BFA protected phpmyadmin

Question

I use a Ubuntu 16.04 Nginx server environment with phpmyadmin (PMA). All my ports are closed besides 22, 25, 80, 443, 9000 (for PHP-FPM).

A common criticism of the good software (PMA) as of 2018, is that it doesn't have good defense from Brute Force Attacks (BFAs). There are different common ways to cope with this and I admit I dislike all of them:

1. Changing the PMA path to something unintuitive and likely uncomfortable (instead of /var/www/html/phpmyadmin).
2. Using a permanent IP (what if you're traveling between countries)?
3. Login through a recognized VPN. What if you don't have a free time to seriously learn VPN basics in some era of your life?
4. Loging with some kind of authentication certificate. What if don't have one?
5. Using mod_security for Apache users. What if you don't use Apache?
6. Using a captcha. What if you login frequently? This might be a bit annoying.
7. Future PMA versions starting from V 4.8.0 are planned to include support for IPSs like Fail2ban, via uthentication logging.
8. Future PMA versions starting from V 4.8.0 are also planned to include 2factorAuthentication.

I found myself another way which is personal and comfortable (I don't recommend any company with customers to use this way in the form I'll describe below):

SSH tunneling through port 80 to port 80 via Putty/OpenSSH, and use PMA securely and temporarily for 2 hours in a tmux session (It is extremely unlikely that anyone could BFA PMA with a decent varied password in just 2 hours).

Each time I want to use PMA I run this code:

#!/bin/bash

find  ${drt}/ -iname '*phpmyadmin*' -exec rm -rf {} \;
wget -P ${drt}/ https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.zip
find  ${drt}/ -type f -iname '*phpmyadmin*.zip' -exec unzip {} \;
find  ${drt}/ -type d -iname 'phpmyadmin-*' -exec mv {} phpmyadmin \;

sleep 2h

find  ${drt}/ -iname '*phpmyadmin*' -exec rm -rf {} \;
tmux kill-session

I run it this way tmux new-session -d 'bash ~/pma.sh', or with a Bash alias pma.

Note: ${drt} stands for document root, which is in my case /var/www/html and defined in /etc/bash.bashrc.

I'd like to know what you think of the code I've written (especially, do you see any way to shorten it)?.

Answer 1

One potential security issue: what if ${drt} is not set before this is run? A safety check will be very useful.

As for your wider issue, rather than having to download it every time, would it not be just as effective to remove the permissions on the phpmyadmin directory? If you set it to 000, then nobody should be able to access it nor its contents.