Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our site is going live soon and I am thinking about security. We have a typical layout of nginx, apache and mysql at back. Ideally the only machines exposed to the net would be the nginx servers but during development we have been using phpmyadmin installed locally on dev machines and then using Putty to SSH tunnel to the backend mysql machines. That means the myslq machines need to be exposed to the net on at least port 22.

So the question is, is it better to restrict IP access to mysql linux instances to the web servers and install phpmyadmin on one of the web servers. I have heard that phpmyadmin is not secure so it is best kept off production machines, hence dev env having it installed on dev machines.

I suppose if we keep on running it locally and use Putty then we only need to expose port 22 to the net. Is that a lesser risk?

share|improve this question
add comment

2 Answers

Hide phpMyAdmin behind cPanel local to the server it's administering. Every time I turn around, phpMyAdmin is always needing an update to patch yet another vulnerability. It shouldn't really be run as an internet facing application. cPanel manages its security for it to lessen the heartburn.

share|improve this answer
    
I am using Rackspace Cloud Linux Hardy instances. cPanel looks like it is a hosting company tool, is it suitable to install on a dedicated virtual server at rackspace and to use that to manage my other instances? If so how does it shield phpmyadmin from the outside world? –  Rich Sep 18 '11 at 4:07
add comment

I would prefer to keep port 22 IP restricted to only known office IPs and require complex key based authentication, then install phpmyadmin on your webserver.

share|improve this answer
    
Problem with known office IPs is that we might want to maintain on the road using myfi or similar. Are you really happy to have phpmyadmin sitting there open to the world? I suppose I could put it on an admin web server and only allow access from fixed IPs but then still got same problem of access via myfi. –  Rich Sep 18 '11 at 0:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.