Just had a hacker on my test server ..

[Gimp]

Anyone know a good less hackable alternative to phpmyadmin?

[freghar]

Yes, firewall.

[Gimp]

Yes, firewall.

No I mean for accessing and editing your db from remote.

[freghar]

phpmyadmin is fine if you have an updated version ... or you might use direct DB access with some GUI client such as navicat / sqlyog.

The thing is not to rely on web app only, use mod_evasive on apache, use port knocking on firewall to get dynamic access, etc, etc ..

[DasBlub]

use ssh + the mysql cli for db access. configure your iptables correctly and turn your server into a bastion host (default all chains to DROP, only exceptions (e.g. mangos, http) are ACCEPT or FORWARD)

that way you'll be secured. (as long as your password is not '1234' )

[Gimp]

use ssh + the mysql cli for db access. configure your iptables correctly and turn your server into a bastion host (default all chains to DROP, only exceptions (e.g. mangos, http) are ACCEPT or FORWARD)

that way you'll be secured. (as long as your password is not '1234' )

Ya but the problem with SSH is that it's a pain in the ass to modify things in the DB, especially since our Linux is command line only.

[DasBlub]

why should that be 'pain in the ass'? i work this way every day

if you look once at professional companies, you'll see, that most don't have any gui installed, and if they have a gui installed the servers are still running at runlevel 3 (=multiuser,network,console) and not runlevel 5 (=multiuser,network,console,gui)

just learn how to use the commands and you'll have no problems with it

[freghar]

... or use ssh secure tunnel to connect to DB remotely

[subhuman_bob]

Here's a general rule for you:

Doing things the "easy" way is not secure.

If you want to make your system secure, you will have to stop doing everything the easy way.

[Gimp]

Thanks guys

[crashuncle]

Some of the posted PHPMyAdmin leaks work on elder versions, I suggest always to remove it cause its a insecure script if you don't know what you do. I see enough servers where you can even get root access, because they dont run the webserver from the home directory they use the default /var/www/ dir and there are tons of exploits to abuse that.

Use a SQL Client like HeidiSQL or Navicat they are also easy to use, in the meanwhile you should get used to queries. Also use secure passwords AND usernames, try to work with caps ;-)

[freghar]

Some of the posted PHPMyAdmin leaks work on elder versions, I suggest always to remove it cause its a insecure script if you don't know what you do. I see enough servers where you can even get root access, because they dont run the webserver from the home directory they use the default /var/www/ dir and there are tons of exploits to abuse that.

Use a SQL Client like HeidiSQL or Navicat they are also easy to use, in the meanwhile you should get used to queries. Also use secure passwords AND usernames, try to work with caps ;-)

What is so insecure about running a webserver chrooted into /var/www/ ?