phpMyAdmin setup

Problems with the Windows version of XAMPP, questions, comments, and anything related.

phpMyAdmin setup

Postby regriff » 28. November 2004 21:11

A few questions about phpMyAdmin:

When I first click on phpMyAdmin I see the following message on the right:

"Your configuration file contains settings (root with no password) that correspond to the default MySQL privileged account. Your MySQL server is running with this default, is open to intrusion, and you really should fix this security hole."


I am assuming these security holes are the users with no passwords in the Privileges section. When I click the Privileges tab I see this:

User overview

User -------Host -----Password --- Global privileges --- Grant
Any ----------- % ---------- No ---------------- USAGE ------------- No
pma ------- localhost ------ No ------------ ALL PRIVILEGES ------ Yes
root ------- localhost ------ No ------------ ALL PRIVILEGES ------ Yes
testuser --- localhost ---- Yes ------------ ALL PRIVILEGES ------ Yes


Can I delete all the users and create my own? What is PMA? Global privileges? Grant? What do I need to change to secure phpMyAdmin? Thank you all emensely for your assistance.
regriff
 
Posts: 9
Joined: 25. November 2004 02:08
Location: Maryland, USA

Postby Wiedmann » 28. November 2004 21:28

Can I delete all the users and create my own?

All, except off "root" and "pma".
http://www.apachefriends.org/en/faq-xam ... #password0

What is PMA?

A service User for phMyAdmin. You should secure it too.
http://www.phpmyadmin.net/documentation/

Global privileges? Grant?

Different privileges:
http://dev.mysql.com/doc/mysql/en/Privilege_system.html
Wiedmann
AF Moderator
 
Posts: 17106
Joined: 01. February 2004 12:38
Location: Stuttgart / Germany

Thanks!

Postby regriff » 29. November 2004 21:27

Thank you very much! One problem. When changing the password of the PMA I am getting errors.

I getting this error:
MySQL said:

#1045 - Access denied for user: 'pma@localhost' (Using password: NO)


I followed your instructions to change the user root and it seemed to work fine. However, when I attempted the same process on user PMA I was able to change the password using the console command but when I tried to find it in the config.inc.php I was unable to and I'm guessing that's why I am getting this error. What am I doing wrong?
regriff
 
Posts: 9
Joined: 25. November 2004 02:08
Location: Maryland, USA

Postby Wiedmann » 29. November 2004 21:34

#1045 - Access denied for user: 'pma@localhost' (Using password: NO)

You must change the setting in "config.inc.php", too.
Wiedmann
AF Moderator
 
Posts: 17106
Joined: 01. February 2004 12:38
Location: Stuttgart / Germany

Postby regriff » 29. November 2004 21:44

Can you give me an idea of where to find the PMA data to change in the config file? I did a search and cannot find a string like the root one for pma. Thank you.
regriff
 
Posts: 9
Joined: 25. November 2004 02:08
Location: Maryland, USA

Postby Wiedmann » 29. November 2004 22:09

You can read that in the documentation at phpmyadmin.net ...

Code: Select all
$cfg['blowfish_secret'] = 'password'; // $cfg['blowfish_secret'] = 'password';
$cfg['Servers'][$i]['controluser']   = 'pma';       // MySQL control user settings
                                                    // (this user must have read-only
$cfg['Servers'][$i]['controlpass']   = '';          // access to the "mysql/user"
                                                    // and "mysql/db" tables)
Wiedmann
AF Moderator
 
Posts: 17106
Joined: 01. February 2004 12:38
Location: Stuttgart / Germany

Postby regriff » 30. November 2004 00:01

Thanks again, you're wonderful! I wasn't searching for the label 'controluser', thank you!
regriff
 
Posts: 9
Joined: 25. November 2004 02:08
Location: Maryland, USA

User ANY

Postby regriff » 30. November 2004 00:06

User ANY , Global Privileges USAGE

What exactly is the ANY user? Is that referring to anyone that comes to my site and wants to see something on the page, or is this just for administrative purposes and I do not need to have a ANY user? Thank you!!
regriff
 
Posts: 9
Joined: 25. November 2004 02:08
Location: Maryland, USA

Postby Wiedmann » 30. November 2004 00:50

What exactly is the ANY user?

Hmm, any user is any user --> everybody


Is that referring to anyone that comes to my site and wants to see something on the page

These privileges (for "root", "pma", "ANY") only effect the access to MySQL.

and I do not need to have a ANY user?

I don't know, it's your server ;-) But normaly, you don't need the "ANY" user and you should delete it.
Wiedmann
AF Moderator
 
Posts: 17106
Joined: 01. February 2004 12:38
Location: Stuttgart / Germany

Postby regriff » 30. November 2004 00:56

Thank you immensely for all your help. You've taught me so much, thank you thank you!!

~Ryan
regriff
 
Posts: 9
Joined: 25. November 2004 02:08
Location: Maryland, USA

Postby sckoh » 01. March 2005 23:45

I configured as below. Is it okay?
How about HOST name %?
USER HOST PWD PRIVILEGES GRANT
pma localhost YES ALL PRIVILEGES YES
root % NO USAGE NO
root localhost YES ALL PRIVILEGES YES
Image
User avatar
sckoh
 
Posts: 67
Joined: 01. March 2005 02:16
Location: Washington DC

Postby Dave_L » 02. March 2005 00:19

pma should look like this: pma localhost No USAGE No

You need to click the edit icon at the right to see the detailed grants for that user.

pma (phpMyAdmin control user) only needs some very restricted privileges. These are explained in the Documentation.html file in the phpMyAdmin directory, in the section "Using authentication modes".

And if you're using phpMyAdmin >= 2.6.1 and MySQL >= 4.1.2, you may not need that user at all. From Documentation.html for phpMyAdmin 2.6.1-pl2:
Note: starting with phpMyAdmin 2.6.1, configuring the controluser to enable HTTP and cookie authentication applies only to MySQL servers older than 4.1.2.
User avatar
Dave_L
 
Posts: 212
Joined: 23. October 2004 00:43

Re: phpMyAdmin setup

Postby fumbling » 16. January 2009 03:26

I had a similar issue. When I tried to change the password, I got the following error:
Error
SQL query:

SET PASSWORD FOR 'root'@'[my email address here]' = PASSWORD( '*********' )

MySQL said:

#1133 - Can't find any matching row in the user table


where it reads [my email address here] in the above is my email address. That looks like it could be the problem, because essentially it reads 'root'@[something]@[something].com, which can't be right with two @ symbols I wouldn't think.

Any ideas?
fumbling
 
Posts: 6
Joined: 16. January 2009 03:19

Re: phpMyAdmin setup

Postby Izzy » 16. January 2009 03:47

Are you using PMA or command console for example.

Do you think you could tell us what you are doing in more detail please or start a new topic perhaps.

BTW this topic is nearly 5 years old and all XAMPP components have changed considerably over the years.
Izzy
 
Posts: 3344
Joined: 25. April 2006 17:06

Re: phpMyAdmin setup

Postby fumbling » 16. January 2009 22:51

Thanks, I created a new thread with more details here:

viewtopic.php?f=16&t=32890

Appreciate your help.
fumbling
 
Posts: 6
Joined: 16. January 2009 03:19

Next

Return to XAMPP for Windows

Who is online

Users browsing this forum: No registered users and 63 guests

cron