Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PhpMyAdmin Project Successfully Completes Security Audit

phpmyadmin.net

Post reply on HN
Print view View original

71–80 of 112 posts

Re: PhpMyAdmin Project Successfully Completes Security Audit

#71

Post by Xeoncross »

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple.

Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port).

    ssh user@example.com -L 3306:localhost:3306
I would never run a DB admin application on the live server because it's just one more piece that might open a security hole.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#72

Post by ZenoArrow »

the_rosentotter wrote: post #60
ZenoArrow wrote: post #41

Earlier quoted context omitted.

Do any of these web-based DB tools come with autocomplete? I'd say that's the feature I value most when using desktop DB tools.

TeamPostgreSQL[1] is a pretty good web interface for Postgres. It has SQL autocompletion too, with completion for schema objects as well as SQL keywords. It is free. [1] http://www.teampostgresql.com

Thanks for the tip.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#73

Post by tobltobs »

dvt wrote: post #70
fideloper wrote: post #66

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security. No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers. Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good…

For a prospective hacker, I don't think there's much of a (functional) difference between a graphical interface or a shell.

I think he is talking about unnecessary additional attack vectors, not about functionality.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#74

Post by CiPHPerCoder »

ivanhoe wrote: post #68
fideloper wrote: post #66

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security. No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers. Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good…

Why do you presume that web app has to be run public? You can easily limit access to web app by IP, or you can put it on a private network that you will access through VPN. That would make it more secure than most web services that we trust regularly, like gmail or paypal...

If you're going to do this, go the VPN route.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#75

Post by richardwhiuk »

MustardTiger wrote: post #59
drzaiusapelord wrote: post #24

Earlier quoted context omitted.

No, it means we understand there are theoretical security issues with global variables, but cannot determine if they're actually applicable or exploitable in this software.

You just repeated exactly the same thing he said as if you were disagreeing.

A theoretical security vulnerability isn't really a think - it's just a bug. Either it's exploitable, and thus a security vulnerability, or it's a bug and isn't,

Re: PhpMyAdmin Project Successfully Completes Security Audit

#76

Post by hackaflocka »

smaili wrote: post #2

Does anyone still use this? I didn't realize this was still actively maintained.

PHPMyAdmin is a lifesaver for newbies and those who are intimidated by the Command Line. It was for me, and I still prefer to use it when possible.

I can't thank the people who created it and maintain it enough.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#77

Post by xrstf »

Xeoncross wrote: post #71

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

On Windows, I recommend using HeidiSQL, which handles SSH tunnels for you using PuTTY's plink.exe.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#79

Post by jquast »

arrmn wrote: post #35

Stupid question, how does a security audit work? Do the consultants just read through the code? Do they try to find security bug like they do on bug bounty programs?

The first few chapters of the book, "The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities" outlines a very meticulous process of reviewing source code for vulnerabilities in a professional manner.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#80

Post by jredwards »

xrstf wrote: post #77
Xeoncross wrote: post #71

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

On Windows, I recommend using HeidiSQL, which handles SSH tunnels for you using PuTTY's plink.exe.

I like some of the HeidiSQL tools so much that I run it via WINE on my mac.
Post reply on HN