Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The phpMyAdmin (version 2.11.9.5) setup screen of my server is not password protected. I have noticed a lot of attempts at accessing the screen in my log files, especially from automated requests that ask for 50 or so different possible directory locations of the setup screen.

The issue is discussed here:server has phpMyAdmin setup but does not require a password to access

I have checked my own servers configuration files and they are already set as perscribed in that article. It seems the page is just a utility used to modify the configuration files and that it has no ability to either load or save such files.

Questions:

1: Is this a security problem? Is there a way to access my MySQL data with this screen accessible?

2: If it is a problem (or maybe even if it is not) how do I turn that screen off?

share|improve this question
1  
Is this the attack where first they "GET /w00tw00t.at.blackhats.romanian.anti-sec:)"? This made me laugh, as they basically announce themselves. Not sure if this is helpful but someone made a ModSecurity rule for this specific attack: linux.m2osw.com/zmeu-attack –  Cory J Aug 3 '10 at 23:37
    
Yes, it's not exactly that, but very close; starts with /w00tw00t.at. - Thanks a lot... I'll check it out... they are shockingly frequent –  aepryus Aug 4 '10 at 0:14
    
the exact string is: /w00tw00t.at.ISC.SANS.DFind:) –  aepryus Aug 4 '10 at 0:26
    
Hilarious stuff. Apparently the robot also often identifies itself with the User-Agent strings "PMAFind" or "pmafind". You might be able to use this module: httpd.apache.org/docs/1.3/mod/mod_setenvif.html to ban these user-agents. –  Cory J Aug 4 '10 at 1:05
add comment

3 Answers

I would strongly recommend a .htaccess file in the root of the folder that phpMyAdmin is installed in:

AuthType Basic
AuthName "Protected Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

and then run:

htpasswd -c /path/to/.htpasswd myuser mypass

There are other good ways to do this, but this is relatively easy.

share|improve this answer
    
I tried this, but it didn't seem to have any effect; no idea what I did wrong. I did find that simply deleting the setup.php file was quite effective however. ;-p –  aepryus Aug 4 '10 at 0:17
    
BTW, after a little research, I discovered my server is set to: AllowOverride None. So, it ignores .htaccess files at the moment, which explains the lack of effect. –  aepryus Aug 4 '10 at 11:13
add comment

About your questions:

1: Is this a security problem? Is there a way to access my MySQL data with this screen accessible?

Depends of your phpmyadmin version. I have hacked by these stupids "blackhats.romanian.anti-sec" few days ago because I forgot that I had an phpmyadmin version in my server, that were very old and vulnerable (2.11.5). Anyway, I could find what they did and who they are (I am not going to say its name just to minimize its importance, I only say that I got its pictures and personal address in Constança, Romania. Currently he has 25 years old, bah, and ugly, hehe, he is a scriptkiddie only).

Basically they are fuc*ing spammers, and they put some ircbots in my server too. Thanks to the bots I could find them. They were using two irc servers in two diferents hosting companies to put all them. I detect around 800 bot-servers like mine in that irc servers, so I decide to inform its hosting companies in order to cancel its accounts (one have acts very fast and has cancelled its account few hours later my report, hehe, the other is still investigating, but I think they are not going to do anything -theplanet is too big to manage correctly this problems without full logs-).

Using two irc servers I guess they take cure of possible problems with hosting companies (when someone inform them as me) and in this manner they can still have control over that 800 bot-servers from the other server and I guess they will got other soon and change its bot-servers configuration easyly sending orders to those bots to have them again in two places in order to not lost control.

2: If it is a problem (or maybe even if it is not) how do I turn that screen off?

Well, I have renamed the phpmyadmin folder to other noncommon name, but also you can protect it with .htaccess, like it is explained above. Also you can safely delete that setup.php script or edit it and put a die(); at the beggining... That setup.php script is not util once you have well configured it.

They have make me lost a full day investigating who they are and how they come inside my server, but I am happy to see that the first hosting company has deleted its account and they have half-lost its spam bots control from them. I hope theplanet also acts asap in order to avoid its control over that 800 spam servers.

Will be great if someone could put them in jail, because they damages my work today, and maybe 800 admins more, by free. But I have no idea where to inform because he is in other country (Romania) and I its irc servers are in USA. Next time I will get a gun and a plane, and I will kill him to make justice, hehe.

Sorry for this long half-personal explanation, but I want to encourage you to inform to hosting companies asap you detect something similar in your servers to try to kill all spammers in the world, they smells a lot.

Regards, HappyAdmin

share|improve this answer
    
Ha, awesome! Unfortunately, I'm a software developer and don't have nearly your server admin skills. But, if your work stops these attacks on my server, that'll be awesome. I'm fairly certain, that they were unable to breach my server through the phpMyAdmin screen and I have since deleted the the setup.php file. Now I just need to hope someone quashes the other 15 bots trying to hack my servers. I think 80% of my server load is taken up by people trying to hack it. –  aepryus Aug 24 '10 at 2:22
add comment

We had these attacks a lot where they try and guess 100 different paths, it was crashing our database so I put a spam-pot in place. Similar to Project Honey Pot but a more cut down version. It was just a PHP page that logged the hacking attempt to our PHP error log. Then in our http.conf file put the below code (over 100 different combinations that were used - I put these up separately in post on my blog so as not to flood this page) which redirects the various requests to the spam-pot page.

AliasMatch ^/.*PMA/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*PMA2005/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*PMA2006/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*pma/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*/administrator/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*database/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*database-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*databaseadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*databasemanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*databaseweb/(.*\.php)$ "/var/www/html/spam-pot/$1"
...
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.