phpMyAdmin security questions

adavis

I'm wanting to upgrade to phpMyAdmin 2.5.4 from version 1.143. This is on personalizing the config.ini.php file for my site.

I was told that it isn't a good idead to put phpMyAdmin in the default location, calling it the default name like:
```
www.mysite.com/phpMyAdmin/
```
but instead as a precaution to keep people from just going to your php site and trying that directory to see if you are running phpMyAdmin without any precautions, to put to somewhere a bit harder to find like:
```
www.mysite.com/anotherfolder/phpMyAdmin254/
```
or something like that. In fact, I think I could call phpMyAdmin anything I wanted to as long as I specified it in the ini file. Am I right on this?
The next security point is with the auth_type. When I get to
```
$cfg['Servers'][$i]['auth_type'] = 'config';
// Authentication method (config, http or cookie based)?
```
I'm not exactly sure what I want. I am thinking I want http there. Previously, I had config there and htaccess on the folder so that the user (me) had to enter userid and password. I have been told that though this is more secure, it is not all that secure because the userid and pasword are sent as plain text and if someone is listening to your port at the right time, they could pick that up. I have read through the documentation and read that cookie is a bit buggy, so what is the best way to secure phpMyAdmin to keep prying eyes and fingers out? [/list=1]If there's anyone out there with some good experience with and knowledge of phpMyAdmin please explain these security issues to us naive soul out here. What is the best way to make our databases secure while still being easy to work with?

Thanks

KITTfan2K

If I am correct, the HTTP authtype asks you to log in every time you use it, but the best way (I think) is to do a htaccess on that directory, AND use the HTTP authtype.

KITTfan2k.

adavis

Can you explain that in a bit more detail? I'm still not familiar with all the terminology. Can you also explain how things would work if I set

$cfg['Servers'][$i]['auth_type'] = 'http';

and set htaccess on that folder?

KITTfan2K

If you set htaccess, then the server wouldn't let you connect to the page without having the correct username/password.

When you set the authtype on phpmyadmin to http, it will (I think, I've never had any reason to try it...) ask you to log in using your root username and password.

By the way, you should change the root username to something else, so that you're less likely to get hacked by people guessing that yopu're using the default username and no password.

KITTfan2K

Edit: I think that Lycos gives you a htaccess/htpasswd generator if you're signed up there. It's one of the only reasons to use it!

mrhappiness

doing both (htacces and http_auth) is only more secure than using only one of them if you use different username/password combinations

both times username/password will be transferred as plain text

adavis

Sorry to be asking so many trivial questions, but I'm kind of slow :rolleyes:. What do you mean by root username?

I'm just wondering if I put phpMyAdmin in a directory with a random name, something like:

www.mysite.org/djasljd/dbadmin/

instead of

www.mysite.org/db/phpMyAdmin/

and used htaccess (which I already have set up on another folder and know how to do already), setting $cfg['Servers'][$i]['auth_type'] = 'config'; , would that be about the same security as setting to 'http'. I'm not opposed to looking into 'cookie' if I could understand how it worked.

KITTfan2K

Originally posted by adavis
Sorry to be asking so many trivial questions, but I'm kind of slow :rolleyes:. What do you mean by root username?

The default username for full control of the database (or the 'root' username, it's a Unix term, you don't need to understand why it's called that) is (when you install it on your own webserver) 'root' with no password, kind of like the default 'Administrator' account on Windows XP. This is a security hole because there are a lot of people out there who know the default settings for that, and some of them will use that information to access your database, and change things there or even lock you out of the database.

You need to change this from 'root' and no password to something easy to remember, for example 'adavis' (your username here, unless I'm talking to completely the wrong person) and a password that you can remember.

KITTfan2K

adavis

Are you talking about these two variables:

$cfg['Servers'][$i]['user']     = 'mysqlusername';  // MySQL user
$cfg['Servers'][$i]['password'] = 'mysqlpassword';  // MySQL password (only needed

If so, I already have them set to something else.

So, if I understand this correctly, when I want to go to my phpMyAdmin folder, I would go to the URL, then the htaccess login box would pop up. I type my htaccess username/password, then phpMyAdmin would challenge me to get my database username/password. Once I entered that info in, I would be allowed to work within phpMyAdmin.

Do you know how the 'cookie' setting works? Is it more secure?

mrhappiness

well, a cookie is stored at a computer so everyone who has access to this comp canuse the information stored inside the cookie

although you chenged your config.inc.php you still have a user called root
open phpmyadmin, there should be a link called "privileges" where all user's are listed

KITTfan2K

Originally posted by mrhappiness
well, a cookie is stored at a computer so everyone who has access to this comp canuse the information stored inside the cookie

Cookie is probably like HTTP if you don't have a cookie on the computer, then it saves the username and password that you enter when you've logged in correctly.

KITTfan2K

Edit: sorry if that didn't make sense, i'm too tired to exlpain it now. I need coffee!

adavis

Okay, so what's the final consensus on the best way to make phpMyAdmin reasonably secure?

What do those of you who use this and are security conscious do?

Thanks...

KITTfan2K

Originally posted by adavis
Okay, so what's the final consensus on the best way to make phpMyAdmin reasonably secure?

What do those of you who use this and are security conscious do?

Thanks...

Yeah... Do you have a secure server?

Because that's the best way to keep the database secure.

Otherwise

Change the default (root) username of the database (if you haven't already)
Set PHPmyAdmin to login with HTTP authentication
Set the .htaccess up to have only one username and password

adavis

Well, sounds like when I upgrade, I'll be doing all I can do.

Any advice on upgrading to the newest version?

Thanks...