Rotten mud: Password-free phpmyadmin configuration for database management

Rotten mud: Password-free phpmyadmin configuration for database management

This document consistsIlanniwebProviding friendship sponsorship, first launchedThe world

For more articles, follow my ilanniweb

In fact, this article has long been intended for writing, but there is no time. Just a little blank this afternoon, I will sort out this article.

Many phpmyadmin articles can be found in Baidu. This article introduces how to use phpmyadmin to control database operations.

Of course, we can consider database security from three aspects:

1) mysql database server, including the security of the server itself.

2) mysql access permissions, including database user permissions and database access methods.

3) security after mysql database access, including whether to allow data export.

Today, we use phpmyadmin to control developers' operations on the database. In fact, we use the second and third points to prohibit users from accessing the database and exporting data.

1. phpmyadmin Installation

First, install phpmyadmin. Here we use the source code to install phpmyadmin, and install the latest version 4.6.4 as follows:

Wget https://files.phpmyadmin.net/phpMyAdmin/4.6.4/phpMyAdmin-4.6.4-all-languages.zip

Unzip phpMyAdmin-4.6.4-all-languages.zip-d/data/dg/

Mv/data/dg/phpMyAdmin-4.6.4-all-languages // data/dg/app_db/

Chmod 755-R/data/dg/app_db/

Note: phpmyadmin requires the lnmp environment. Therefore, you must install the related basic environment before running phpmyadmin.

After phpmyadmin is decompressed and installed, configure nginx as follows:

Here I have enabled the nginx Directory Index Function, mainly considering that if there are multiple databases, we can differentiate them by directory names.

For example, our online database is as follows:

Visit the following link:

We can see that phpmyadmin can be accessed normally now, but we need to enter the relevant user name and password.

Ii. phpmyadmin password-free Configuration

In section 1, we have installed phpmyadmin. In this section, we configure phpmyadmin to allow password-free access.

Here we take the database app_db as an example. Before achieving password-free access, we also need to create a read-only user ilanniread for the app_db database in the mysql database.

Create an SQL statement as follows:

Mysql accept-uroot-p 'ilanni'-e "grant select on app_db. * to 'ilanniread' @ '% 'identified by 'readonlyqw ';

After ilanniread is created, modify the configuration file config. default. php of phpmyadmin.

For config. default. in the PHP file, we only need to modify rows 106, 252, and 259. Row 106th is the connection address of the database, and row 252nd and row 259 are the username and password of the database respectively. As follows:

After the modification is complete, let's access the page to see the actual effect, as shown below:

We can see that currently accessing phpmyadmin does not require the user name and password of the database.

In addition, after doing so, we can also enable developers not to know the actual database address and the database username and password, which is relatively more secure.

3. Disable phpmyadmin from exporting data

In section 2, we have configured password-free access to phpmyadmin. Now we will configure how to disable the export of queried data through phpmyadmin.

By default, phpmyadmin can export the entire database as follows:

To prevent developers from exporting the query results without authorization, We can rename the tbl_export.php or export. php file in the phpmyadmin root directory as follows:

Mv export. php export. php. bak

After the modification, let's export the data as follows:

Through this, we can easily see that data cannot be exported at present, so that we can prohibit phpmyadmin from exporting data.

Note: The export. php file is exported to the entire database. To disable export after query, You need to rename the tbl_export.php file.

PS: security is relative, and there is no absolute security. We can only prevent the gentleman from the villain.