1
\$\begingroup\$

I use a Ubuntu 16.04 Nginx server environment with phpmyadmin (PMA). All my ports are closed besides 22, 25, 80, 443, 9000 (for PHP-FPM).

A common criticism of the good software (PMA) as of 2018, is that it doesn't have good defense from Brute Force Attacks (BFAs). There are different common ways to cope with this and I admit I dislike all of them:

  1. Changing the PMA path to something unintuitive and likely uncomfortable (instead of /var/www/html/phpmyadmin).
  2. Using a permanent IP (what if you're traveling between countries)?
  3. Login through a recognized VPN. What if you don't have a free time to seriously learn VPN basics in some era of your life?
  4. Loging with some kind of authentication certificate. What if don't have one?
  5. Using mod_security for Apache users. What if you don't use Apache?
  6. Using a captcha. What if you login frequently? This might be a bit annoying.
  7. Future PMA versions starting from V 4.8.0 are planned to include support for IPSs like Fail2ban, via uthentication logging.
  8. Future PMA versions starting from V 4.8.0 are also planned to include 2factorAuthentication.

I found myself another way which is personal and comfortable (I don't recommend any company with customers to use this way in the form I'll describe below):

SSH tunneling through port 80 to port 80 via Putty/OpenSSH, and use PMA securely and temporarily for 2 hours in a tmux session (It is extremely unlikely that anyone could BFA PMA with a decent varied password in just 2 hours).

Each time I want to use PMA I run this code:

#!/bin/bash

find  ${drt}/ -iname '*phpmyadmin*' -exec rm -rf {} \;
wget -P ${drt}/ https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.zip
find  ${drt}/ -type f -iname '*phpmyadmin*.zip' -exec unzip {} \;
find  ${drt}/ -type d -iname 'phpmyadmin-*' -exec mv {} phpmyadmin \;

sleep 2h

find  ${drt}/ -iname '*phpmyadmin*' -exec rm -rf {} \;
tmux kill-session

I run it this way tmux new-session -d 'bash ~/pma.sh', or with a Bash alias pma.

Note: ${drt} stands for document root, which is in my case /var/www/html and defined in /etc/bash.bashrc.

I'd like to know what you think of the code I've written (especially, do you see any way to shorten it)?.

\$\endgroup\$
  • \$\begingroup\$ To make sure I'm reading this right: you're basically uninstalling and reinstalling phpmyadmin every two hours? \$\endgroup\$ – Joe C Jan 14 '18 at 10:42
  • \$\begingroup\$ No, I use it for 2 hours each time I need (can happen once in 2-3 months or even once in 6 months). \$\endgroup\$ – Arcticooling Jan 14 '18 at 10:46
2
+50
\$\begingroup\$

One potential security issue: what if ${drt} is not set before this is run? A safety check will be very useful.

As for your wider issue, rather than having to download it every time, would it not be just as effective to remove the permissions on the phpmyadmin directory? If you set it to 000, then nobody should be able to access it nor its contents.

\$\endgroup\$
  • \$\begingroup\$ Thanks! Sorry for not mentioning, I declared ${drt} inside /etc/bash.bashrc (I shouldn't worry about some other user conflicting because this is a personal system I enter usually only from my own computers). Regarding permissions, you're probably right; This would save the script and will let me download it and install it just once as with apt-get install phpmyadmin. I do wonder, however, how to make sure permissions are changed the moment I finished using it and then, when I want I change them back, so even if I pick the good method you mention, I need to automate permission handling. \$\endgroup\$ – Arcticooling Jan 14 '18 at 11:24
  • \$\begingroup\$ Something good in redownloading and reinstalling instead permission change is making sure I always use the most updated version. \$\endgroup\$ – Arcticooling Jan 14 '18 at 11:50
  • \$\begingroup\$ If you consider PMA unsecure I'm not sure a time window approach solves that for you. Sure, it's better, but a crawler looking for PMA could find it near the beginning of your window and have hours of brute force access. If you access via a PC I'd consider some type of SSH tunnel from your laptop to the Ubuntu server while running PMA itself on an internal/private IP address. \$\endgroup\$ – Max Haaksman Jan 17 '18 at 13:06
  • \$\begingroup\$ Max, thanks. I mentioned I used an SSH tunnel as well as a time window in the question. \$\endgroup\$ – Arcticooling Jan 18 '18 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.