Section 18: phpMyAdmin Installation & Security Configuration

⚠️ Security Warning

phpMyAdmin can be a significant security risk if not properly configured. This guide covers not only installation but also critical security hardening measures to protect your server. Never install phpMyAdmin without implementing all security measures outlined in this guide.

📋 Overview

This section covers several important miscellaneous topics for server administration:

phpMyAdmin Installation & Configuration
Security Hardening (Multi-layer authentication)
Nginx Configuration Optimization
Log Rotation Setup

💡 Why phpMyAdmin?

While desktop clients with SSH tunnels are more secure, many users prefer phpMyAdmin for its familiar interface and ease of use. This guide ensures that if you choose to use phpMyAdmin, it's implemented securely with multiple layers of protection.

🔐 Security Architecture

Three-Layer Security Model

Layer 1
Random URL

→

Layer 2
IP Restriction

→

Layer 3
HTTP Auth

→

Final
phpMyAdmin Login

🛡️ Layer 1: Random URL Path

Using a randomly generated string in the URL makes it extremely difficult for attackers to even locate your phpMyAdmin installation.

🛡️ Layer 2: IP Address Restriction

Only specified IP addresses can access phpMyAdmin. Unauthorized IPs receive a 403 Forbidden error immediately.

🛡️ Layer 3: HTTP Basic Authentication

An additional username/password prompt before reaching phpMyAdmin login screen.

🚀 Step-by-Step Installation & Configuration

1Clean Up Default Nginx Configuration

Before installing phpMyAdmin, we need to clean up the default Nginx server block by removing unnecessary comments and directives.

Navigate to Nginx sites directory:

cd /etc/nginx/sites-available/

Edit the default file:

sudo nano default

Remove all comments and the PHP location block. Your cleaned configuration should look like this:

server { listen 80 default_server; root /var/www/html; index index.php; server_name _; location / { try_files $uri $uri/ =404; return 444; } }

Note: The return 444; directive ensures that requests to your server's IP address receive no response, enhancing security.

2Generate Random Strings

Generate three random 12-character strings. We'll use one for the phpMyAdmin URL path.

cat /dev/urandom | tr -dc 'a-za-z0-9' | fold -w 12 | head -n 3

Example output:

Cb7VogmHUwn6 w9sv5hu98q0i V2th1pchBI71

Important: Save these strings in a secure location. You'll need one for the phpMyAdmin URL and another for HTTP authentication password.

3Create Database Administrator User

Create a new MariaDB administrative user that uses password authentication instead of Unix socket authentication.

Login to MariaDB:

sudo mysql

Create the administrative user:

GRANT ALL ON *.* TO 'dbadmin'@'localhost' IDENTIFIED BY 'Cb7VogmHUwn6' WITH GRANT OPTION;

Apply privileges:

flush privileges;

Exit MariaDB:

exit

🔒 Security Best Practice

Replace Cb7VogmHUwn6 with one of your randomly generated strings. Use a strong, unique password for this administrative user.

4Setup HTTP Basic Authentication

Configure HTTP Basic Authentication to add an additional layer of security before reaching phpMyAdmin.

Navigate to Nginx includes directory:

cd /etc/nginx/includes

Encrypt your password using OpenSSL:

openssl passwd

You'll be prompted to enter and verify your password:

Password: w9sv5hu98q0i Verifying - Password: $1$lSmswTO8$tv.unS.4n68fH.yrV0WHR0

Create the password file:

sudo nano pma_userpass

Add your username and encrypted password:

andrew:$1$lSmswTO8$tv.unS.4n68fH.yrV0WHR0

Format: username:encrypted_password (no spaces)

5Install phpMyAdmin

Install phpMyAdmin from the official Ubuntu repository.

Update package list:

sudo apt update

Install phpMyAdmin:

sudo apt install phpmyadmin

Installation Prompts

Web server selection: Press TAB to highlight OK and press Enter (we'll configure Nginx manually)
Configure database: Select Yes
Password for phpMyAdmin: Leave blank for random password generation or enter your own

6Create Symbolic Link with Random URL

Create a symbolic link using a randomly generated string to obscure the phpMyAdmin location.

sudo ln -s /usr/share/phpmyadmin /var/www/html/V2th1pchBI71

Replace V2th1pchBI71 with your own randomly generated string. This becomes part of your phpMyAdmin URL.

Verify the symbolic link:

ls -la /var/www/html/

7Configure Nginx for phpMyAdmin

Create a dedicated Nginx configuration file for phpMyAdmin with security restrictions.

Create the configuration file:

sudo nano /etc/nginx/includes/pma.conf

Add the following configuration:

location ^~ /V2th1pchBI71 { # CONDITIONS satisfy all; # HTTP AUTHENTICATION auth_basic "Sign In"; auth_basic_user_file /etc/nginx/includes/pma_username_password; # IP BASED ACCESS # if your IP changes, ssh to your server and use the last command # last -n3 (still logged in) is your IP address you need to add to allow allow your_IP_ADDRESS; deny all; try_files $uri $uri/ =404; location ~ \.php$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/run/php/php8.3-fpm.sock; include /etc/nginx/includes/fastcgi_optimize.conf; } }

⚙️ Configuration Breakdown

Directive	Purpose
`^~ /V2th1pchBI71`	Prefix match for your random URL (replace with yours)
`satisfy all`	Requires BOTH IP match AND HTTP authentication
`auth_basic`	Enables HTTP Basic Authentication
`allow your_IP_ADDRESS`	Replace with your actual IP address
`deny all`	Blocks all other IP addresses

Find your IP address:

last -n3

Look for the line showing "still logged in" - that's your current public IP address.

Update the configuration with your IP:

sudo nano /etc/nginx/includes/pma.conf

Replace your_IP_ADDRESS with your actual IP address.

8Include Configuration in Default Server Block

Link the phpMyAdmin configuration to your default Nginx server block.

Navigate to sites-available:

cd /etc/nginx/sites-available/

Edit the default file:

sudo nano default

Add the include directive:

include /etc/nginx/includes/pma.conf;

Place this line within the server block, typically after the location / context.

Test Nginx configuration:

sudo nginx -t

Reload Nginx:

sudo systemctl reload nginx

9Update Index Directive

Ensure Nginx can properly serve PHP files for phpMyAdmin.

Edit the default file:

sudo nano /etc/nginx/sites-available/default

Update the index directive to include index.php:

index index.php index.html index.htm index.nginx-debian.html;

Test and reload:

sudo nginx -t sudo systemctl reload nginx

✅ Accessing phpMyAdmin

You can now access phpMyAdmin using the following URL format:

http://your_server_ip/V2th1pchBI71/

Replace your_server_ip with your server's IP address and V2th1pchBI71 with your random string.

Login Process:

Enter your HTTP authentication username and password
Enter your database username (dbadmin) and password
Access phpMyAdmin dashboard

📝 Log Rotation Configuration

10Set Default Log Rotation Settings

Configure system-wide log rotation to manage disk space efficiently.

Edit the main logrotate configuration:

cd /etc/

sudo nano logrotate.conf

Make the following changes:

Setting	Original Value	New Value
Rotation frequency	`weekly`	`daily`
Number of rotations	`rotate 4`	`rotate 7`
Compression	`#compress`	`compress` (uncommented)

Result: Logs will rotate daily and keep 7 days of compressed backups.

11Configure Individual Service Log Rotation

Update log rotation settings for specific services.

Navigate to logrotate.d directory:

cd /etc/logrotate.d/

List available configuration files:

Update the following files:

fail2ban
nginx
rsyslog
ufw

Edit each file:

sudo nano fail2ban sudo nano nginx sudo nano rsyslog sudo nano ufw

In each file, make these changes:

Change weekly to daily
Change rotate 4 to rotate 3

Verify the changes:

sudo logrotate -d /etc/logrotate.conf

The -d flag runs in debug mode to show what would happen without actually rotating logs.

🔄 IP Address Management

Updating Your IP Address

Whenever your IP address changes, you must update the phpMyAdmin configuration to maintain access.

Steps to update your IP:

SSH into your server
Check your current IP: last -n3
Edit the configuration: sudo nano /etc/nginx/includes/pma.conf
Update the allow directive with your new IP
Test configuration: sudo nginx -t
Reload Nginx: sudo systemctl reload nginx

🧪 Testing Security Layers

Security Response Flow

Wrong URL
404 Not Found

Wrong IP
403 Forbidden

Correct IP
HTTP Auth Prompt

All Correct
phpMyAdmin Access

📊 Complete Configuration Summary

Component	Purpose	Security Level
Random URL String	Obscures phpMyAdmin location	High
IP Restriction	Limits access to specific IPs	High
HTTP Authentication	Additional login layer	Medium
Database User Auth	phpMyAdmin login credentials	High
Return 444 on IP	Prevents server enumeration	Medium

⚠️ Important Security Notes

Never use default paths: Always use randomly generated URL strings
Keep IP restrictions updated: Update your IP whenever it changes
Use strong passwords: For both HTTP authentication and database users
Regular updates: Keep phpMyAdmin and all packages up to date
Monitor logs: Regularly check access logs for suspicious activity
Backup configuration: Keep secure backups of all configuration files

🔧 Troubleshooting Common Issues

Issue	Solution
403 Forbidden Error	Update your IP address in pma.conf and reload Nginx
Empty Response	This is expected for direct IP access (return 444)
HTTP Auth Not Working	Verify the password file path and encrypted password format
PHP Files Not Processing	Ensure index.php is in the index directive
Cannot Login to phpMyAdmin	Verify database user credentials and privileges

🎉 Congratulations!

You have successfully installed and secured phpMyAdmin with multiple layers of protection. Your server is now significantly more secure against common attack vectors targeting phpMyAdmin installations.

Best Practice Reminder: While phpMyAdmin is now secured, consider using SSH tunnels with desktop database clients for even better security. Only use phpMyAdmin when absolutely necessary.