An unsecured phpMyAdmin is one of the biggest security risk on most servers. First we create all users as username@localhost, then we open up a webinterface, allowing everybody to login as “@localhost”.
Great, isn’t it? So let’s use our old buddy fail2ban to reduce this risk quite a bit.
Out goal? Block a user’s IP for a certain amount of time after several failed logins.
First things first: we need a logfile. Usually, phpMyAdmin doesn’t log anything - but since we’re on our own Server, we can change that (given we’re using apache2).
The phpMyAdmin Documentation provides a possible solution.
But we have to keep a few things in mind:
- LogFormat/CustomLog have to be applied at Server Context or VirtualHost Context (see here). So our phpMyAdmin installation has to be it’s own VirtualHost. A subdomain will work fine.
- phpMyAdmin uses php’s apache_note function to make this work. AFAIK this function is only available in mod_php mode. This will not work with mod_fcgi & co.
Having taken this into consideration, we add these lines to our Apache Config in the according VirtualHost Section:
Don’t forget to reload your apache2 configuration:
service apache2 reload
Now we create our fail2ban filter
/etc/fail2ban/filter.d/phpmyadmin.conf
And we test if our filter is working (try logging into phpMyAdmin with wrong credentials for this to return something meaningful):
fail2ban-regex /var/log/apache2/phpmyadmin_access.log /etc/fail2ban/filter.d/phpmyadmin.conf
Looks good? Good. Then we just have to add our jail to /etc/fail2ban/jail.conf
Reload fail2ban one last time and you’re done.
service fail2ban reload