My current ways to protect PHPmyadmin (PMA) particularly form Brute Force Attacks (BFAs) in my ubuntu-nginx-https environment, are one or more of these:

1) Changing the location of the PMA directory to something wired and hard to guess.

2) Login from a permanent IP.

3) Login through a recognized VPN (this is an edit due to comments below).

4) Running PMA temporarily in a separate tmux session:

cat <<-"PHPMYADMIN" > /opt/pma.sh
    find /var/www/html -iname '*phpmyadmin*' -exec rm -rf {} \;
    cd /var/www/html && wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.zip
    find /var/www/html -type f -iname '*phpmyadmin*.zip' -exec unzip {} \;
    find /var/www/html -type d -iname 'phpmyadmin-*' -exec mv {} phpmyadmin \;

    sleep 2h

    find /var/www/html -iname '*phpmyadmin*' -exec rm -rf {} \;
    tmux kill-session
chmod +x /opt/pma.sh

cat <<-"BASHRC" >> /etc/bash.bashrc
    alias pma="tmux new-session -d 'bash /opt/pma.sh'"
source /etc/bash.bashrc


pma # execute script and use pma for 2 hours.

Why I'm not comfortable using these ways

  1. What if someone finds the wired unintuitive PMA path it could still try to brute force it.

  2. I cannot afford that. I might move between apartments sometimes.

  3. This might be a nice option though might be overwhelming for that purpose (I don't have other VPN uses at this era).

  4. This script is quite heavy and lengthens the already very long Nginx Server Environment Setup (NSES) script I use.

My question

What else do I have left to protect PMA from Brute force attack in my ubuntu-nginx-https environment?

  • You can always create a PHP-myadmin entry that is only accessible from your internal network or via VPN or if you really need that bad in the Internet at large, do user authentication via a X.509 certificate. (user auth mind you) – Rui F Ribeiro Jan 11 '18 at 9:27
  • I've edited to include that I cannot use a permanent IP. Only a VPN or the x.509 certificates remain I guess. – Arcticooling Jan 11 '18 at 9:36
  • What about some Apache mod_security equivalent for Nginx? – Arcticooling Jan 11 '18 at 9:37
  • You can also restrict the IPs that access that page or put another layer the authentication on top. It works, they are not my favourite solutions. – Rui F Ribeiro Jan 11 '18 at 9:38
  • 1. Did you mean to restrict PMA to a specific VPN? 2. Another layer of authentication on top like the x.509 certificate or you meant something else? – Arcticooling Jan 11 '18 at 9:44

The documentation has a section about "Securing your phpMyAdmin installation" to which you should refer for more details.

My favorites:

  1. Changing to a not obvious directory name is a simple way to greatly reduce brute-force attacks. Attackers have a variety of them they try, from /phpmyadmin/ to /phpMyAdmin-4.7.7/ and so on, but if you pick something that makes sense for you but isn't obvious for a bot to try, you'll be really reduce your attack vector.
  2. Using the authentication logging that will be part of phpMyAdmin 4.8.0 (* see footnote), you can let specialized tools like Fail2Ban do the detection and blocking.
  3. You can enable two-factor authentication, starting with phpMyAdmin 4.8.0 *.
  4. Using a Captcha can greatly reduce the effectiveness of a brute-force attack. See this and this for the configuration directives.

* 4.8.0 isn't yet released as of when I'm writing this, but the development snapshots are generally pretty stable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.