安装 - 认证方式的使用 - 《phpMyAdmin v5.1 使用文档》

认证方式的使用
加固您的 phpMyAdmin 安装
Using SSL for connection to database server
Known issues
- Users with column-specific privileges are unable to “Browse”
- Trouble logging back in after logging out using ‘http’ authentication

认证方式的使用

HTTP and cookie authentication modes are recommended in a multi-user environment where you want to give users access to their own database and don’t want them to play around with others. Nevertheless, be aware that MS Internet Explorer seems to be really buggy about cookies, at least till version 6. Even in a single-user environment, you might prefer to use HTTP or cookie mode so that your user/password pair are not in clear in the configuration file.

HTTP and cookie authentication modes are more secure: the MySQL login information does not need to be set in the phpMyAdmin configuration file (except possibly for the $cfg['Servers'][$i]['controluser']). However, keep in mind that the password travels in plain text unless you are using the HTTPS protocol. In cookie mode, the password is stored, encrypted with the AES algorithm, in a temporary cookie.

Then each of the true users should be granted a set of privileges on a set of particular databases. Normally you shouldn’t give global privileges to an ordinary user unless you understand the impact of those privileges (for example, you are creating a superuser). For example, to grant the user real_user with all privileges on the database user_base:

GRANT ALL PRIVILEGES ON user_base.* TO 'real_user'@localhost IDENTIFIED BY 'real_password';

现在用户可以做什么已经完全被 MySQL 用户管理系统所控制了。在 HTTP 或 cookie 认证方式下，您不需要填写 $cfg['Servers'] 中的 user/password 设置。

参见

1.32 Can I use HTTP authentication with IIS?, 1.35 Can I use HTTP authentication with Apache CGI?, 4.1 I’m an ISP. Can I setup one central copy of phpMyAdmin or do I need to install it for each customer?, 4.2 What’s the preferred way of making phpMyAdmin secure against evil access?, 4.3 I get errors about not being able to include a file in /lang or in /libraries.

HTTP 认证方式

通过 HTTP 基本认证方式将允许您使用任何有效的 MySQL 用户登录。
支持大部分 PHP 设置。 IIS （ ISAPI）上的 CGI PHP 支持请参见 1.32 Can I use HTTP authentication with IIS?，Apache 上的 CGI 支持请参见 1.35 Can I use HTTP authentication with Apache CGI?。
When PHP is running under Apache’s mod_proxy_fcgi (e.g. with PHP-FPM), Authorization headers are not passed to the underlying FCGI application, such that your credentials will not reach the application. In this case, you can add the following configuration directive:
```
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
```
参见 4.4 phpMyAdmin always gives “Access denied” when using HTTP authentication. 关于不要同时使用 .htaccess 和‘ HTTP’认证方式。

注解

There is no way to do proper logout in HTTP authentication, most browsers will remember credentials until there is no different successful authentication. Because of this, this method has a limitation that you can not login with the same user after logout.

Cookie 认证方式

Username and password are stored in cookies during the session and password is deleted when it ends.
在该认证方式下，用户可以真正的退出 phpMyAdmin 并用相同的用户再次登录（在 HTTP 认证方式方式当中是不可行的）。
If you want to allow users to enter any hostname to connect (rather than only servers that are configured in config.inc.php), see the $cfg['AllowArbitraryServer'] directive.
在需求一节中我们提到过，可选的 openssl 扩展可以显著提高访问速度，但不是必须的。

Signon 认证方式

This mode is a convenient way of using credentials from another application to authenticate to phpMyAdmin to implement a single signon solution.
The other application has to store login information into session data (see $cfg['Servers'][$i]['SignonSession'] and $cfg['Servers'][$i]['SignonCookieParams']) or you need to implement script to return the credentials (see $cfg['Servers'][$i]['SignonScript']).
When no credentials are available, the user is being redirected to $cfg['Servers'][$i]['SignonURL'], where you should handle the login process.

The very basic example of saving credentials in a session is available as examples/signon.php:

<?php
/**
 * Single signon for phpMyAdmin
 *
 * This is just example how to use session based single signon with
 * phpMyAdmin, it is not intended to be perfect code and look, only
 * shows how you can integrate this functionality in your application.
 */
declare(strict_types=1);
/* Use cookies for session */
ini_set('session.use_cookies', 'true');
/* Change this to true if using phpMyAdmin over https */
$secure_cookie = false;
/* Need to have cookie visible from parent directory */
session_set_cookie_params(0, '/', '', $secure_cookie, true);
/* Create signon session */
$session_name = 'SignonSession';
session_name($session_name);
// Uncomment and change the following line to match your $cfg['SessionSavePath']
//session_save_path('/foobar');
@session_start();
/* Was data posted? */
if (isset($_POST['user'])) {
    /* Store there credentials */
    $_SESSION['PMA_single_signon_user'] = $_POST['user'];
    $_SESSION['PMA_single_signon_password'] = $_POST['password'];
    $_SESSION['PMA_single_signon_host'] = $_POST['host'];
    $_SESSION['PMA_single_signon_port'] = $_POST['port'];
    /* Update another field of server configuration */
    $_SESSION['PMA_single_signon_cfgupdate'] = ['verbose' => 'Signon test'];
    $_SESSION['PMA_single_signon_HMAC_secret'] = hash('sha1', uniqid(strval(rand()), true));
    $id = session_id();
    /* Close that session */
    @session_write_close();
    /* Redirect to phpMyAdmin (should use absolute URL here!) */
    header('Location: ../index.php');
} else {
    /* Show simple form */
    header('Content-Type: text/html; charset=utf-8');
    echo '<?xml version="1.0" encoding="utf-8"?>' . "\n";
    echo '<!DOCTYPE HTML>
<html lang="en" dir="ltr">
<head>
<link rel="icon" href="../favicon.ico" type="image/x-icon">
<link rel="shortcut icon" href="../favicon.ico" type="image/x-icon">
<meta charset="utf-8">
<title>phpMyAdmin single signon example</title>
</head>
<body>';
    if (isset($_SESSION['PMA_single_signon_error_message'])) {
        echo '<p class="error">';
        echo $_SESSION['PMA_single_signon_error_message'];
        echo '</p>';
    }
    echo '<form action="signon.php" method="post">
Username: <input type="text" name="user" autocomplete="username"><br>
Password: <input type="password" name="password" autocomplete="current-password"><br>
Host: (will use the one from config.inc.php by default)
<input type="text" name="host"><br>
Port: (will use the one from config.inc.php by default)
<input type="text" name="port"><br>
<input type="submit">
</form>
</body>
</html>';
}

Alternatively, you can also use this way to integrate with OpenID as shown in examples/openid.php:

<?php
/**
 * Single signon for phpMyAdmin using OpenID
 *
 * This is just example how to use single signon with phpMyAdmin, it is
 * not intended to be perfect code and look, only shows how you can
 * integrate this functionality in your application.
 *
 * It uses OpenID pear package, see https://pear.php.net/package/OpenID
 *
 * User first authenticates using OpenID and based on content of $AUTH_MAP
 * the login information is passed to phpMyAdmin in session data.
 */
declare(strict_types=1);
if (false === @include_once 'OpenID/RelyingParty.php') {
    exit;
}
/* Change this to true if using phpMyAdmin over https */
$secure_cookie = false;
/**
 * Map of authenticated users to MySQL user/password pairs.
 */
$AUTH_MAP = [
    'https://launchpad.net/~username' => [
        'user' => 'root',
        'password' => '',
    ],
];
// phpcs:disable PSR1.Files.SideEffects,Squiz.Functions.GlobalFunction
/**
 * Simple function to show HTML page with given content.
 *
 * @param string $contents Content to include in page
 *
 * @return void
 */
function Show_page($contents)
{
    header('Content-Type: text/html; charset=utf-8');
    echo '<?xml version="1.0" encoding="utf-8"?>' . "\n";
    echo '<!DOCTYPE HTML>
<html lang="en" dir="ltr">
<head>
<link rel="icon" href="../favicon.ico" type="image/x-icon">
<link rel="shortcut icon" href="../favicon.ico" type="image/x-icon">
<meta charset="utf-8">
<title>phpMyAdmin OpenID signon example</title>
</head>
<body>';
    if (isset($_SESSION['PMA_single_signon_error_message'])) {
        echo '<p class="error">' . $_SESSION['PMA_single_signon_message'] . '</p>';
        unset($_SESSION['PMA_single_signon_message']);
    }
    echo $contents;
    echo '</body></html>';
}
/**
 * Display error and exit
 *
 * @param Exception $e Exception object
 *
 * @return void
 */
function Die_error($e)
{
    $contents = "<div class='relyingparty_results'>\n";
    $contents .= '<pre>' . htmlspecialchars($e->getMessage()) . "</pre>\n";
    $contents .= "</div class='relyingparty_results'>";
    Show_page($contents);
    exit;
}
// phpcs:enable
/* Need to have cookie visible from parent directory */
session_set_cookie_params(0, '/', '', $secure_cookie, true);
/* Create signon session */
$session_name = 'SignonSession';
session_name($session_name);
@session_start();
// Determine realm and return_to
$base = 'http';
if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
    $base .= 's';
}
$base .= '://' . $_SERVER['SERVER_NAME'] . ':' . $_SERVER['SERVER_PORT'];
$realm = $base . '/';
$returnTo = $base . dirname($_SERVER['PHP_SELF']);
if ($returnTo[strlen($returnTo) - 1] !== '/') {
    $returnTo .= '/';
}
$returnTo .= 'openid.php';
/* Display form */
if ((! count($_GET) && ! count($_POST)) || isset($_GET['phpMyAdmin'])) {
    /* Show simple form */
    $content = '<form action="openid.php" method="post">
OpenID: <input type="text" name="identifier"><br>
<input type="submit" name="start">
</form>';
    Show_page($content);
    exit;
}
/* Grab identifier */
if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
    $identifier = $_POST['identifier'];
} elseif (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
    $identifier = $_SESSION['identifier'];
} else {
    $identifier = null;
}
/* Create OpenID object */
try {
    $o = new OpenID_RelyingParty($returnTo, $realm, $identifier);
} catch (Throwable $e) {
    Die_error($e);
}
/* Redirect to OpenID provider */
if (isset($_POST['start'])) {
    try {
        $authRequest = $o->prepare();
    } catch (Throwable $e) {
        Die_error($e);
    }
    $url = $authRequest->getAuthorizeURL();
    header('Location: ' . $url);
    exit;
}
/* Grab query string */
if (! count($_POST)) {
    [, $queryString] = explode('?', $_SERVER['REQUEST_URI']);
} else {
    // I hate php sometimes
    $queryString = file_get_contents('php://input');
}
/* Check reply */
try {
    $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);
} catch (Throwable $e) {
    Die_error($e);
}
$id = $message->get('openid.claimed_id');
if (empty($id) || ! isset($AUTH_MAP[$id])) {
    Show_page('<p>User not allowed!</p>');
    exit;
}
$_SESSION['PMA_single_signon_user'] = $AUTH_MAP[$id]['user'];
$_SESSION['PMA_single_signon_password'] = $AUTH_MAP[$id]['password'];
$_SESSION['PMA_single_signon_HMAC_secret'] = hash('sha1', uniqid(strval(rand()), true));
session_write_close();
/* Redirect to phpMyAdmin (should use absolute URL here!) */
header('Location: ../index.php');

If you intend to pass the credentials using some other means than, you have to implement wrapper in PHP to get that data and set it to $cfg['Servers'][$i]['SignonScript']. There is a very minimal example in examples/signon-script.php:

<?php
/**
 * Single signon for phpMyAdmin
 *
 * This is just example how to use script based single signon with
 * phpMyAdmin, it is not intended to be perfect code and look, only
 * shows how you can integrate this functionality in your application.
 */
declare(strict_types=1);
// phpcs:disable Squiz.Functions.GlobalFunction
/**
 * This function returns username and password.
 *
 * It can optionally use configured username as parameter.
 *
 * @param string $user User name
 *
 * @return array
 */
function get_login_credentials($user)
{
    /* Optionally we can use passed username */
    if (! empty($user)) {
        return [
            $user,
            'password',
        ];
    }
    /* Here we would retrieve the credentials */
    return [
        'root',
        '',
    ];
}

参见

$cfg['Servers'][$i]['auth_type'], $cfg['Servers'][$i]['SignonSession'], $cfg['Servers'][$i]['SignonCookieParams'], $cfg['Servers'][$i]['SignonScript'], $cfg['Servers'][$i]['SignonURL'], Example for signon authentication

Config 认证方式

This mode is sometimes the less secure one because it requires you to fill the $cfg['Servers'][$i]['user'] and $cfg['Servers'][$i]['password'] fields (and as a result, anyone who can read your config.inc.php can discover your username and password).
在 ISPs, multi-user installations 一节中将会说明如何保护您的配置文件。
为了让该认证方式更加安全，您还可以考虑使用主机认证的 $cfg['Servers'][$i]['AllowDeny']['order'] 和 $cfg['Servers'][$i]['AllowDeny']['rules'] 指令。
与 cookie 和 http 不同，在访问 phpMyAdmin 时 config 认证方式不会要求用户登录。虽然设计如此但这将导致任意用户都能访问。我们建议使用某些方式进行限制，如一个含有要求 HTTP 认证指令的 .htaccess 文件或者从路由器或防火墙设置禁止特定的 HTTP 访问（上述方法均不属于本文档的范围，但可以很容易地通过 Google 搜索到）。

加固您的 phpMyAdmin 安装

The phpMyAdmin team tries hard to make the application secure, however there are always ways to make your installation more secure:

Follow our Security announcements and upgrade phpMyAdmin whenever new vulnerability is published.
Serve phpMyAdmin on HTTPS only. Preferably, you should use HSTS as well, so that you’re protected from protocol downgrade attacks.
Ensure your PHP setup follows recommendations for production sites, for example display_errors should be disabled.
Remove the test directory from phpMyAdmin, unless you are developing and need a test suite.
从phpMyAdmin中删除``setup``目录，初始设置后你可能不会使用它。
正确选择认证方式 - Cookie 认证方式是共享主机的最好选择。
Deny access to auxiliary files in ./libraries/ or ./templates/ subfolders in your webserver configuration. Such configuration prevents from possible path exposure and cross side scripting vulnerabilities that might happen to be found in that code. For the Apache webserver, this is often accomplished with a .htaccess file in those directories.
Deny access to temporary files, see $cfg['TempDir'] (if that is placed inside your web root, see also Web server upload/save/import directories.
It is generally a good idea to protect a public phpMyAdmin installation against access by robots as they usually can not do anything good there. You can do this using robots.txt file in the root of your webserver or limit access by web server configuration, see 1.42 How can I prevent robots from accessing phpMyAdmin?.
In case you don’t want all MySQL users to be able to access phpMyAdmin, you can use $cfg['Servers'][$i]['AllowDeny']['rules'] to limit them or $cfg['Servers'][$i]['AllowRoot'] to deny root user access.
为您的账户启用双因素身份验证。
Consider hiding phpMyAdmin behind an authentication proxy, so that users need to authenticate prior to providing MySQL credentials to phpMyAdmin. You can achieve this by configuring your web server to request HTTP authentication. For example in Apache this can be done with:
```
AuthType Basic
AuthName "Restricted Access"
AuthUserFile /usr/share/phpmyadmin/passwd
Require valid-user
```
Once you have changed the configuration, you need to create a list of users which can authenticate. This can be done using the htpasswd utility:
```
htpasswd -c /usr/share/phpmyadmin/passwd username
```
If you are afraid of automated attacks, enabling Captcha by $cfg['CaptchaLoginPublicKey'] and $cfg['CaptchaLoginPrivateKey'] might be an option.
Failed login attemps are logged to syslog (if available, see $cfg['AuthLog']). This can allow using a tool such as fail2ban to block brute-force attempts. Note that the log file used by syslog is not the same as the Apache error or access log files.
In case you’re running phpMyAdmin together with other PHP applications, it is generally advised to use separate session storage for phpMyAdmin to avoid possible session-based attacks against it. You can use $cfg['SessionSavePath'] to achieve this.

Using SSL for connection to database server

It is recommended to use SSL when connecting to remote database server. There are several configuration options involved in the SSL setup:

$cfg['Servers'][$i]['ssl']

Defines whether to use SSL at all. If you enable only this, the connection will be encrypted, but there is not authentication of the connection - you can not verify that you are talking to the right server.

$cfg['Servers'][$i]['ssl_key'] and $cfg['Servers'][$i]['ssl_cert']

This is used for authentication of client to the server.

$cfg['Servers'][$i]['ssl_ca'] and $cfg['Servers'][$i]['ssl_ca_path']

The certificate authorities you trust for server certificates. This is used to ensure that you are talking to a trusted server.

$cfg['Servers'][$i]['ssl_verify']

This configuration disables server certificate verification. Use with caution.

参见

Google Cloud SQL with SSL, $cfg['Servers'][$i]['ssl'], $cfg['Servers'][$i]['ssl_key'], $cfg['Servers'][$i]['ssl_cert'], $cfg['Servers'][$i]['ssl_ca'], $cfg['Servers'][$i]['ssl_ca_path'], $cfg['Servers'][$i]['ssl_ciphers'], $cfg['Servers'][$i]['ssl_verify']

Known issues

Users with column-specific privileges are unable to “Browse”

If a user has only column-specific privileges on some (but not all) columns in a table, “Browse” will fail with an error message.

As a workaround, a bookmarked query with the same name as the table can be created, this will run when using the “Browse” link instead. Issue 11922.

Trouble logging back in after logging out using ‘http’ authentication

When using the ‘http’ auth_type, it can be impossible to log back in (when the logout comes manually or after a period of inactivity). Issue 11898.