phpMyAdmin setup not password protected; getting hit a lot by hackers

Question

The phpMyAdmin (version 2.11.9.5) setup screen of my server is not password protected. I have noticed a lot of attempts at accessing the screen in my log files, especially from automated requests that ask for 50 or so different possible directory locations of the setup screen.

The issue is discussed here:server has phpMyAdmin setup but does not require a password to access

I have checked my own servers configuration files and they are already set as perscribed in that article. It seems the page is just a utility used to modify the configuration files and that it has no ability to either load or save such files.

Questions:

1: Is this a security problem? Is there a way to access my MySQL data with this screen accessible?

2: If it is a problem (or maybe even if it is not) how do I turn that screen off?

Answer 1

I would strongly recommend a .htaccess file in the root of the folder that phpMyAdmin is installed in:

AuthType Basic
AuthName "Protected Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

and then run:

htpasswd -c /path/to/.htpasswd myuser mypass

There are other good ways to do this, but this is relatively easy.

Answer 2

About your questions:

1: Is this a security problem? Is there a way to access my MySQL data with this screen accessible?

Depends of your phpmyadmin version. I have hacked by these stupids "blackhats.romanian.anti-sec" few days ago because I forgot that I had an phpmyadmin version in my server, that were very old and vulnerable (2.11.5). Anyway, I could find what they did and who they are (I am not going to say its name just to minimize its importance, I only say that I got its pictures and personal address in Constança, Romania. Currently he has 25 years old, bah, and ugly, hehe, he is a scriptkiddie only).

Basically they are fuc*ing spammers, and they put some ircbots in my server too. Thanks to the bots I could find them. They were using two irc servers in two diferents hosting companies to put all them. I detect around 800 bot-servers like mine in that irc servers, so I decide to inform its hosting companies in order to cancel its accounts (one have acts very fast and has cancelled its account few hours later my report, hehe, the other is still investigating, but I think they are not going to do anything -theplanet is too big to manage correctly this problems without full logs-).

Using two irc servers I guess they take cure of possible problems with hosting companies (when someone inform them as me) and in this manner they can still have control over that 800 bot-servers from the other server and I guess they will got other soon and change its bot-servers configuration easyly sending orders to those bots to have them again in two places in order to not lost control.

2: If it is a problem (or maybe even if it is not) how do I turn that screen off?

Well, I have renamed the phpmyadmin folder to other noncommon name, but also you can protect it with .htaccess, like it is explained above. Also you can safely delete that setup.php script or edit it and put a die(); at the beggining... That setup.php script is not util once you have well configured it.

They have make me lost a full day investigating who they are and how they come inside my server, but I am happy to see that the first hosting company has deleted its account and they have half-lost its spam bots control from them. I hope theplanet also acts asap in order to avoid its control over that 800 spam servers.

Will be great if someone could put them in jail, because they damages my work today, and maybe 800 admins more, by free. But I have no idea where to inform because he is in other country (Romania) and I its irc servers are in USA. Next time I will get a gun and a plane, and I will kill him to make justice, hehe.

Sorry for this long half-personal explanation, but I want to encourage you to inform to hosting companies asap you detect something similar in your servers to try to kill all spammers in the world, they smells a lot.

Regards, HappyAdmin

Answer 3

We had these attacks a lot where they try and guess 100 different paths, it was crashing our database so I put a spam-pot in place. Similar to Project Honey Pot but a more cut down version. It was just a PHP page that logged the hacking attempt to our PHP error log. Then in our http.conf file put the below code (over 100 different combinations that were used - I put these up separately in post on my blog so as not to flood this page) which redirects the various requests to the spam-pot page.

AliasMatch ^/.*PMA/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*PMA2005/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*PMA2006/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*pma/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*/administrator/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*database/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*database-admin/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*databaseadmin/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*databasemanager/(.*\.php)$ "/var/www/html/spam-pot/$1"
AliasMatch ^/.*databaseweb/(.*\.php)$ "/var/www/html/spam-pot/$1"
...