1

Trying to secure phpmyadmin, we already did the following:

  • Cookie Auth login

  • firewall off tcp port 3306.

  • running on non-standard port

Now we would like to implement https... but how could it work with phpmyadmin running already on a non-stardard port?

This is the apache config:

# PHP MY ADMIN
<VirtualHost *:$CUSTOMPORT>
    Alias /phpmyadmin /usr/share/phpmyadmin

    <Directory /usr/share/phpmyadmin>
        Options FollowSymLinks
        DirectoryIndex index.php

        <IfModule mod_php5.c>
            AddType application/x-httpd-php .php

            php_flag magic_quotes_gpc Off
            php_flag track_vars On
            php_flag register_globals Off
            php_value include_path .
        </IfModule>

    </Directory>

    # Disallow web access to directories that don't need it
    <Directory /usr/share/phpmyadmin/libraries>
        Order Deny,Allow
        Deny from All
    </Directory>

    <Directory /usr/share/phpmyadmin/setup/lib>
        Order Deny,Allow
        Deny from All
    </Directory>

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/phpmyadmin.log combined
</VirtualHost>

Edit:

I created a custom SSL certificate with apache itself, based on this link and then followed the tips given by James and I get this:

[Sun Nov 04 16:02:38 2012] [info] Init: Seeding PRNG with 656 bytes of entropy
[Sun Nov 04 16:02:38 2012] [error] Init: Unable to read server certificate from file /etc/apache2/ssl/pma.crt
[Sun Nov 04 16:02:38 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Nov 04 16:02:38 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Mon Nov 05 18:22:54 2012] [info] Init: Seeding PRNG with 656 bytes of entropy
[Mon Nov 05 18:22:54 2012] [error] Init: Unable to read server certificate from file /etc/apache2/ssl/pma.crt
[Mon Nov 05 18:22:54 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Nov 05 18:22:54 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

Edit:

File exists, key is there, it ends with '-' end these are the privileges:

drwxr-xr-x 2 root root 4096  4. Nov 14:45 .
drwxr-xr-x 8 root root 4096  4. Nov 14:30 ..
-rw-r--r-- 1 root root 1041  4. Nov 14:45 pma.crt
-rw-r--r-- 1 root root 1679  4. Nov 14:45 pma.key

3 Answers 3

4

phpMyAdmin is one of those packages that has kept me in business as an incident/forensic examiner. It has a terrible history of arbitrary code execution and authentication bypass. My general security recommendation is to uninstall it and use something like Workbench or learn how to manage mysqld directly.

If you do use it, then the steps you've taken are good ones. You definitely need to only present it over SSL, which will be configured on the underlying webserver. You also need to restrict access. With Apache httpd this will be done via htaccess. Close it off as tightly as you can. Your efforts will be rewarded.

3
  • Hi Scott...interesting. But do you think this is valid also for the latest stable release? Moreover, considering assigning a number indicating the security safety, how much would you assign to a phpmyadmin with all the mentioned steps (included SSL) and Workbench? I ask just to get a better idea about your point of view
    – elect
    Nov 5, 2012 at 17:32
  • 2
    @elect: The problem with phpMyAdmin isn't so much that it currently has these problems, is that they seem to crop up frequently. Sure, one will get patched, then another gets discovered. This is a fairly small software package, in the grand scheme of things. The frequency that vulnerabilities of these magnitudes come up indicate, to me, a more systemic problem w.r.t. code quality and testing. All the recommendations are just just attempts to mitigate a potentially fundamentally broken piece of software.
    – Scott Pack
    Nov 5, 2012 at 17:40
  • Hi Scott, I just wanted to ask you a last thing, when you mention Workbench do you mean to install it on the client and then connect to the server and access the db or something like pma, where you install it on the server and then you just browse and operate on the db through the browser?
    – elect
    Jan 30, 2013 at 21:16
3

Simply put all you need to do is configure the virtual host for SSL in the normal way.

SSLEngine on
SSLCertificateFile /path/to/crt
SSLCertificateKeyFile /parh/to/cry/key

Because the virtual host is configured to listen on a different port does not affect the way SSL will work but you do need to tell your browser that it is functioning on a different port. Eg:

https://www.example.com:3130/phpmyadmin

Update: Fixed typos.

2
  • Wait, let me write in the question
    – elect
    Nov 5, 2012 at 17:26
  • Unable to read server certificate from file /etc/apache2/ssl/pma.crt This could mean one of 4 things. 1) the file doesn't exist, 2) The file permissions are wrong (hint 755 for crt and 400 for key and owned by www-data user) 3) the file is empty 4) There is a surplus new line at the end of the file that should be removed. The last character should be a - Nov 5, 2012 at 17:35
2

If you must use phpMyAdmin (which you shouldn't if you really care about security, as covered by @ScottPack), you should consider restricting access to a private subnet and connect using a VPN tunnel to access it. I would never deploy phpMyAdmin on the public Internet if I were forced to.

1
  • I would go so far as to say "I would refuse to deploy phpMyAdmin on a public Internet-facing system, and it's an issue I would leave a job over." -- Ultimately as the SA you are going to be responsible (or at least held accountable) when machines get compromised. Refusing to install a known security hole (and/or forcing people to jump through hoops to get to it) is just good sense.
    – voretaq7
    Nov 9, 2012 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .