0

I want users to be able to access phpMyAdmin from any computer. There are multiple users and I want to require login. It would definitely be OK to have remote access only. (All I would need do to use it locally is to use the remote address.) Remote access is required.

I've set up an Apache 2.4.23 server with PHP 7.0.13 and 4.6.5.2 phpMyAdmin (XAMPP). I have set-up multiple accounts access to MySQL and tested each individual could login and logout when on localhost (and also auto logged out after a time limit on non-use). When I shifted to accessing phpMyAdmin remotely, phpMyAdmin automatically logs into root account and cannot log out. The button for logout is there, but the description is "clear session data" and that's all it does.

I've been searching for answers for days now, and can guarantee that changing the auth_type to config or http doesn't fix it. None of the other solutions I've found have had any effect.

UPDATE: I set the password for root and pma and it's working properly on localhost. Remote access throws an access denied error.

Here's my config.inc for phpMyAdmin (I've tested many variations on the upper section .. auth_type etc):

    <?php
/*
 * This is needed for cookie based authentication to encrypt password in
 * cookie
 */
$cfg['blowfish_secret'] = 'xampp'; /* YOU SHOULD CHANGE THIS FOR A MORE SECURE COOKIE AUTH! */

/*
 * Servers configuration
 */
$i = 0;

/*
 * First server
 */
$i++;

/* Authentication type and info */
$cfg['Servers'][$i]['auth_type'] = 'config';
$cfg['Servers'][$i]['user'] = 'root';
$cfg['Servers'][$i]['password'] = '';
$cfg['Servers'][$i]['extension'] = 'mysqli';
$cfg['Servers'][$i]['AllowNoPassword'] = false;
$cfg['Lang'] = '';

/* Bind to the localhost ipv4 address and tcp */
$cfg['Servers'][$i]['host'] = '127.0.0.1';
$cfg['Servers'][$i]['connect_type'] = 'tcp';

/* User for advanced features */
$cfg['Servers'][$i]['controluser'] = 'pma';
$cfg['Servers'][$i]['controlpass'] = '';

/* Advanced phpMyAdmin features */
$cfg['Servers'][$i]['pmadb'] = 'phpmyadmin';
$cfg['Servers'][$i]['bookmarktable'] = 'pma__bookmark';
$cfg['Servers'][$i]['relation'] = 'pma__relation';
$cfg['Servers'][$i]['table_info'] = 'pma__table_info';
$cfg['Servers'][$i]['table_coords'] = 'pma__table_coords';
$cfg['Servers'][$i]['pdf_pages'] = 'pma__pdf_pages';
$cfg['Servers'][$i]['column_info'] = 'pma__column_info';
$cfg['Servers'][$i]['history'] = 'pma__history';
$cfg['Servers'][$i]['designer_coords'] = 'pma__designer_coords';
$cfg['Servers'][$i]['tracking'] = 'pma__tracking';
$cfg['Servers'][$i]['userconfig'] = 'pma__userconfig';
$cfg['Servers'][$i]['recent'] = 'pma__recent';
$cfg['Servers'][$i]['table_uiprefs'] = 'pma__table_uiprefs';
$cfg['Servers'][$i]['users'] = 'pma__users';
$cfg['Servers'][$i]['usergroups'] = 'pma__usergroups';
$cfg['Servers'][$i]['navigationhiding'] = 'pma__navigationhiding';
$cfg['Servers'][$i]['savedsearches'] = 'pma__savedsearches';
$cfg['Servers'][$i]['central_columns'] = 'pma__central_columns';
$cfg['Servers'][$i]['designer_settings'] = 'pma__designer_settings';
$cfg['Servers'][$i]['export_templates'] = 'pma__export_templates';
$cfg['Servers'][$i]['favorite'] = 'pma__favorite';

/*
 * End of servers configuration
 */

?>
  • Try to clear cookies on client's browser. – Mikhail Khirgiy Feb 3 '17 at 15:25
  • I've done that too. Didn't do anything. As I understand it, it wouldn't solve the problem anyway. With additional steps, it merely forces a single logout but you're back in the same spot once you log in again. – Roger F. Gay Feb 3 '17 at 15:31
  • Then change $cfg['Servers'][$i]['auth_type'] to cookie. – Mikhail Khirgiy Feb 3 '17 at 15:52
  • Pardon me. I didn't say that quite right in my question. I've tried all three. – Roger F. Gay Feb 3 '17 at 17:27
  • Common sense isn't often the best thing to try to apply in these cases (it's just imagining how one would like things to be). But it seems like cookie and config is begging for automatic login, with the information in either a cookie or config file. I don't want auto-login at all. The goal is to force login in every case. – Roger F. Gay Feb 3 '17 at 17:34
1

auth_type config suggests that the username and password configuration would be used by the configuration file, in your case

$cfg['Servers'][$i]['user'] = 'root';
$cfg['Servers'][$i]['password'] = '';

To change this behavior you should set auth_type to cookie clear your cookies, and try again.

If you want to access phpMyAdmin from localhost, with "root" without entering credentials , as your configuration suggests, but you want remotely to force users login, you could do a simple hack of,

$ip = $_SERVER['REMOTE_ADDR'];
if ( ! filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) )
{
    $cfg['Servers'][$i]['auth_type'] = 'config';
}
else {
    $cfg['Servers'][$i]['auth_type'] = 'cookie';
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.