Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently I get the latest phpMyAdmin unzip and load into my www folder and just run it. Recently there was an attack via phpMyAdmin. So what is the correct method I should install to avoid this type of vulnerable attack ony my server in future? My os is centos and the attack was due to this PhpMyAdmin vulnerability CVE-2011-2505 (http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2505)

share|improve this question
    
Needs more detail, what OS (distribution), what was the attack, how did it succeed, how have you configured phpMyAdmin once installed, etc. –  EightBitTony May 11 '12 at 16:58
    
I have provided my os and also the cause of the vulnerability too. I just copy the whol phpMyAdmin into the www folder and I did not protect it further so what should I do now? –  user111196 May 11 '12 at 18:01
add comment

closed as not constructive by EightBitTony, gWaldo, mdpc, voretaq7 Oct 25 '12 at 18:03

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 3 down vote accepted

Beside the points @rackandboneman mentioned, you should not deploy phpMyAdmin on a well known or common location (e.g. http://www.example.com/phpMyAdmin/) but ideally on a seperate vhost (e.g. https://admin.example.com/phpmyadmin/) where the whole root is protected by Apache Authentication (as an addition to the MySQL authentication done by phpMyAdmin).

Furthermore, you should restrict the login of your application users to only the required databases/tables.

share|improve this answer
    
Ideally you would not have phpmyadmin in the URL at all. Most scans I've seen on my servers scan for both properly capitalized default path and the all lower case version. A subdomain isn't really going to help you much unless its not listed anywhere a bot can scrape. –  Kyle May 11 '12 at 17:14
    
If the whole subdomain is protected by proper authentication (NOT the database authentication) no bot can crawl this domain. Even if it is known. –  Johann May 11 '12 at 17:24
    
@Johann so how to protect with proper authentication then? Any help please? So what should be my first step now? How install phpMyAdmin the right way? –  user111196 May 11 '12 at 17:58
add comment

Also here: set up http auth, probably via ssl, in addition to any login mechanism phpmyadmin provides. So a user that is not authenticated just CAN not mess with anything unless he can break the httpd itself.

share|improve this answer
    
How to set this http auth? Any tips on this. I first need to build a .htaccess folder on my www is it?If I need it to be https how to configure it? –  user111196 May 11 '12 at 17:57
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.