Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is there a way to disable phpMyAdmin from being accessed on my server while still keeping the install in case it is needed later?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

you can create a file called .htaccess and place it in the directory with the phpMyAdmin installation with the following contents;

 deny from all

If you have a VirtualHost configured you will need to enable this like so;

<VirtualHost *:80>
DocumentRoot /var/www/html
ServerName www.mydomain.com
....
<Directory /var/www/html>
AllowOverride All            
</Directory>
...
</VirtualHost>

If you using the default apache httpd.conf i.e. your files are in /var/www/html then you need to change the /etc/httpd/conf/httpd.conf file like so, and service httpd restart change;

<Directory "/var/www/html">
...
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
#   Options FileInfo AuthConfig Limit
#
AllowOverride None

to this;

<Directory "/var/www/html">
...
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
#   Options FileInfo AuthConfig Limit
#
AllowOverride All             <------change this

As a further security suggestion. I would generally recommend restricting access to the phpMyAdmin installation folder during production and development usage, simply because phpMyAdmin is easy to leave open, and is popular with bots for automated exploitation by brute force etc. You can just allow your own IP (if you have a known static IP like so;)

Order Deny,Allow
Deny from all
Allow from 123.123.123.123
share|improve this answer
    
I tried this and does not seem to work –  arrowill12 May 14 '12 at 4:34
    
ah, i was just adding a pointer about enabling the Deny rules in httpd.conf basically you need to change AllowOverride None to AllowOverride All in /etc/httpd/conf/httpd.conf –  Tom H May 14 '12 at 4:39
    
I did this exactly using the "deny from all" but still no joy is this all that needs to be in the file? –  arrowill12 May 14 '12 at 4:50
    
If you have <VirtualHost *:80> configured, should should put AllowOverride All in there –  Tom H May 14 '12 at 4:55
1  
oops. my bad. In the VirtualHost, set it like this; <Directory /var/www/html> AllowOverride All </Directory> –  Tom H May 14 '12 at 5:05
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.