Why am I denied access to phpmyadmin?

Question

Here is what my phpmyadmin.conf file looks like:

#
#  Web application to manage MySQL
#

<Directory "/usr/share/phpmyadmin">
  Order Deny,Allow
  Allow from 192.168.0.2
  Allow from 192.168.0.219
</Directory>

Alias /phpmyadmin /usr/share/phpmyadmin
Alias /phpMyAdmin /usr/share/phpmyadmin
Alias /mysqladmin /usr/share/phpmyadmin

I did restart the apache service after making changes as well. I used the following commands to try to restart apache:

sudo systemctl restart httpd.service

sudo apachectl restart

The server I'm working with is running CentOS and is hosted on the same LAN and my local ip is listed under the allows. Navigating to http://serverip/phpmyadmin results in a:

Forbidden

You don't have permission to access /phpmyadmin on this server.

Message. Any ideas? I followed guides that told me to do it this way, but it just doesn't seem to want to work.

Edit: This message shows up in my httpd error_log:

AH01630: client denied by server configuration: /usr/share/phpmyadmin

But I can't find a configuration file in /usr/share/phpmyadmin.

Answer 1

Warning: The below (Require all granted) allows access from ANY ip.

I had to add this to my /etc/httpd/conf/httpd.conf file:

<Directory "/usr/share/phpmyadmin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

Then restart the apache service:

sudo systemctl restart httpd.service

I have also read that selinux can cause this, so you can check to see if that is causing issues by putting selinux into permissive mode:

sudo setenforce 0
getenforce

take selinux out of permissive mode:

sudo setenforce 1
getenforce

It's also a good idea to check permissions on the /usr/share/phpmyadmin directory to make sure they are set to something like 0755.

Answer 2

Right before the error message in the log it will have the client ip address.

[client 10.0.2.2:52570] AH01630: client denied by server configuration: /usr/share/phpMyAdmin

which you can then use in the rule in the conf file (this is the location for Centos 7).

sudo vi /etc/httpd/conf.d/phpMyAdmin.conf

and edit so that it looks similar to the below. The last part of the IP is replaced with a zero, and a mask "/15" to allow anyone on the subnet 10.0.2.x access.

<Directory /usr/share/phpMyAdmin/>
   AddDefaultCharset UTF-8
   <IfModule mod_authz_core.c>
     # Apache 2.4
     <RequireAny>
       Require ip 127.0.0.1
       Require ip ::1
       Require ip 10.0.2.0/15
     </RequireAny>
   </IfModule>
   <IfModule !mod_authz_core.c>
     # Apache 2.2
     Order Deny,Allow
     Deny from All
     Allow from 127.0.0.1
     Allow from ::1
     Allow from 10.0.2.0/15
   </IfModule>
</Directory>