Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
MiniServ is the lightweight Perl based web server that powers Webmin and Usermin, serving the system administration interface over HTTPS and setting a strictly necessary session cookie to authenticate administrators.
MiniServ is the lightweight, Perl based web server that powers Webmin and Usermin, the popular open source tools for administering Unix and Linux systems. It runs directly on the administrator own server and serves the management interface over HTTPS, handling authentication, access control and encrypted connections without relying on any external service.
MiniServ, implemented in the script miniserv.pl, is the built in web server that both Webmin and Usermin use to deliver their administration panels. It is a first party, self hosted component that you install and run on your own infrastructure. It is not a visitor analytics tool and it does not load third party trackers or advertising scripts. Its only job is to securely present the administration interface to the people who manage the server.
When an administrator signs in, MiniServ sets a first party session cookie, commonly named sid, and may use a short lived testing cookie to confirm that the browser accepts cookies. This cookie keeps the administrator logged in for the duration of the session and is the standard mechanism behind Webmin session authentication mode. The cookie holds only an opaque session identifier, not credentials, and over HTTPS it is issued with the secure and httpOnly flags so it cannot be read by scripts or sent over an unencrypted connection.
The MiniServ session cookie is strictly necessary to provide the service that the administrator explicitly requested, namely a secure login. Under Article 5(3) of the ePrivacy Directive, cookies that are strictly necessary to deliver a service the user asked for are exempt from the consent requirement. The minimal processing involved rests on the operator legitimate interest under Article 6(1)(f) GDPR in securing access to its own systems, so MiniServ raises only limited data protection concerns when it is used as intended.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Because the session cookie is strictly necessary for authentication, no prior consent or cookie banner is required for it. The interface is reached only by administrators who deliberately log in, not by general visitors, so there is no tracking that would trigger a consent obligation. You should still describe the cookie transparently in any internal privacy notice that covers your administration tools.
MiniServ is entirely self hosted, so it does not transmit personal data to any third party or to servers outside your own infrastructure. There is no transfer to third countries to assess, because the session data never leaves the machine you control. This makes MiniServ straightforward from an international data transfer perspective, provided you host it within the jurisdiction you intend.
To run MiniServ compliantly, always serve the interface over HTTPS so the session cookie is encrypted in transit, and keep the secure and httpOnly cookie flags enabled. Restrict administrator access by IP where possible, use strong credentials and two factor authentication, and keep Webmin or Usermin updated to receive security fixes. Finally, document who has administrator access and reference the strictly necessary session cookie in your internal records of processing.
Websites using MiniServ must obtain user consent under GDPR regulations.
DPIA considerations
MiniServ is self hosted and processes only the data needed to authenticate administrators through a first party session cookie, so a formal Data Protection Impact Assessment is generally not required. Operators should still record administrator access in their internal documentation and apply standard access controls. Because no visitor tracking or third party data sharing takes place, the residual privacy risk is low.
Sample consent text
This site uses a strictly necessary MiniServ session cookie to keep administrators securely signed in, which does not require consent.
Third-party domains contacted
webmin.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sid | Strictly Necessary | Session | Keeps an authenticated administrator logged in to the Webmin or Usermin interface for the duration of the session. Issued with the secure and httpOnly flags over HTTPS. |
| testing | Strictly Necessary | Session | Short lived cookie used at login to confirm that the administrator browser accepts cookies before establishing the authenticated session. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
MiniServ sets a first party session cookie, commonly named sid, when an administrator logs in, and it may use a short lived testing cookie to confirm that the browser accepts cookies. The session cookie holds only an opaque identifier and, over HTTPS, carries the secure and httpOnly flags. No third party or tracking cookies are involved.
No. The session cookie is strictly necessary to provide the secure login that the administrator explicitly requested, so it falls under the Article 5(3) ePrivacy exemption. No cookie banner or prior consent is needed for it. You should still document the cookie in your internal privacy records.
The minimal processing relies on the operator legitimate interest under Article 6(1)(f) GDPR in securing access to its own systems, combined with the strictly necessary cookie exemption under the ePrivacy Directive. Because access is limited to authenticated administrators, the basis is well supported and the risk is low.
No. MiniServ is entirely self hosted and does not send personal data to third parties or to servers outside your own infrastructure. Session data never leaves the machine you control, so there is no third country transfer to assess as long as you host it within your intended jurisdiction.
Generally no. MiniServ processes only the minimal data needed to authenticate administrators, with no visitor tracking or third party sharing, so a formal Data Protection Impact Assessment is usually not required. You should still record administrator access and apply standard access controls as part of good practice.
Serve the interface over HTTPS so the session cookie is encrypted in transit, and keep the secure and httpOnly flags enabled. Restrict administrator access by IP where possible, use strong credentials and two factor authentication, and keep Webmin or Usermin updated for security fixes. Document who holds administrator access.
MiniServ is part of Webmin and Usermin, so it is chosen alongside those tools. If you are comparing administration panels, alternatives include Cockpit, Ajenti and Plesk. Each has its own architecture and cookie behaviour, so review the relevant privacy and security characteristics before switching.
If your cookie or privacy documentation covers the administration interface, mention the strictly necessary MiniServ session cookie for transparency, even though it does not require consent. Describe its purpose, that it is first party and self hosted, and that no tracking takes place.