2

(This question is related to but different from Would you install phpmyadmin on a production web server?)

I want to use PhpMyAdmin to access my production database. I'd rather not have it installed on the production server. Would it be reasonable/safe to run it on a different server, but have it access my production database over the Internet?

Community
  • 1
julien_c
  • 155
  • 1
  • 5

4 Answers4

1

I have a dev server in house that I run phpmyadmin on and then have ssh tunnels from a random high ports on the dev server to port 3306 on each production server. I then point phpmyadmin at the local high number port.

autossh -C -M 0 -f -N -L 7650:localhost:3306 pmauser@www.example.com

This is myphpmyadmin config for each host. You can duplicate this as many times as you need changing the host and port. When you go to the phpmyadmin page you will have a drop down list that lets you select which host you want to connect to. Just make sure each one is in your hosts file and points at localhost. 

/*
MySite
 */

$i++; $cfg['Servers'][$i]['auth_type'] = 'cookie'; $cfg['Servers'][$i]['host'] = 'MySite'; $cfg['Servers'][$i]['port'] = '7650'; $cfg['Servers'][$i]['connect_type'] = 'tcp'; $cfg['Servers'][$i]['compress'] = false; $cfg['Servers'][$i]['extension'] = 'mysql'; $cfg['Servers'][$i]['AllowNoPassword'] = false; $cfg['Servers'][$i]['bs_garbage_threshold'] = 50; $cfg['Servers'][$i]['bs_repository_threshold'] = '32M'; $cfg['Servers'][$i]['bs_temp_blob_timeout'] = 600; $cfg['Servers'][$i]['bs_temp_log_threshold'] = '32M';

digitaladdictions
  • 1,505
  • 1
  • 12
  • 30
  • I ended up doing just that - Running PhpMyAdmin on the database server was actually not even an option b/c I want to be able to deploy to Amazon RDS later. Thanks ! – julien_c Nov 08 '11 at 09:53
1

If you're accessing the production server via the internet, I would recommend minimizing the number of open ports. It goes without saying, the less services exposed to the internet, the less likely you are to have a security vulnerability.

That being said, I would recommend the following:

  1. If you already expose the mySQL ports to the internet, use phpMyAdmin remotely. If you don't, then you shouldn't risk allowing external connections to the database.
  2. Host phpMyAdmin directly on the production server but use a URL that isn't "typical". Bots scan for common locations such as /phpmyadmin/.
  3. If you expose SSH (which I imagine you do), expose phpmyadmin only on the localhost of the production server and tunnel your web traffic to the server over an SSH connection. You can open a connection similar to the following and then point your browser at the "localhost:2000" socks proxy.
ssh -D 2000 user@production-server
emills
  • 774
  • 1
  • 4
  • 15
0

Here's my preference:

1) disallow connections to mysql from outside your network 2) Run phpmyadmin from a secure server...https:// 3) Keep the mysql and phpmyadmin on separate servers to keep the vulnerability low on any one server 4) Do not expose SSH outside your network. If you need to access SSH from outside, VPN into your network first.

peg_leg
  • 93
  • 1
  • 1
  • 7
0

You can simply install phpmyadmin on the production server, but several things can be done to improve the security of your system:

1- Run apache on non default port.

2- Access the web pages using https. A self-signed certificate should be sufficient.

3- Use the appropriate allow/deny rules in apache to allow only the trusted ips.

4- Change the default http url from phpmyadmin to something not easily guessable.

5- Use strong passwords.

Khaled
  • 36,533
  • 8
  • 72
  • 99