Securing phpmyadmin installation

April 1, 2013 3.8k views
studio
By:
studio
Hello all, I'm a complete noob but I can follow instructions quite well... :) I was following the article on how the install and secure the phpmyadmin installation on Ubuntu until I hit an error: When I run the command sudo htpasswd -c /home/myusername/passwd/.htpasswd username I get error "cannot create file /home/myusername/passwd/.htpasswd" I double checked the .htaccess file and the AuthUserFile matches the path above. In the .htaccess file what I have is: AuthUserFile /home/myusername/passwd/.htpasswd As far as I can see the paths are identical. I'd appreciate your help on this as I cannot figure this out. Thank you in advance, Goran
Log In to Comment
3 Answers
studio April 2, 2013
Solved it.
For some reason it would not let me put the .htpasswd file in /home/myusername/passwd/.htpasswd but it let me put it in /home/myusername/.htpasswd
Reply
tvw April 6, 2013
You should not use phpmyadmin on a production server. Phpmyadmin makes only sense when you have a shared hosting plan which does not allow you to login via ssh to access the database. On your own server, where you can login with ssh, there is no need at all to use and install phpmyadmin. Using phpmyadmin is a big security risk, since due to misconfiguration of your webserver your database and all user credidentials are wide open to any attacker. And attacks against phpmyadmin are on the top of the list of each hacker, who comes along your website.
Reply
tvw April 6, 2013
BTW: I hope you access/allow phpmyadmin only via https, otherwise securing it via a password (.htpasswd) is pointless.
Reply
Have another answer? Share your knowledge.