletion of old ones.
5. Choose a schedule — for example, daily at midnight — and save.

Do not keep backups only on the same server: if the VPS fails, local copies go with it. For large sites, differential backups help — a full one weekly and changes nightly. Restoring is under “Backup and Restore → Restore Virtual Servers”; more in the Virtualmin docs.

Virtualmin vs other hosting panels

A quick look at how Virtualmin compares with popular alternatives:

Panel	License	Web server	Mail and DNS	Best for
Virtualmin	free GPL, Pro available	Apache or Nginx	yes	full control and lots of features
HestiaCP	free	Nginx + Apache or PHP-FPM	yes	a simpler interface; Debian and Ubuntu only
CloudPanel	free	Nginx	no	PHP, Node.js and Python sites without self-hosted mail
aaPanel	free core, paid plugins	Nginx, Apache, OpenLiteSpeed	via plugins	people who like an app store inside the panel
ISPmanager	paid	Apache and Nginx	yes	commercial support and a localized interface

Virtualmin looks more complex than the others at first, but it supports more systems, does almost everything out of the box, and is completely free in the GPL edition with no limit on sites.

Virtualmin FAQ