Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a Debian server with PHP5, Apache 2.2.16 and PHPMyAdmin (I don't know how to check the version number), Logcheck and some other programs.
Today Logcheck begin to attach multiple lines like this, and I do not know how I can prevent them

Feb 12 15:08:03 mail suhosin[5538]: ALERT - tried to register forbidden variable '_SESSION[ConfigFile][Servers][*/foreach($_GET as $k=>$v)if($k==="eval")eval($v);/*][port]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')
Feb 12 15:08:03 mail suhosin[3131]: ALERT - tried to register forbidden variable '_SESSION[ConfigFile][Servers][*/foreach($_GET as $k=>$v)if($k==="eval")eval($v);/*][port]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')
Feb 12 15:08:04 mail suhosin[5548]: ALERT - tried to register forbidden variable '_SESSION[!bla]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')
Feb 12 15:08:04 mail suhosin[3130]: ALERT - tried to register forbidden variable '_SESSION[!bla]' through GET variables (attacker '64.34.176.50', file '/usr/share/phpmyadmin/index.php')

Should I block the IP using IPTables or how?
And if I am going to use IPTables, how should I insert the lines?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Block this using just IPtables will be a futile endeavor, as PHPMyAdmin is a very attractive target for attackers and you will get other attempts from other addresses.

You have the following options, sorted in order of reliability:

  1. Get rid of the unsecure pile of garbage that is PHPMyAdmin and remove it from your system.
  2. If that's not possible, limit access to it with one or more of the following methods from your Apache config (either the site config file or with an .htaccess in the PHPMyAdmin directory:
    • Limit access to a known network or even better only the localhost and use SSH port forwarding to access it.
    • Limit access to it with an SSL key pair. This is quite secure but not very easy to set up.
    • Use HTTP basic auth to limit access to PHPMyAdmins directory with an additional password.
  3. Use something like Fail2Ban that will dynamically block attackers IP addresses.

If I have someone who just needs PHPMyAdmin and can't be bothered to learn to use other tools, I usually set up a local installation of it on the user's machine and configure it to use MySQL via a SSH port forwarding and then make it easy for the user to establish the tunnel.

share|improve this answer
    
Is there a way to allow IPes in PHPMyAdmin without restarting Apache2 each time a new IP is added? –  The87Boy Feb 12 '12 at 16:51
    
That's what the .htaccess is for, but if you plan to modify the allowed IP addresses whenever your (dynamic?) IP address on the client side changes, I would strongly advise you to use SSH port forwarding instead and limit access to PHPMyAdmin to the localhost on the server side. –  SvW Feb 12 '12 at 16:54
    
I think that's the way to go then. Thanks for the answer :D I first edited /etc/apache2/conf.d/phpmyadmin.conf, but then I have to restart Apache2 each time, but if I created an .htaccess-file inside /usr/share/phpmyadmin/ I shouldn't restart the PHPMyAdmin each time –  The87Boy Feb 12 '12 at 17:02
    
@SvenW If PHPMyAdmin is so bad, what do you propose? My requirements are that it must be web-based, not slower than PHPMyAdmin (it's a bit slow already), and it should have as many or more features as PHPMyAdmin has. –  Luc Jan 5 '13 at 18:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.