Live data from Hacker News

PhpMyAdmin Project Successfully Completes Security Audit

phpmyadmin.net

81–90 of 112 posts

Re: PhpMyAdmin Project Successfully Completes Security Audit

#81
post #2

Does anyone still use this? I didn't realize this was still actively maintained.

I think it is one of the best mariadb/mysql gui's out there.

But to get the good stuff one has to configure it properly, and generally people don't bather configuring it. They just place the files in a folder.

No other web based tool for any database that i have tried even comes close.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#82

Earlier quoted context omitted.

Didn't postgresql community just annouced pgadmin4 lately and it seems to come with a modern webclient https://www.pgadmin.org/

Do any of these web-based DB tools come with autocomplete? I'd say that's the feature I value most when using desktop DB tools.

Latest version of PhpMyAdmin does, but not nearly as good as for example "Microsoft SQL Management" does for MsSQL.

My favorite feature is generally the graphical database relation view. Without it i am something like 500% less effective.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#84

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

Apart from security, are there any other benefits?

Re: PhpMyAdmin Project Successfully Completes Security Audit

#85
post #70

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security. No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers. Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good…

For a prospective hacker, I don't think there's much of a (functional) difference between a graphical interface or a shell.

The attack surface for a web application like phpmyadmin is the entire codebase of that application. The attack surface for mysql over an ssh tunnel is basically only the sshd daemon and its authentication configuration.

I think most people would agree which one exposes a greater likelihood of being hacked. Of course you can secure a phpmyadmin installation against even being accessed by attackers (I've done this in the past myself), but there is still a chance of such security measures being accidentally botched compared to the sshd configuration.

I don't feel strongly either way, if you are confident that your security measures on a phpmyadmin installation are solid. I for one, security audit or not, would never expose a phpmyadmin installation on a publicly accessible URL.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#86

Earlier quoted context omitted.

You just repeated exactly the same thing he said as if you were disagreeing.

A theoretical security vulnerability isn't really a think - it's just a bug. Either it's exploitable, and thus a security vulnerability, or it's a bug and isn't,

Yes it is. It is a bug, that may be exploitable. There's no contradiction there.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#87

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

Apart from security, are there any other benefits?

I presume it'd be faster, since only remote data is MySQL data, as opposed to web server/PHP rendering.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#88

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

Apart from security, are there any other benefits?

Sequel Pro (free open source, despite name) is a native application which is much nicer to use than phpMyAdmin. So, yes there's benefits other than security.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#89

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

Or learn how to use the CLI client to connect. No need to install a awkward wrapper software layer.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#90
post #89

I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple. Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port). ssh user@example.com -L 3306:localhost:3306 I would never run a DB admin application on the live server because it's just one more piece that mig…

Or learn how to use the CLI client to connect. No need to install a awkward wrapper software layer.

The "awkward wrapper software layer" has so many workflow enhancements and advantages over the ho-hum CLI client that it's not even funny.
Post reply on HN