# Security Features Available in webMAN MOD's Admin Mode: Complete Technical Guide

> Explore webMAN MOD admin mode security features including sys_admin flag, password auth, and guards. Learn how to insulate privileged operations from standard access in this technical guide.

- Repository: [Aldo Vargas/webman-mod](https://github.com/aldostools/webman-mod)
- Tags: deep-dive
- Published: 2026-02-24

---

**webMAN MOD implements a defense-in-depth security model using a runtime `sys_admin` flag, password authentication, hardware shortcuts, and compile-time guards to isolate privileged operations from standard user access.**

The aldostools/webman-mod repository provides a sophisticated permission system for PlayStation 3 homebrew management. Understanding the security features available in webMAN MOD's admin mode is essential for securing critical system functions against unauthorized remote access. The implementation centers on a global `u8 sys_admin` flag and a persistent `admin_mode` configuration entry that create multiple authorization layers across the codebase.

## Authentication and Access Control

### Password-Based Admin Activation

Admin mode requires explicit authentication through the `/admin.ps3` HTTP endpoint. Users must supply a correct password via the query parameter `/admin.ps3?enable&pwd=<password>` to set the privileged flag.

The `check_password(param)` function in [`include/cmd/admin.h`](https://github.com/aldostools/webman-mod/blob/main/include/cmd/admin.h) validates credentials before modifying the system state. Upon successful validation, the code sets `sys_admin = 1`, granting access to restricted functionality. Failed attempts are tracked, and the password check can reset via hardware intervention.

```c
/* Enable admin mode via HTTP request */
if (islike(param, "/admin.ps3")) {
    // /admin.ps3?enable&pwd=secret
    if (param[10] == 0 || param[11] == 0) ;          // show status only
    else if (~param[11] & 1) sys_admin = 0;           // disable
    else sys_admin = check_password(param);           // enable after password
}

```

### Hardware Shortcut Toggle

Users can toggle admin mode without network access using the controller combination **L2+R2+Triangle**. Implemented in [`include/combos.h`](https://github.com/aldostools/webman-mod/blob/main/include/combos.h), this shortcut flips the `sys_admin` flag using bitwise XOR (`sys_admin ^= 1`) and simultaneously resets the password attempt counter (`pwd_tries = 0`).

```c
/* Toggle admin mode using the controller shortcut (L2+R2+△) */
if (is_combo(L2+R2+TRIANGLE)) {
    sys_admin ^= 1;          // flip the flag
    pwd_tries = 0;           // reset failed attempts
    show_status("ADMIN", sys_admin);
    sys_admin ? BEEP1() : BEEP2();   // audible feedback
}

```

## Runtime Authorization and Command Filtering

### The sys_admin Flag Architecture

At the core of webMAN MOD's security model is the global `u8 sys_admin` variable defined in [`include/www/www_admin.h`](https://github.com/aldostools/webman-mod/blob/main/include/www/www_admin.h). This runtime flag acts as a gatekeeper for all privileged operations. When `sys_admin` evaluates to false (0), the system rejects requests to critical endpoints and returns an **ADMIN DISABLED** error message.

```c
#ifdef SYS_ADMIN_MODE
if (!sys_admin) {
    concat3(param, STR_ERROR, "\nADMIN ", STR_DISABLED);
    keep_alive = http_response(conn_s, header, param,
                              CODE_BAD_REQUEST, param);
    goto exit_handleclient_www;
}
#endif

```

### Restricted Web Command Protection

The [`include/www/www_isadmin.h`](https://github.com/aldostools/webman-mod/blob/main/include/www/www_isadmin.h) file maintains an accept list of URLs that require administrative privileges. When admin mode is disabled, the system blocks access to sensitive endpoints including `/setup.ps3`, `/delete.ps3`, and `/mount.ps3`. Any request to these URLs without the `sys_admin` flag set triggers an immediate rejection with a `CODE_BAD_REQUEST` response.

## Network and File System Security Barriers

### Protected Server Sockets

Network services implementing remote code execution capabilities enforce admin mode checks before accepting connections. The **FTP server** ([`include/ftp.h`](https://github.com/aldostools/webman-mod/blob/main/include/ftp.h)) and **PS3MAPI server** ([`include/ps3mapi/ps3mapi_server.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi_server.h)) both wrap their socket acceptance logic in `if(sys_admin && …)` conditions, ensuring these powerful remote interfaces remain inaccessible to unauthenticated users.

### File System Operation Guards

Critical file system operations that could modify system partitions are protected through explicit guards in [`include/file_manager.h`](https://github.com/aldostools/webman-mod/blob/main/include/file_manager.h) and [`include/mount.h`](https://github.com/aldostools/webman-mod/blob/main/include/mount.h). Operations targeting sensitive paths such as `/dev_flash`, `/dev_blind`, and `/dev_hdd1` require `sys_admin` to be true before execution. This prevents accidental or malicious modification of system firmware and critical storage partitions during standard user sessions.

## Configuration and Compile-Time Security

### Persistent Admin Mode Settings

The [`include/wm_config.h`](https://github.com/aldostools/webman-mod/blob/main/include/wm_config.h) file defines `u8 admin_mode`, which stores the default permission level across reboots (0 for USER mode, 1 for ADMIN mode). Users can force admin mode at boot time through the `SYS_ADMIN` configuration combo. Additionally, the [`flags.h`](https://github.com/aldostools/webman-mod/blob/main/flags.h) file provides the `SYS_ADMIN_MODE` compile-time macro that enables the entire admin security subsystem during build configuration.

## User Feedback and Security Awareness

webMAN MOD provides immediate visual and audible feedback when the admin state changes to prevent silent privilege escalation. The `show_status("ADMIN", sys_admin)` function displays **ADMIN ENABLED** or **ADMIN DISABLED** in the web UI, while distinct beep patterns (`BEEP1()` for activation, `BEEP2()` for deactivation) provide physical confirmation of security state transitions.

## Summary

- **Defense-in-depth architecture** combines authentication, authorization, and auditing layers to protect critical functions.
- **Runtime `sys_admin` flag** controls access to all privileged code paths, checked before executing sensitive operations.
- **Password protection** via `/admin.ps3` endpoint and `check_password(param)` validation prevents unauthorized admin activation.
- **Hardware toggle** using L2+R2+Triangle provides physical control over the permission state and resets failed authentication attempts.
- **Network and filesystem guards** block FTP, PS3MAPI, and partition modification operations unless admin mode is explicitly enabled.
- **Compile-time controls** through `SYS_ADMIN_MODE` macro and `admin_mode` configuration enable persistent security policies.

## Frequently Asked Questions

### How do I enable admin mode in webMAN MOD?

You can enable admin mode by accessing the URL `/admin.ps3?enable&pwd=<your_password>` through a web browser, or by pressing the **L2+R2+Triangle** controller combination on the PlayStation 3. The password is validated by the `check_password(param)` function in [`include/cmd/admin.h`](https://github.com/aldostools/webman-mod/blob/main/include/cmd/admin.h) before the `sys_admin` flag is set to 1.

### What commands are restricted when admin mode is disabled?

When admin mode is disabled, webMAN MOD blocks access to `/setup.ps3`, `/delete.ps3`, and `/mount.ps3` endpoints according to the logic in [`include/www/www_isadmin.h`](https://github.com/aldostools/webman-mod/blob/main/include/www/www_isadmin.h). Additionally, the FTP server ([`include/ftp.h`](https://github.com/aldostools/webman-mod/blob/main/include/ftp.h)) and PS3MAPI server ([`include/ps3mapi/ps3mapi_server.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi_server.h)) reject all incoming connections, and file system operations on `/dev_flash`, `/dev_blind`, or `/dev_hdd1` are prohibited.

### Where is the admin mode password validated in the source code?

Password validation occurs in [`include/cmd/admin.h`](https://github.com/aldostools/webman-mod/blob/main/include/cmd/admin.h) within the `check_password(param)` function. This function parses the password from the HTTP request parameters and compares it against the stored credentials. Only upon successful validation does the code execute `sys_admin = 1` to grant privileged access.

### Can admin mode be enabled permanently?

Yes, admin mode can be configured to persist across reboots using the `admin_mode` setting in [`include/wm_config.h`](https://github.com/aldostools/webman-mod/blob/main/include/wm_config.h), where a value of 1 forces ADMIN mode and 0 forces USER mode. Users can also define the `SYS_ADMIN` combo in their configuration to automatically enable admin mode at boot time, or compile the project with the `SYS_ADMIN_MODE` macro in [`flags.h`](https://github.com/aldostools/webman-mod/blob/main/flags.h) to enable the security subsystem.