4 ms·
The issue behind phpMyAdmin IMHO neither is the fact that it's written in PHP nor that it looks unsexy. The problem is that it exists. It's too tempting to lea
by pilif 14y ago
The issue behind phpMyAdmin IMHO neither is the fact that it's written in PHP nor that it looks unsexy. The problem is that it exists.
It's too tempting to leave it running on some server and promptly forget it. Or get it installed without knowing by some third-party CMS.
Even if it had a spotless security track record (it doesn't), this is just too big an attack surface.
MySQL and especially Postgres have really good command line utilities you can use over SSH which will have the additional advantage of you learning DDL syntax for emergencies. And of course GUIs exist too (use SSH port forwarding).
About Bike: I didn't install it, but this looks like a pure frontend to type in queries and get back results. This provides the security problems of phpMyAdmin minus the specialized GUI to save you from learning DDL or server internals.
As such it provides the worst of both worlds. I wouldn't call that "phpMyAdmin for geeks". CLI mysql is phpMyAdmin for geeks.
- laumars 14y agoTo be honest i do run phpMyAdmin, but I run it on a subdomain that has HTTP auth over SSL and the log files are included by fail2ban scans (thus anyone that fails to HTTP auth correctly 3 times gets auto-banned in iptables). So while I do agree with your points regarding phpMyAdmin, you can have the convenience of running it (and securely) if you really wanted to.
- Kudos 14y agoNone of those things protect you from security exploits in phpMyAdmin.
- laumars 14y agoActually they do. My method prevents attackers from being able to access phpMyAdmin in the first place and thus if an attacker cannot access phpMyAdmin, then they can't exploit any of the vulnerabilities within phpMyAdmin. Prevention is definitely better than a cure in this instance; preventing the unwanted from accessing phpMyAdmin is better than fixing all the vulnerabilities and hoping that an attacker doesn't discoverer a new exploit.
- r00fus 14y agoSo wouldn't you just setup a simple secure tunnel and run this on your local dev machine (with key-auth and an ssh agent to manage the connections)? That's how I run my phpAdmin. No server security issues.
- pilif 14y agoThat of course works too, but then again, I wonder what features of phpMyAdmin warrant the overhead of actually installing it plus the webserver it needs as opposed to just using the mysql command line tool (honest question - I haven't been using MySQL in a long time and on Postgres' side there's nothing that a GUI would allow me to do quicker than what I can do in the CLI psql utility)
- Bootvis 14y agoThere are a ton of things I can do quicker in a GUI when using Postgres. That's simply because I'm not proficient with the Postgres CLI. Of course I can and try to fix that, but that takes time I don't always have.
- deleted 14y ago[deleted]
- roel_v 14y agoEasier to scroll through large result sets, especially for tables with many columns. It's quite hard to mentally parse a bunch of entries that don't line up in a console.
- antihero 14y agoYep, but if you do that you may as well use something like MySQL Workbench, which is fucking awesome, or pgAdmin III, which is okay.
- quattrofan 14y agoAgreed, seen time and time again how this has become a liability for clients. I either command line in over SSH or open up a tunnel and use SQLYog.