在单个子域上使用SSL的Phpmyadmin

Question

I would like to access phpmyadmin on a unique subdomain. I've created a virtualhost, everything works fine but I use many subdomains and they all give me access to phpmyadmin.

I want that only one subdomain points to phpmyadmin.

https://static01.domain.com => point to phpmyadmin (and shouldn't)

https://pma.domain.com => point to phpmyadmin (OK, but I would like only this one)

Here is my virtualhost :

<VirtualHost *:80>
    ServerName static01.domain.com
    DocumentRoot /var/www/public_html/O2/..
</VirtualHost>
..
<VirtualHost *:443>
   ServerName pma.domain.com
   DocumentRoot /usr/share/phpmyadmin

   SSLEngine On
   SSLCertificateFile /etc/apache2/certificate/server.crt
   SSLCertificateKeyFile /etc/apache2/certificate/server.key
   SSLProxyEngine  on
</VirtualHost>

Any idea ?

Answer 1

In apache2.conf you will find a line at the bottom:

Include conf.d/

What this does is include ALL files in the /etc/apache2/conf.d/ directory.

So have a look in this folder and you will likely find a file named phpmyadmin.conf . You can simply delete it.

Answer 2

I found a solution, for those interested this thing did the trick :

<VirtualHost *:443>  (need to be 1st, for any subdomains)
    ServerName domain.com
    RedirectPermanent / "http://www.domain.com:80"

    SSLEngine On
    SSLCertificateFile /etc/apache2/certificate/server.crt
    SSLCertificateKeyFile /etc/apache2/certificate/server.key
    SSLProxyEngine on
</VirtualHost>

<VirtualHost *:443>
    ServerName pma.domain.com
    DocumentRoot /usr/share/phpmyadmin

    SSLEngine On
    SSLCertificateFile /etc/apache2/certificate/server.crt
    SSLCertificateKeyFile /etc/apache2/certificate/server.key
    SSLProxyEngine on
</VirtualHost>

Answer 3

You are going in the right direction, but I think you should add some extra security directives.

Below my current configuration, based on the original phpMyAdmin.conf that was created after the yum package installation in CentOS 7. For other systems paths could be different, or if you use a different Apache/PHP version, some commands can also change, but you should be able to find the replacement.

I'm commenting the original directives, and also some other directives that might be useful:

# phpMyAdmin - Web based MySQL browser written in php
# 
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

#Alias /phpMyAdmin /usr/share/phpMyAdmin
#Alias /phpmyadmin /usr/share/phpMyAdmin

<Directory /usr/share/phpMyAdmin/>
   AddDefaultCharset UTF-8

   #<IfModule mod_authz_core.c>
   #  # Apache 2.4
   #  <RequireAny>
   #    Require ip 127.0.0.1
   #    Require ip ::1
   #  </RequireAny>
   #</IfModule>
   #<IfModule !mod_authz_core.c>
   #  # Apache 2.2
   #  Order Deny,Allow
   #  Deny from All
   #  Allow from 127.0.0.1
   #  Allow from ::1
   #</IfModule>
</Directory>

<Directory /usr/share/phpMyAdmin/setup/>
   <IfModule mod_authz_core.c>
     # Apache 2.4
     <RequireAny>
       Require ip 127.0.0.1
       Require ip ::1
     </RequireAny>
   </IfModule>
   <IfModule !mod_authz_core.c>
     # Apache 2.2
     Order Deny,Allow
     Deny from All
     Allow from 127.0.0.1
     Allow from ::1
   </IfModule>
</Directory>

# These directories do not require access over HTTP - taken from the original
# phpMyAdmin upstream tarball
#
<Directory /usr/share/phpMyAdmin/libraries/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

<Directory /usr/share/phpMyAdmin/setup/lib/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

<Directory /usr/share/phpMyAdmin/setup/frames/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

# This configuration prevents mod_security at phpMyAdmin directories from
# filtering SQL etc.  This may break your mod_security implementation.
#
#<IfModule mod_security.c>
#    <Directory /usr/share/phpMyAdmin/>
#        SecRuleInheritance Off
#    </Directory>
#</IfModule>

<VirtualHost XXX.XXX.XX.XX:443>
  ServerName your.domain.com

  DocumentRoot /usr/share/phpMyAdmin

  <Directory /usr/share/phpMyAdmin>
    Options Indexes FollowSymLinks MultiViews
      AllowOverride all
        DirectoryIndex index.php
      Require all granted

    AddType application/x-httpd-php .php
    php_flag magic_quotes_gpc Off
    php_flag track_vars On
    php_flag register_globals Off
    php_admin_flag allow_url_fopen Off
    php_value include_path .
    php_admin_value upload_tmp_dir /var/lib/phpMyAdmin/tmp
    php_admin_value open_basedir /usr/share/phpMyAdmin:/etc/phpMyAdmin:/var/lib/phpMyAdmin:/usr/share/php/gettext:doc/html
  </Directory>

  <Directory /usr/share/phpMyAdmin/libraries>
    Order Deny,Allow
    Deny from All
    Allow from None
  </Directory>

  #ErrorLog ${APACHE_LOG_DIR}/error.log
  #LogLevel warn

  #CustomLog ${APACHE_LOG_DIR}/access.log combined

  SSLEngine on
  SSLCertificateFile /path/to/your/certificate.crt
  SSLCertificateKeyFile /path/to/your/key.key
  #SSLVerifyClient none
  #SSLOptions +StrictRequire
  SSLProtocol -all +TLSv1 +SSLv3
  SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM
  SSLProxyEngine off
  #<IfModule mime.c>
  # AddType application/x-509-ca-cert .crt
  # AddType application/x-pkcs7-crl .crl
  #</IfModule>

</VirtualHost>

This should give you a much more secure installation open to the public. If anyone has further suggestions I'm happy to hear.

Answer 4

You can use this command:

a2disconf phpmyadmin

to disable the phpmyadmin url.