Q:

Webmin authentication fails without any errors - Correct username and password fail

I use Ubuntu server 16.04 on which I base my Apache server environment. I have installed CSF-LFD to filter almost all ports in the machine:
# Setup CSF-LFD:
cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
sed -i 's/TESTING = "1"/TESTING = "0"/g' /etc/csf/csf.conf
csf -r
perl /usr/local/csf/bin/csftest.pl
# cd /etc/csf && sh uninstall.sh

I then installed Webmin and unfiltered its native port (10000) which was filtered by CSF-LFD from before:
cat << EOF >> /etc/apt/sources.list

deb http://download.webmin.com/download/repository sarge contrib
EOF
cd /root
wget http://www.webmin.com/jcameron-key.asc
apt-key add jcameron-key.asc
sudo apt-get update
apt-get install webmin -y
sed -i 's/ssl=1/ssl=0/g' /etc/webmin/miniserv.conf
sed -i 'TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995"/TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,10000"/g' /etc/csf/csf.conf
service csf restart
/etc/init.d/webmin restart

Yet I just can't access it: When I go to http://my_ip:10000, I fill in the username and password, click login, and the page just refresh for about 0.25 second. I can repeat this process up to 5 times till I'm blocked for 1 minute.
I've already installed Webmin several times on VPSs and never had this problem in which I try to login and the login fails, with no error, anywhere (or thus it seems to me).

This situation is quite wired, because:
.1. I made sure I insert the correct password (I checked that in about 5 different occasions).
.2. I Checked from several browsers after total browser cache-flush: It's not a browser Cache issue...
.3. Not only I can go to the login screen when http://my_ip:10000 without probelm, Port 10,000 is LISTEN, so it's quite certainly not a CSF-LFD issue. See:
root@ubuntu-2gb-fra1-01:/var/webmin# netstat -an | grep :10000
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN
udp        0      0 0.0.0.0:10000           0.0.0.0:*

.4. Apache error log shows no webmin-related errors:
root@ubuntu-2gb-fra1-01:/var/webmin# tail /var/log/apache2/error.log
[Mon Nov 21 01:13:20.984586 2016] [mpm_prefork:notice] [pid 22959] AH00171: Graceful restart requested, doing restart
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
[Mon Nov 21 01:13:21.040358 2016] [mpm_prefork:notice] [pid 22959] AH00163: Apache/2.4.18 (Ubuntu) configured -- resuming normal operations
[Mon Nov 21 01:13:21.040376 2016] [core:notice] [pid 22959] AH00094: Command line: '/usr/sbin/apache2'
[Mon Nov 21 01:13:25.730236 2016] [mpm_prefork:notice] [pid 22959] AH00169: caught SIGTERM, shutting down
[Mon Nov 21 01:13:40.492172 2016] [mpm_prefork:notice] [pid 1720] AH00163: Apache/2.4.18 (Ubuntu) configured -- resuming normal operations
[Mon Nov 21 01:13:40.495566 2016] [core:notice] [pid 1720] AH00094: Command line: '/usr/sbin/apache2'
[Mon Nov 21 07:06:27.483595 2016] [mpm_prefork:notice] [pid 1720] AH00169: caught SIGTERM, shutting down
[Mon Nov 21 07:06:28.568672 2016] [mpm_prefork:notice] [pid 7745] AH00163: Apache/2.4.18 (Ubuntu) configured -- resuming normal operations
[Mon Nov 21 07:06:28.568778 2016] [core:notice] [pid 7745] AH00094: Command line: '/usr/sbin/apache2'

.5. Apache access log shows no webmin-related errors:
root@ubuntu-2gb-fra1-01:/var/webmin# tail /var/log/apache2/access.log
80.246.133.215 - - [21/Nov/2016:20:46:37 +0000] "GET /icons/ubuntu-logo.png HTTP/1.1" 200 3624 "http://46.101.188.112/" "Mozilla/5.0 (Linux; Android 7.0; Nexus 5X Build/NBD90W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Mobile Safari/537.36"
80.246.133.215 - - [21/Nov/2016:20:46:38 +0000] "GET /favicon.ico HTTP/1.1" 404 505 "http://46.101.188.112/" "Mozilla/5.0 (Linux; Android 7.0; Nexus 5X Build/NBD90W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Mobile Safari/537.36"
46.59.140.166 - - [21/Nov/2016:22:06:26 +0000] "GET / HTTP/1.1" 200 3525 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Safari/537.36"
46.59.140.166 - - [21/Nov/2016:22:06:27 +0000] "GET /icons/ubuntu-logo.png HTTP/1.1" 200 3623 "http://46.101.188.112/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.85 Safari/537.36"
92.247.83.67 - - [21/Nov/2016:23:18:05 +0000] "GET / HTTP/1.0" 200 11595 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
199.241.190.169 - - [21/Nov/2016:23:30:27 +0000] "PROPFIND /webdav/ HTTP/1.1" 405 569 "-" "WEBDAV Client"
36.230.254.210 - - [22/Nov/2016:00:26:57 +0000] "CONNECT 163mx02.mxmail.netease.com:25 HTTP/1.0" 405 546 "-" "-"
54.206.114.46 - - [22/Nov/2016:01:11:03 +0000] "GET / HTTP/1.1" 200 3488 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
212.83.181.85 - - [22/Nov/2016:03:04:27 +0000] "GET http://www.stilllistener.com/checkpoint1/test2/ HTTP/1.1" 404 520 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
213.57.101.253 - - [22/Nov/2016:03:16:13 +0000] "GET / HTTP/1.0" 200 11595 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"

.6. Webmin miniserv log give no clear error:
root@ubuntu-2gb-fra1-01:/var/webmin# tail /var/webmin/miniserv.error
[21/Nov/2016:01:13:42 +0000] PAM authentication enabled
[21/Nov/2016:07:06:41 +0000] [000.000.000.000] /session_login.cgi : Access denied for 000.000.000.000. The host has been blocked because of too many authentication failures.
[21/Nov/2016:07:50:24 +0000] [000.000.000.000] /session_login.cgi : Access denied for 000.000.000.000. The host has been blocked because of too many authentication failures.
[21/Nov/2016:16:23:46 +0000] miniserv.pl started
[21/Nov/2016:16:23:46 +0000] Using MD5 module Digest::MD5
[21/Nov/2016:16:23:46 +0000] PAM authentication enabled
[21/Nov/2016:20:33:02 +0000] miniserv.pl started
[21/Nov/2016:20:33:02 +0000] Using MD5 module Digest::MD5
[21/Nov/2016:20:33:02 +0000] PAM authentication enabled
[22/Nov/2016:03:05:03 +0000] [000.000.000.000] /session_login.cgi : Access denied for 000.000.000.000. The host has been blocked because of too many authentication failures.

Notes:

Even though /etc/webmin/config already includes log=1. Both locate webmin.log or find / -type f -name webmin.log 2>/dev/null, so I can't use that particular file to further debug.

My question:
If the software is installed in the conventional way, port 10000 is opened, and no clear error is seen anywhere (or thus it seems to me), what else can prevent a user from logging to Webmin in this case?

A:

Naturally, Webmin uses your Unix users as its own users (that includes root). Yet, it seems Webmin didn't use the non-root work user I created in Unix for some reason, maybe it was due to a typo or corrupted pasting of a ready password, back when I created my Unix non-root work user. So basically there are 2 ways to solve this problem. 
Way 1 - Using the root user:
If you want to use your Unix root user to operate in Webmin just create a password for it if you haven't already, and login with it.
Note that in some cases, some people don't create a root password and hence when logging in with SSH keys, they can't do some password-requiring operations with root, like logging in to Webmin, and they might wonder why... In this case, all is required is creating a root password in Unix, via:
passwd root

Create a password and you're good to go. Now try to login with Webmin.
Way 2 - Using a non-root user:
If you created a non root work user (with a password) just try to login with it. It should work. If it doesn't work, try this:
Create a Webmin user:
/usr/share/webmin/changepass.pl /etc/webmin [user] [[password]

In [user] and [password] just type the desired username which is identical to my Unix non-root work user (you can also just type there root) and a password without brackets.

My opinion on which way to choose:

If you are the only person who uses the server, I see no reason, not to pick way 1... It is indeed a best practice to work in Unix from a non root work user, but I'm not sure it's always a best practice in all that has to do with Webmin; I personally use Webmin as root in my own servers. 

