How do you lock down phpMyAdmin?

[Adams-Blake Co.]

What technique do you folks use to keep your passwords and user names out of
the phpMyAdmin config.inc file.

Thanks,

Al

[Wolfgang 'Dreamguard' Nagele]

Re: How do you lock down phpMyAdmin?

> What technique do you folks use to keep your passwords and user names out
of[color=blue]
> the phpMyAdmin config.inc file.[/color]
use the http auth which is included?!

yours, dreamguard.

--
"Ich bin Vegetarier und Antialkoholiker ,
weil ich so besseren Gebrauch von meinem
Gehirn machen kann!"
--
Author: Thomas A. Edison (1847 - 1931)

[Jan Pieter Kunst]

Re: How do you lock down phpMyAdmin?

In article <3f6dbea3$0$328 76$91cee783@new sreader01.highw ay.telekom.at>,
"Wolfgang 'Dreamguard' Nagele" <dreamguard@dre amguard.at> wrote:
[color=blue][color=green]
> > What technique do you folks use to keep your passwords and user names out[/color]
> of[color=green]
> > the phpMyAdmin config.inc file.[/color]
> use the http auth which is included?![/color]

But http auth sends your username and password in the clear over the
network.

I use 'config' authentication without the password in the config.inc.php
like this:

I put a file (say, 'worteltje_bove n.inc.php') which contains my password
outside the document root somewhere. I define my password in that file:

define('WORTELT JE_BOVEN', 'secret_passwor d');

I then 'require' that file at the top of the config.inc.php:

require('/path/to/worteltje_boven .inc.php');

And then I do this:

$cfg['Servers'][$i]['password'] = WORTELTJE_BOVEN ;

JP

--
Sorry, <devnull@cauce. org> is een "spam trap".
E-mail adres is <jpk"at"akamail .com>, waarbij "at" = @.

[Adams-Blake Co.]

Re: How do you lock down phpMyAdmin?

Jan Pieter Kunst wrote:
[color=blue]
> In article <3f6dbea3$0$328 76$91cee783@new sreader01.highw ay.telekom.at>,
> "Wolfgang 'Dreamguard' Nagele" <dreamguard@dre amguard.at> wrote:
>[color=green][color=darkred]
>> > What technique do you folks use to keep your passwords and user names out[/color]
>> of[color=darkred]
>> > the phpMyAdmin config.inc file.[/color]
>> use the http auth which is included?![/color]
>
> But http auth sends your username and password in the clear over the
> network.
>
> I use 'config' authentication without the password in the config.inc.php
> like this:
>
> I put a file (say, 'worteltje_bove n.inc.php') which contains my password
> outside the document root somewhere. I define my password in that file:
>
> define('WORTELT JE_BOVEN', 'secret_passwor d');
>
> I then 'require' that file at the top of the config.inc.php:
>
> require('/path/to/worteltje_boven .inc.php');
>
> And then I do this:
>
> $cfg['Servers'][$i]['password'] = WORTELTJE_BOVEN ;
>
> JP
>[/color]

Yes, this looks good. Why do you use a CONSTANT instead of plain old
variable? Are they somehow more secure?

Here is something that I do for my own apps. I have a file like you have. But
instead of the the real password run it through an encryptor that I have and
end up with something like $mypass="wouydo s8737sl72lsh;al s8".

I then "include" the file with these encrypted variables and run them through
the decrypt routine (a rather short PHP class) and plug that result into
session variables.

What I could do for myphpadmin config is something similar. I just thought
there might be an easier way.

[Jan Pieter Kunst]

Re: How do you lock down phpMyAdmin?

In article <Bvkbb.1004$vS. 471@newsread3.n ews.pas.earthli nk.net>,
"Adams-Blake Co." <atakeoutcanton @adams.takeme.o ut.-blake.com> wrote:
[color=blue]
> Yes, this looks good. Why do you use a CONSTANT instead of plain old
> variable? Are they somehow more secure?[/color]

There is no particular reason I used a constant instead of a variable in
this case. Now that I think of it, constants may be more secure than
variables in the sense that they can't be redefined during execution of
the script, so there is no way that someone can maliciously change their
values to something evil. But I don't think that applies to this
phpmyadmin setup. (A changed value for the mysql password would simply
not work.)

JP

--
Sorry, <devnull@cauce. org> is een "spam trap".
E-mail adres is <jpk"at"akamail .com>, waarbij "at" = @.