Making phpmyadmin secure

Anon

Hi All.

If I accept the default location my server provides for installation... /html/phpmyadmin, then anyone can type index.php3 into their browser and phpmyadmin opens and displays all the mysql dbs on the server.

If I have root as the user and roots pwd in the config.inc.php3 file,
then when I run phpmyadmin the one live database that exists on - one of
my clients sites - is visible showing all details of the mysql db.

When I remove all references to users and passwords in the
config.inc.php3 file then I am still able to see the db's listed, but
not the data. Clicking on a db name (in the left column) returns "no
tables found in database."

If I move the phpmyadmin directory out of the /html directory then I'm unable to access it.

How does one protect phpmyadmin?

Lance

andrin

If you use Apache I would suggest using .htpass and protect the directory containing phpMyAdmin.

Good Luck
/Andrin

Anon

There are two easy options:

1)You can place the phpmyadmin directory in an authenticated directory using standard basic authentication (or digest if you are using IE 5.0 or above)

2) Change the authentication type in phpmyadmin to cookie so you need to login at the index.php page. Also, careful attention to the users privileges that is able to access the sql server will make things a bit more secure but as with everything over the internet...nothing is perfect.

Using both of the above wouldn't be a bad idea.

LanceS wrote:

Hi All.

If I move the phpmyadmin directory out of the /html directory then I'm unable to access it.

How does one protect phpmyadmin?

Lance

Anon

Here is another method for protection of phpmyadmin.

.htaccess protect you phpmyadmin directory. The .htaccess user/pass combo should be the user/pass combo for the database. And in your config.inc.php3 file set your

$cfgServers[1]['user'] = "$PHP_AUTH_USER";
$cfgServers[1]['password'] = "$PHP_AUTH_PW";

This allows only users who have db access permissions to log into directory, and protects world-readable code on the webserver.

The fact that PHP as a module runs as nobody is a HUGE security risk. Since it runs as nobody, all code must be readable by the unprivileged user. This gives any user, with access to your server, the ability to view your code and grep for user/pass combos or look for security related holes within your code. PHP run as a module in a shared environment is a NIGHTMARE! If you host on a shared box, I strongly suggest that you run your PHP applications using PHP complied into a binary executing under suexec.

lances

OK.

Without being touchy-feely, I have posted this question on just about every PHP related board I could find, and while I have to admit I did start to receive a reply from someone on PostNuke, the response on PHPBuilder has been outstanding.

I want to thank everyone for taking the time to reply.

So that said, it does seem as tho .htaccess is the recommended way to go. So not knowing much about .htaccess, I'll look into how to make those entries. I did find a great site for tutorial at:

http://www.find.com.au/tutorials/

Anyway, J., you lost me with:

I strongly suggest that you run your PHP >>applications using PHP complied into a >>binary executing under suexec.

I'm in sensory overload at themoment but I should have something to report by the end of the week.

Lance