Bike - phpMyAdmin replacement for geeks • Hacker News Board

Re: Bike - phpMyAdmin replacement for geeks

#41

Post by [deleted] » Wed, Jun 27, 2012, 12:29 PM UTC

Bootvis wrote: post #31

pilif wrote: post #25

Earlier quoted context omitted.

That of course works too, but then again, I wonder what features of phpMyAdmin warrant the overhead of actually installing it plus the webserver it needs as opposed to just using the mysql command line tool (honest question - I haven't been using MySQL in a long time and on Postgres' side there's nothing that a GUI would allow me to do quicker than what I can do in the CLI psql utility)

There are a ton of things I can do quicker in a GUI when using Postgres. That's simply because I'm not proficient with the Postgres CLI. Of course I can and try to fix that, but that takes time I don't always have.

[deleted]

Re: Bike - phpMyAdmin replacement for geeks

#42

Post by Kudos » Wed, Jun 27, 2012, 12:30 PM UTC

laumars wrote: post #34

pilif wrote: post #6

The issue behind phpMyAdmin IMHO neither is the fact that it's written in PHP nor that it looks unsexy. The problem is that it exists. It's too tempting to leave it running on some server and promptly forget it. Or get it installed without knowing by some third-party CMS. Even if it had a spotless security track record (it doesn't), this is just too big an attack surface. MySQL and especially Postgres have really goo…

To be honest i do run phpMyAdmin, but I run it on a subdomain that has HTTP auth over SSL and the log files are included by fail2ban scans (thus anyone that fails to HTTP auth correctly 3 times gets auto-banned in iptables). So while I do agree with your points regarding phpMyAdmin, you can have the convenience of running it (and securely) if you really wanted to.

None of those things protect you from security exploits in phpMyAdmin.

Re: Bike - phpMyAdmin replacement for geeks

#43

Post by roel_v » Wed, Jun 27, 2012, 12:37 PM UTC

pilif wrote: post #25

r00fus wrote: post #19

Earlier quoted context omitted.

So wouldn't you just setup a simple secure tunnel and run this on your local dev machine (with key-auth and an ssh agent to manage the connections)? That's how I run my phpAdmin. No server security issues.

That of course works too, but then again, I wonder what features of phpMyAdmin warrant the overhead of actually installing it plus the webserver it needs as opposed to just using the mysql command line tool (honest question - I haven't been using MySQL in a long time and on Postgres' side there's nothing that a GUI would allow me to do quicker than what I can do in the CLI psql utility)

Easier to scroll through large result sets, especially for tables with many columns. It's quite hard to mentally parse a bunch of entries that don't line up in a console.

Re: Bike - phpMyAdmin replacement for geeks

#44

Post by frenchfries » Wed, Jun 27, 2012, 2:45 PM UTC

Geeks use mysql from the command line

Re: Bike - phpMyAdmin replacement for geeks

#45

Post by _b8r0 » Thu, Jun 28, 2012, 7:31 AM UTC

justindocanto wrote: post #36

_b8r0 wrote: post #27

Earlier quoted context omitted.

The two simple ways of addressing this are to use some sort of folder level authentication (e.g. htaccess and htpasswd or equivalent) and to make sure it's not referenced in sitemaps or robots.txt, nor linked to from elsewhere on the net.

Those are nice suggestions and all but I already see one way to abuse this script since it's in the public html folder and pretty much wide open to attack if you can gain access to it. Let's say i see your site has timthumb and it hasn't been updated to the new, more secure, version. Perfect! I'll just use your timthumb to grab your htaccess file and see what folders your hiding. Alright so (theoretically) it looks l…

I tried to reply a few times last night but was having problems.

You're absolutely right about timbthumb. I was referring to bike in isolation, which of course it never will be. Having said that, the same applies to phpmyadmin and other apps that you might have. Indeed, timbthumb is a common way of breaking into weak wordpress themes and plugins.

Just to be clear I wasn't suggesting using a random folder name. I've never been one for security by obscurity, but by keeping anything you don't want near the Internet restricted from the great unwashed (and by following an appropriate application security strategy) then you have a better chance than just putting this under /bike and open to the world.

Re: Bike - phpMyAdmin replacement for geeks

#46

Post by shellox » Thu, Jun 28, 2012, 10:43 AM UTC

perssontm wrote: post #20

shellox wrote: post #10

Earlier quoted context omitted.

A bit of topic, but wasn't tm the expensive tld which you need to register for 10 years? When no can you tell me where you registered yours?

Yeah, it is, but I have a long commitment to my last name. :)

Sounds plausible. I had also a lot of luck with a .ch domain, which fits my lastname ;)

Re: Bike - phpMyAdmin replacement for geeks

#47

Post by laumars » Thu, Jun 28, 2012, 10:59 AM UTC

Kudos wrote: post #42

laumars wrote: post #34

Earlier quoted context omitted.

To be honest i do run phpMyAdmin, but I run it on a subdomain that has HTTP auth over SSL and the log files are included by fail2ban scans (thus anyone that fails to HTTP auth correctly 3 times gets auto-banned in iptables). So while I do agree with your points regarding phpMyAdmin, you can have the convenience of running it (and securely) if you really wanted to.

None of those things protect you from security exploits in phpMyAdmin.

Actually they do. My method prevents attackers from being able to access phpMyAdmin in the first place and thus if an attacker cannot access phpMyAdmin, then they can't exploit any of the vulnerabilities within phpMyAdmin.

Prevention is definitely better than a cure in this instance; preventing the unwanted from accessing phpMyAdmin is better than fixing all the vulnerabilities and hoping that an attacker doesn't discoverer a new exploit.