-2

APACHE2/PHPMYADMIN question.

my ubuntu webserver was recently scanned by a web application inspection program where it checks for any vulnerability in my server.

the result i received was mostly medium-level vulnerabilities and management wanted me to quickly resolve the issue.

one of the issues is to use basic authentication over an https connection for this directory /phpmyadmin/setup

heading over to that link https://<ip>/phpmyadmin/setup, will prompt a javascript login page where it requires a username/password.

i didnt actually knew that there's such directory, mainly because i just install LAMP and leave, with very minimal configuration.

now im trying to understand how can i use HTTPS to access that link, any ideas on how i can properly execute this?

1
  • 1
    Are you asking how to enable https? Or are you experiencing a specific problem with your web server configuration? Take some time and analyze your situation, read our tips on writing good questions, and update this question to clarify what problem you are experiencing and what you've done to try to resolve it. Engage in rubber duck debugging if necessary.
    – voretaq7
    Feb 7, 2014 at 21:08

2 Answers 2

3

Your company needs to pay a consultant to come in and a) do a thorough check of your system, and b) teach you the basics of how to secure your LAMP site. Meanwhile, I suggest that you do

chmod -R 000 /path/to/wwwfiles/phpmyadmin/setup

This will make that page unaccessible to everyone, thus closing that particular security hole.

2

I don't really understand the panic with your management over using basic authentication when done over HTTPS, it seems a bit overzealous to flag that as an immediate problem. (See https://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https for a bit more discussion on the matter, yes I realize there are potential shortcomings but at least the password isn't going over cleartext here).

To add to Jenny D's good answer, the setup directory isn't needed if you do a manual configuration, isn't a means an attacker can use to exploit any known weaknesses, and isn't something users access anyway. It can be safely removed from the officially distributed phpMyAdmin files if you want by simple deleting that folder on disk or changing permissions to 000.

However, I also am unable to reproduce the situation you've described; in fact phpMyAdmin doesn't use any JavaScript for authentication prompts (there are four means of authenticating to phpMyAdmin; hard coding the username and password in the configuration file so that you're not prompted at all (auth_type config), an inline form for username and password (auth_type cookie), and asking your webserver to prompt you by means of http basic authentication, which actually may be what you mean but isn't JavaScript (auth_type http). You could try changing your auth_type to cookie if you don't like the http basic prompt, but I did a quick test here and the setup directory doesn't seem to be affected by the auth_type, so I am starting to suspect you've got an additional layer of security that's being provided by your webserver rather than phpMyAdmin itself.

3
  • I won't argue with you over that particular directory. The thing that gives me a slight case of panic is the admin of the server a) not knowing what is on it, b) not knowing how to enable/disable access without HTTPS, and c) "just install LAMP and leave". This is a recipe for disaster, regardless of the severity of this particular issue.
    – Jenny D
    Feb 7, 2014 at 16:03
  • Oh, absolutely, and I agree with you. And when I referred to panic, I didn't mean you, I meant with the OP's management, so I'll edit my answer to make that more clear. I hope I didn't take away or minimize anything about your answer, I was just trying to add some information about phpMyAdmin specifically.
    – ibennetch
    Feb 7, 2014 at 19:58
  • No worries - I also realised that my answer was maybe a bit harshly worded, so I took the chance to clarify a bit here.
    – Jenny D
    Feb 8, 2014 at 9:50

Not the answer you're looking for? Browse other questions tagged .