apache - Block all users except localhost from phpmyadmin and mysql -


i installed xampp stack on desktop , connected via laptop on local network. surprise, able access phpmyadmin , delete update mysql tables. though understand shouldn't use xampp production (and i'm not), still learn how manage these types of obvious security flaws. know can block access directories via .htacces (http://forum.directadmin.com/showthread.php?t=29089), little more comprehensive. how restrict running of mysql queries anywhere except localhost? there way without .htaccess? thought partially purpose of root user.

mysql defined users domains. if @ user_privileges table in information_schema database see have domains. if users defined strictly localhost, there no remote access.

also, can edit my.cnf turn off tcp access database, forcing connections socket. under [mysqld], include line skip-networking. have configure apps use socket connection, socket better anyway.

this nothing protect data using phpmyadmin, if phpmyadmin installed on same machine database. safest thing rid of app. that's not practical, however, it's useful tool, , need configure phpmyadmin require users authenticate themselves. means not putting password in config file. need think how long sessions before reauthentication, , things that.

phpmyadmin fills me rage hotter thousand suns whenever try configure it, possible set things password required each time connect database through phpmyadmin. can further limit damage phpmyadmin abusers can making sure connects user limited privileges (for instance, able modify database you're working on @ moment).


Comments

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

c++ - qgraphicsview horizontal scrolling always has a vertical delta -