1

I have a virtual machine running a number of websites. All users have access these via the external IP address of the machine. I am running Debian Stable on this machine.

I can access the machine via ssh and have organized it so I port forward my local 10080 port to localhost:80 so I can connect my browser to localhost port 10080/phpmyadmin and gain access to phpmyadmin. My machine is on a 192.168.0.0/24 network

Trouble is, you can also access it via any of the external web sites - because Debian has placed it in the top level Apache config.

I would like to limit access to only connections via the ssh port. But there doesn't appear to be the equivalent of a listen directive for a directory.

However there is Allow from IP_address. What IP address does apache think I connected on when I come over the ssh tunnel.

  • 5
    This seems like an overly complicated set up. Why didn't you just configure apache to Listen on port 10080 and create a default virtual host for that port that serves the phpMyAdmin application? If it's a security thing, you can just configure that virtualhost for SSL via SSLEngine on – Bratchley Mar 25 '14 at 21:37
  • 3
    You may look into Allow/Deny statements to only allow connections that seem to be coming from localhost (which should be how apache sees the remote user as connecting since the local sshd is doing the relay). – Bratchley Mar 25 '14 at 21:40
  • Allow/Deny did it, with 127.0.0.1 The connection appeared to be coming from its own local host – akc42 Mar 25 '14 at 21:52
  • @bersch organised isn't actually a typo. – n.st Mar 25 '14 at 23:39
  • @n.st ah I see, thanks, wrong province, I'll take care of it next time. Although I consider if "organyse" would bye satisfactory for all. :-) – user55518 Mar 26 '14 at 0:02
0

OK, this is relatively simple to solve.

You access your server with

 ssh -L 5580:localhost:80 www.servername.tld

and you access your phpmyadmin via

 http://localhost:5580/phpmyadmin/

because Debian has placed it

If you would have M$, you can say this, but you have Debian, so you can change the defaults as you need. :-)

However there is Allow from IP_address. What IP address does apache think I connected on when I come over the ssh tunnel.

The same as you have already used: localhost

Simplest solution here, you said it already

# /etc/phpmyadmin/apache.conf 
Alias /phpmyadmin /usr/share/phpmyadmin
<Directory /usr/share/phpmyadmin>

  ...
  AllowOverride None
  Order deny,allow
  Deny from all
  Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>

Another solution would be to listen on an additional port to have an exclusive access to phpmyadmin:

Files to change:

 # /etc/apache2/ports.conf
 Listen localhost:8880

and

# /etc/phpmyadmin/apache.conf 
<VirtualHost *:8880>
  ServerName localhost
  Alias /phpmyadmin /usr/share/phpmyadmin
  <Directory /usr/share/phpmyadmin>

     ...
     Allow from 127.0.0.0/255.0.0.0 ::1/128
  </Directory>    
</VirtualHost>

Eventually

 apache2ctl configtest
 apache2ctl restart

The redirection command

 ssh -L 5580:localhost:8880 www.servername.tld

and connect to

 http://localhost:5580/phpmyadmin/
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.