3

OK, so I have several sites on a vps with ssl certificates. I have mod security setup as well as tripwire. My question then relates to phpmyadmin security. If my IP is 123.123.123.123 I can access phpmyadmin using 123.123.123.123/mypmyadmin-IHaveChangedThisURL.

And even though I changed the phpmyadmin url, phpmyadmin is still accessible if you can find the url.

I have added a blank html file to the root directory and so no directory index is given using the vps hostname or vps IP.

Is there anything else I can do to protect the IP use and attempts to get to phpmyadmin etc?

Any guidance appreciated. Thanks.

3

Several things could be done. I will explain my ideas and the way how they could be implemented within Apache2.


1. Use HTTPS connection to protect your data from sniffing

  • First enable SSL module if it is not enabled: sudo a2enmod ssl.

  • Оpen port 443 (HTTPS) into the firewall. You should use your custom port here.

  • Follow this manual and enable a free certificate from Let's Encrypt.

  • Check this answer and disable Weak Ciphers.

  • Then you can force all users to use HTTPS.


2. Change the URI of PhpMyAdmin

To change the URI, within the default configuration, you should edit /etc/phpmyadmin/apache.conf and change the first part (/phpmyadmin) of this directive:

Alias /phpmyadmin /usr/share/phpmyadmin

Restart Apache and you will be able to access PhpMyAdmin through the new URI.


3. Run PhpMyAdmin on different port

Here is a step-by-step manual: How to run PhpMyAdmin on different port. Don't forget to open this port into the Firewall.


4. Access PhpMyAdmin only locally through SSH tunnel

Run PhpMyAdmin on different port. Let's assume it is port 99. Close this port into the Firewall. Then establish SSH connection by a command similar as:

ssh -fTN -R 99:localhost:99 <user>@<domain>or<ip>
  • This command will create ssh tunnel, where the remote -R port 99 is forwarded to the local port 99 on the localhost (127.0.0.1).
  • The options -fTN will push the connection in to the background.

Then PhpMyAdmin should be accessible via the web browser of your local machine on the URL http://localhost:99/. More ideas could be find here:


5. Protect PhpMyAdmin URI path via Password authentication

More details could be found in this Apache's manual: Authentication and Authorization. The package apache2-utils must be installed. In short the steps are:

  • Create folder outside of /var/www, where the password file will be kept. Then generate password file. Let's assume the name of this new folder is /var/www-auth:

    $ sudo mkdir /var/www-auth
    $ cd /var/www-auth
    $ sudo htpasswd -c .htpasswd.phpmyadmin <user>
    New Password: *********
    Re-Type New Password: *********
    Adding Password For User <user>
    
    • .htpasswd.phpmyadmin is the name of the file in which the password will be stored.
    • user is the login name that will be used.
    • ********* is the password :)
    • -c means create new file. If this option is omitted htpasswd command will try to add the new login name to an existing .htpasswd.file.
  • Modify PhpMyAdmin authentication type, through edit /etc/phpmyadmin/apache.conf in this way (or create .htaccess file):

        <Directory /usr/share/phpmyadmin>
        .....
            <IfModule mod_authz_core.c>
                <IfModule mod_authn_file.c>
                    AuthType Basic
                    AuthName "The name of the authentication form - type some user and password hints"
                    AuthUserFile /var/www-auth/.htpasswd.phpmyadmin
                </IfModule>
                Require valid-user
            </IfModule>
        .....
        </Directory>
    
  • Enable the modules and restart Apache2 to apply the new configuration:

        sudo a2enmod authz_core authz_user authn_file
        sudo systemctl restart apache2.service
    
  • Now to access PhpMyAdmin's URI you must provide the login name user and its password.


6. Protect PhpMyAdmin URI path via Two Factor Authentication (2FA):

  • Follow steps 1 and 3 from this manual to generate .google_authenticator file, located in your $HOME directory. In step 4 is described how to generate authentication codes.

  • Create a new directory under /var/www-auth. Let's assume the name of this new folder is google_authenticator:

    sudo mkdir -p /var/www-auth/google_authenticator
    
  • Copy the file $HOME/.google_authenticator into that directory and change its permissions (it must be readable for www-data):

    sudo cp $HOME/.google_authenticator /var/www-auth/google_authenticator/user
    sudo chown www-data:www-data /var/www-auth/google_authenticator/user
    

    Please note that the file name determines the login name! The file name will be used as username while logging-in to your secure website.

  • Modify the new file by adding the directive " PASSWORD=qwerty, where qwerty is the new login password.

    E3CY3TNSNBXXXXXX
    " RESETTING_TIME_SKEW ...
    " RATE_LIMIT 3 30 ...
    " WINDOW_SIZE 17
    " DISALLOW_REUSE 48885555 ...
    " TOTP_AUTH
    " PASSWORD=qwerty
    4567...
    
  • Install mod_authn_google for Apache2. Unfortunately I this module is unavailable within Ubuntu's repository, but we can get it from this repository. The steps are: (1) go to your Downloads, (2) download the package dba-apa24-mod_authn_google-r22... .rpm, (3) extract mod_authn_google.so, (4) place the file in /usr/lib/apache2/modules/, (5) grant appropriate permissions, (6) Create module load file:

    cd $HOME/Downloads
    wget http://download.opensuse.org/repositories/home:/csbuild:/DBA/RedHat_RHEL-7/x86_64/dba-apa24-mod_authn_google-r22-1.1.x86_64.rpm
    
    rpm2cpio dba-apa24-mod_authn_google-r22-1.1.x86_64.rpm | cpio -iv --to-stdout ./DBA/apache24/WWW/2.4.x/modules/mod_authn_google-r22.so > mod_authn_google.so
    
    sudo mv mod_authn_google.so /usr/lib/apache2/modules/
    sudo chown root:root /usr/lib/apache2/modules/mod_authn_google.so
    sudo chmod g-w /usr/lib/apache2/modules/mod_authn_google.so
    
    echo "LoadModule authn_google_module /usr/lib/apache2/modules/mod_authn_google.so" | sudo tee /etc/apache2/mods-available/authn_google.load
    
    sudo a2enmod authn_google
    
  • Modify PhpMyAdmin authentication type, through edit /etc/phpmyadmin/apache.conf in this way (or create .htaccess file):

        <Directory /usr/share/phpmyadmin>
        .....
            <IfModule mod_authz_core.c>
                <IfModule mod_authn_google.c>
                    AuthType Basic
                    AuthName "The name of the authentication form - type some user and password hints"
                    AuthBasicProvider "google_authenticator"
                    GoogleAuthUserPath /var/www-auth/google_authenticator
                    GoogleAuthCookieLife 3600
                    GoogleAuthEntryWindow 2
                </IfModule>
                Require valid-user
            </IfModule>
        .....
        </Directory>
    
  • Enable the modules and restart Apache2 to apply the new configuration:

        sudo a2enmod authz_core authz_user authn_google
        sudo systemctl restart apache2.service
    
  • Now to access PhpMyAdmin's URI you must provide the login name user, its password and 6 digit token code:

    enter image description here


7. Use ModSecurity for Apache

With ModSecurity you can add more flexible restrictions to the PhpMyAdmin's URI. In this answer, under the section "ModSecurity Rules > SAS > Iptables", I've described in short how we can create custom rules for ModSecurity.

  • 2
    If extra paranoid (in this instance it would be very good) i would actually suggest a virtualhost dedicated to serving phpmyadmin to localhost only, then using ssh tunnel and browser proxy - so phpmyadmin is only available if ssh access is also achieved... – taifwa Jul 24 '17 at 17:22
  • 1
    #pa4080 awesome. Thats gonna keep me busy fro a while and may require other answers but I think I get the most of that. exept maybe ssl. I have lets encrypt certificates on all of the domains and so dont know hif I can apply one using an IP? Not sure about that but I will get started on this tomorrow. Thanks again for the awesome response. Much appreciated. – Hawk007 Jul 24 '17 at 19:54
  • @Hawk007 I'm happy to help! You cannot apply SSL/TLS certificate using an IP, but by the default configuration PhpMyAdmin must be accessible via https://each-of-your.domains/phpmyadmin-uri. I intentionally wrote thath option, because you had said, you using SSL, but access PhpMyAdmin through the server's IP address. – pa4080 Jul 24 '17 at 21:34
  • 1
    The main source of security should come from your strong password and securing data in transit via TLS. Anything else is just security through obscurity and can be easily circumvented. – Eiver Feb 21 '18 at 12:57
  • @Eiver, I've reordered the options. – pa4080 Feb 23 '18 at 8:57

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.