Le jeudi 07 avril 2005 à 13:05 +0200, Piotr Roszatycki a écrit : > > It looks quite dangerous security wise. Could the overlapping > > parameters (order, allow mostly) be removed from one of the file > > ? > > You're probably right, the /etc/phpmyadmin/htaccess file shouldn't override > global configuration but I don't understand why it might be so dangerouse. At > least it is the conffile which can be modified by administrator.
Not so dangerous else i would have set it to serious or such. There is really no hurry. I set all my admin web applications as localhost until i feel confident with the setup. You guess that i was wondering why my phpmyadmin was still accessible from the web after setting the Allow to localhost :) The "Allow All" opening everything , whatever it is set in apache.conf is discarded. What would you think about setting Allow to localhost only by default ? I want to advocate it. Either the user know how to open it wider or he know so few about web server that he probably don't have a properly setup firewall ... This may seems unbelievable but 14000 mysql server where infected by a worm due to this problem. It was open to all and user did not close the port with their firewall (and apache virtual host being on 80 most user that want to serve pages but don't want to open admin on the net would be affected by an xss in phpmyadmin). And phpmyadmin would workaround the localhost default of mysql admin. As users of mysql are often users of mysql i guess the skills of their admins are quite the same. For example apache is open on localhost by default but phpmyadmin would still be accessible from the net if one use the ip instead of the fqdn ... I really don't see such a "policy" change for sarge though it looks interesting to look after it for post sarge (and the newborn web applications policy, well only dbconfig-common policy by now) Alban
