phpMyAdmin is installed with CentOS Web Panel. By default, it is not protected and there is only MySQL user authentication. This can put your server vulnerable. So it is recommended to add additional layer protection.
phpMyAdmin is available through the following url in a CWP based server.
http:/hostname/phpmyadmin
http:/hostname:2030/pma
CWP panel runs its core services through its own version of Nginx. So normal htaccess based password protection will not work.
Create the Password File
You can do this by using the OpenSSL utilities that may already be available on your server. Alternatively, you can use the purpose-made htpasswd utility included in the apache2-utils package(Debian/ubuntu) or httpd-tools(Redhat/Centos).
Using OpenSSL Utilities
We will create a hidden file called .pma_pass /usr/local/cwpsrv/var/services/ folder. You can use any username. I am using dbadmin here as an example
sudo sh -c "echo -n 'dbadmin:' >> /usr/local/cwpsrv/var/services/.pma_pass"
Next, add an encrypted password entry for the username by typing:
sudo sh -c "openssl passwd -apr1 >> /usr/local/cwpsrv/var/services/.pma_pass"
Using Apache Utilities
This tool is already installed and available on all CWP servers.
/usr/local/apache/bin/htpasswd -c /usr/local/cwpsrv/var/services/.pma_pass dbadmin
Configure Nginx Password Authentication
We will need to configure Nginx to read this file before serving our protected content.
CWP Service Nginx configuration file: /usr/local/cwpsrv/conf/cwp_services.conf
Open the above file add the following to the location block of phpMyAdmin.
auth_basic “Admin Login”;
auth_basic_user_file /usr/local/cwpsrv/var/services/pma_pass;
So the full block should look like this now.
location /pma {
root /usr/local/cwpsrv/var/services;
index index.html index.htm index.php;
ModSecurityEnabled off;
ModSecurityConfig /usr/local/cwpsrv/conf/security/conf/pma_rules.conf;
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_read_timeout 600;
fastcgi_pass unix:/usr/local/cwp/php71/var/sockets/cwpsvc.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
include fastcgi_params;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
access_log off;
log_not_found off;
expires 1M;
}
auth_basic "Admin Login";
auth_basic_user_file /usr/local/cwpsrv/var/services/.pma_pass;
}
Restart CWP nginx service by below commands
systemctl restart cwpsrv.service
Confirm the Password Authentication
To confirm that your content is protected, try to access your restricted content in a web browser. You should be presented with a username and password prompt