[GUIDE] Running PhpMyAdmin from vesta service

[ivcha92]

This will make PHP my admin run with PHP from vesta and be available on port 8083.

This guide is for setup with Nginx + PHP-FPM tested on Centos 7

First we make new temp directory for PHPMyAdmin to avoid permission issue.

Code: Select all

mkdir /tmp/phpMyAdmin
chmod 777 /tmp/phpMyAdmin

Then we add set this directory as TempDir to PhpMyAdmin configuration.

in file: /etc/phpMyAdmin/config.inc.php

Code: Select all

$cfg['TempDir'] = '/tmp/phpMyAdmin';

Nest thing we want to add admin user to apache group so that PhpMyAdmin can access the config file.

Code: Select all

 usermod -a -G apache admin

Next we edit the nginx configuration file to look like this. This also fixes the issue with documentation .
If you want you can pick change url suffix from phpmyadmin to something else by replacing "phpmyadmin" on each location parameter

in file: /etc/nginx/conf.d/phpmyadmin.inc

Code: Select all

location ^~ /phpmyadmin {
    alias /usr/share/phpMyAdmin;
    index index.php;

    location ^~ /[phpmyadmin/(libraries|setup) {
        return 404;
    }

    location ~ ^/phpmyadmin/(.*\.php)$ {
	alias /usr/share/phpMyAdmin/$1;
        fastcgi_pass unix:/var/run/vesta-php.sock;
	fastcgi_index index.php;
	include         /usr/local/vesta/nginx/conf/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $request_filename;
    }
    location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
        alias /usr/share/phpMyAdmin/$1;
    }
}

next we include phpmyadmin.ini vesta nginx.conf by adding the following line at the bottom of the server section

in file: /usr/local/vesta/nginx/conf/nginx.conf

Code: Select all

include /etc/nginx/conf.d/phpmyadmin.inc;

next restart the vesta service

Code: Select all

service vesta restart

In order to have link in admin panel working properly. open Vesta CP and under DB set phpMyAdmin URL as:

Code: Select all

/phpmyadmin/

Now you have PhpMyAdmin running via vesta service but it will sill be accessible at /phpmyadmin for each domain in order to disable it there modify your templates at /usr/local/vesta/data/templates/web/nginx/php-fpm/ and comment out with # or remove the following line :

Code: Select all

include /etc/nginx/conf.d/phpmyadmin.inc;

After modifying templates make sure to rebuild the users either from cli or by chaining template in Vesta CP

[Stesh]

Very very bad idea. In case of hacking PhpMyAdmin, the whole server will be hacked

[ivcha92]

Very very bad idea. In case of hacking PhpMyAdmin, the whole server will be hacked

Why do you think so. PhpMyAdmin will be running as vesta default user admin which does not have root access. It have same access as if you were running it from virtual host on admin user

[Stesh]

new install

Code: Select all

# v-delete-web-domain admin blabla.com
# service vesta stop
# v-add-user user password [email protected]
# v-add-web-domain user blabla.com

[mehargags]

Why do you think so. PhpMyAdmin will be running as vesta default user admin which does not have root access. It have same access as if you were running it from virtual host on admin user

Absolutely wrong on this point... the user "admin" has sudo privileges, so it as elevated access always.

However, I'm not sure if this guide is right or not, I guess Roundcube and PHPMyAdmin are installed globally and not sure if there is any security difference between using it this way.

[dpeca]

Bad idea for sure, brate.

Vesta-php is running as superuser.

In fact, phpmyadmin is also running as 'admin' via apache, but at least, you can disable dangerous functions in php.ini.
In vesta-php you can not disable 'eval' for example.

[dpeca]

If your idea is to run phpmyadmin via php-fpm, to avoid apache, then it's pretty easy to install separate php-fpm, trust me... mostly one apt-get/yum command...

[ivcha92]

Let me explain why I did that and why it is not so bad Idea. If you run phpmyadmin on vhosts it is accessible on port 80 and 443. Now I am running it on Vesta Nginx server so it is only accessible on port 8083 on which I can set firewall rule to allow only specific ip addresses to access it.

[ivcha92]

If your idea is to run phpmyadmin via php-fpm, to avoid apache, then it's pretty easy to install separate php-fpm, trust me... mostly one apt-get/yum command...

I don't use Apache it's Nginx + php-fpm setup

[ivcha92]

I have another idea for the super user permission. A new pool can be added for Vesta PHP-FPM and separate user can be created for phpmyadmin