Webmin vs Stenvakt

Webmin and Stenvakt both help you run a Linux server without memorising every config file. They answer different questions, though. Webmin lets you change almost anything on the server from a browser. Stenvakt tells you what is risky on your servers and fixes it without locking you out.

Published 1 November 2026. Webmin as published on webmin.com; Stenvakt for macOS 14 or newer, managing Linux servers over SSH.

• The short answer
• Where each one runs
• What each one is good at
• Lockouts
• How to choose

The short answer

• Pick Webmin when you want one place to manage everything on a server from any browser: users, Apache or nginx, DNS, cron, file shares, packages, and much more.
• Pick Stenvakt when the job is keeping several servers patched and locked down, and you never want a change to cut off your own SSH access.
• Use both if you like Webmin for day-to-day admin. Stenvakt's review will simply tell you that a panel is listening, and on which port.

Where each one runs

Webmin is installed on the server. It runs its own web server, by default on port 10000, and you log in to it with a browser. Everything it does, it does as root on that machine.

Stenvakt is installed on your Mac. It connects to each server over SSH, the way you already do, and nothing new listens on the server. A review only reads; nothing changes until you preview a fix and run it.

This is the biggest practical difference. A web panel is one more login page facing the internet, and one more program that has to be kept up to date. Webmin has had serious problems in the past, including a 2019 incident in which some of its published downloads carried a backdoor (CVE-2019-15107) and a 2022 access-control flaw (CVE-2022-0824). Both were fixed, and keeping Webmin updated and behind a firewall or VPN is the usual advice.

What each one is good at

Webmin is broad. Its modules cover a huge part of Linux administration, and it is free and open source. If you manage a mail server, DNS zones or Samba shares by hand, Webmin saves real time.

Stenvakt is narrow and opinionated. It looks at security and health:

• A review of each server with a security and a health score, and a plain list of what to fix now, what to do soon and what is nice to have.
• Firewall, SSH and fail2ban changes that run in safe mode: the server saves its config, arms a rollback timer, and keeps the change only after a fresh SSH login works.
• Fleet views: the same checks on every server at once, and the weakest server first.
• Watch: who tried to log in, what the firewall blocked, and which ports are really used.

Lockouts

The fastest way to lose a server is a firewall rule or SSH setting that blocks your own connection. Webmin will happily apply what you ask for; if it was wrong, you need the hosting provider's console to get back in.

Stenvakt's safe mode exists for exactly this. The rollback timer runs on the server, so even if your Mac sleeps or your connection drops, the server undoes the change on its own when the timer runs out.

How to choose

• One server, lots of hands-on admin, comfortable with a panel on the server: Webmin.
• Several servers, the goal is "patched, firewalled, SSH locked down, and I find out when something changes": Stenvakt.
• Not sure: run a read-only check first. Stenvakt's review changes nothing, so it costs you nothing to see where your servers stand.

Sources

1. Webmin (official site)
2. CVE-2019-15107: Webmin password_change.cgi backdoor (NVD)
3. CVE-2022-0824: Webmin improper access control (NVD)