1

I am running a Debian server with PHP5, Apache 2.2.16 and PHPMyAdmin (I don't know how to check the version number), Logcheck and some other programs.
Today Logcheck begin to attach multiple lines like this, and I do not know how I can prevent them

Feb 12 15:08:03 mail suhosin[5538]: ALERT - tried to register forbidden variable '_SESSION[ConfigFile][Servers][*/foreach($_GET as $k=>$v)if($k==="eval")eval($v);/*][port]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')
Feb 12 15:08:03 mail suhosin[3131]: ALERT - tried to register forbidden variable '_SESSION[ConfigFile][Servers][*/foreach($_GET as $k=>$v)if($k==="eval")eval($v);/*][port]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')
Feb 12 15:08:04 mail suhosin[5548]: ALERT - tried to register forbidden variable '_SESSION[!bla]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')
Feb 12 15:08:04 mail suhosin[3130]: ALERT - tried to register forbidden variable '_SESSION[!bla]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')

Should I block the IP using IPTables or how?
And if I am going to use IPTables, how should I insert the lines?

1 Answer 1

6

Block this using just IPtables will be a futile endeavor, as PHPMyAdmin is a very attractive target for attackers and you will get other attempts from other addresses.

You have the following options, sorted in order of reliability:

  1. Get rid of the unsecure pile of garbage that is PHPMyAdmin and remove it from your system.
  2. If that's not possible, limit access to it with one or more of the following methods from your Apache config (either the site config file or with an .htaccess in the PHPMyAdmin directory:
    • Limit access to a known network or even better only the localhost and use SSH port forwarding to access it.
    • Limit access to it with an SSL key pair. This is quite secure but not very easy to set up.
    • Use HTTP basic auth to limit access to PHPMyAdmins directory with an additional password.
  3. Use something like Fail2Ban that will dynamically block attackers IP addresses.

If I have someone who just needs PHPMyAdmin and can't be bothered to learn to use other tools, I usually set up a local installation of it on the user's machine and configure it to use MySQL via a SSH port forwarding and then make it easy for the user to establish the tunnel.

4
  • Is there a way to allow IPes in PHPMyAdmin without restarting Apache2 each time a new IP is added?
    – The87Boy
    Feb 12, 2012 at 16:51
  • That's what the .htaccess is for, but if you plan to modify the allowed IP addresses whenever your (dynamic?) IP address on the client side changes, I would strongly advise you to use SSH port forwarding instead and limit access to PHPMyAdmin to the localhost on the server side.
    – Sven
    Feb 12, 2012 at 16:54
  • I think that's the way to go then. Thanks for the answer :D I first edited /etc/apache2/conf.d/phpmyadmin.conf, but then I have to restart Apache2 each time, but if I created an .htaccess-file inside /usr/share/phpmyadmin/ I shouldn't restart the PHPMyAdmin each time
    – The87Boy
    Feb 12, 2012 at 17:02
  • @SvenW If PHPMyAdmin is so bad, what do you propose? My requirements are that it must be web-based, not slower than PHPMyAdmin (it's a bit slow already), and it should have as many or more features as PHPMyAdmin has.
    – Luc
    Jan 5, 2013 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .