marek-miklewicz/alt-mysql
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix phpMyAdmin SSO login and harden SSO/security posture

Browse Source 
phpMyAdmin login was broken because phpmyadmin_install.sh never wired
the private phpMyAdmin copy into the web server: no Apache Alias was
registered via DirectAdmin CustomBuild, so the SSO redirect target was
unreachable. Add configure_apache_alias()/apply_apache_alias() (Alias +
Directory blocks, ./build rewrite_confs, httpd reload), detect the real
Apache group instead of hardcoding diradmin:diradmin, stop silently
swallowing chown/chmod failures, and verify an optional SHA256 for the
downloaded phpMyAdmin tarball. Extend phpmyadmin_health_check.sh to
detect a missing/incorrect Apache alias and to probe HTTP reachability.

Security hardening: scope temporary phpMyAdmin SSO MySQL roles to
127.0.0.1 instead of '%', tighten SSO ticket file permissions to 0640
(they contain a plaintext MySQL password), and log MySQL connection
failures for diagnosis instead of swallowing them silently.

Bump version to 1.2.12 and rebuild the release archive.
This commit is contained in:
Marek Miklewicz
2026-07-04 19:16:09 +02:00
parent 78e3d66d9a
commit ba64342702
14 changed files with 390 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup/phpmyadmin_health_check.sh
+35
View File
@@ -2,16 +2,23 @@
set -euo pipefail
PHPMYADMIN_DIR="${PHPMYADMIN_PRIVATE_DIR:-${PHPMYADMIN_DIR:-/var/www/html/alt-mysql-phpmyadmin}}"
PHPMYADMIN_URL_PATH="${PHPMYADMIN_URL_PATH:-/alt-mysql-phpmyadmin}"
CONFIG_INC="${PHPMYADMIN_DIR}/config.inc.php"
SIGNON_SCRIPT="${PHPMYADMIN_DIR}/da_signon.php"
SIGNON_URL_PAGE="${PHPMYADMIN_DIR}/da_login.php"
RUNTIME_CONFIG="${PHPMYADMIN_DIR}/runtime/config.json"
CUSTOMBUILD_DIR="${CUSTOMBUILD_DIR:-/usr/local/directadmin/custombuild}"
APACHE_ALIAS_CUSTOM="${CUSTOMBUILD_DIR}/custom/ap2/conf/extra/httpd-alias.conf"
fail() {
printf 'phpMyAdmin alt-mysql health: %s\n' "$*" >&2
exit 1
}
warn() {
printf 'phpMyAdmin alt-mysql health: WARNING: %s\n' "$*" >&2
}
[ -d "$PHPMYADMIN_DIR" ] || fail "phpMyAdmin directory not found: $PHPMYADMIN_DIR"
[ -r "$PHPMYADMIN_DIR/index.php" ] || fail "phpMyAdmin index.php is not readable: $PHPMYADMIN_DIR/index.php"
[ -r "$CONFIG_INC" ] || fail "config.inc.php is not readable: $CONFIG_INC"
@@ -24,6 +31,13 @@ grep -Fq "da_mysql_login_consume_ticket" "$SIGNON_URL_PAGE" || fail "da_login.ph
grep -Fq "DA_MYSQL_DEFAULT_CONF = '/usr/local/directadmin/conf/alt-mysql.conf'" "$SIGNON_SCRIPT" \
|| fail "signon script does not default to alt-mysql.conf"
[ -r "$APACHE_ALIAS_CUSTOM" ] \
|| fail "Apache alias config not found: $APACHE_ALIAS_CUSTOM - phpMyAdmin is not reachable over HTTP, run phpmyadmin_install.sh"
grep -Fq "# BEGIN ALT_MYSQL_PHPMYADMIN" "$APACHE_ALIAS_CUSTOM" \
|| fail "Apache alias block missing in $APACHE_ALIAS_CUSTOM - phpMyAdmin is not reachable over HTTP, run phpmyadmin_install.sh"
grep -Fq "Alias ${PHPMYADMIN_URL_PATH} ${PHPMYADMIN_DIR}" "$APACHE_ALIAS_CUSTOM" \
|| fail "Apache alias in $APACHE_ALIAS_CUSTOM does not point at $PHPMYADMIN_DIR"
if [ -r "$RUNTIME_CONFIG" ] && command -v php >/dev/null 2>&1; then
php -r '
$path = $argv[1];
@@ -39,4 +53,25 @@ if [ -r "$RUNTIME_CONFIG" ] && command -v php >/dev/null 2>&1; then
' "$RUNTIME_CONFIG" || fail "runtime config validation failed"
fi
if [ -r "$RUNTIME_CONFIG" ] && command -v php >/dev/null 2>&1 && command -v curl >/dev/null 2>&1; then
PROBE_URL="$(php -r '
$data = json_decode(file_get_contents($argv[1]), true);
$base = trim((string)($data["phpmyadmin_public_base_url"] ?? ""));
$path = trim((string)($data["phpmyadmin_url_path"] ?? ""));
if ($base === "" || $path === "") {
exit(0);
}
echo rtrim($base, "/") . $path . "/da_login.php";
' "$RUNTIME_CONFIG" 2>/dev/null || true)"
if [ -n "$PROBE_URL" ]; then
HTTP_CODE="$(curl -s -o /dev/null -m 5 -w '%{http_code}' "$PROBE_URL" 2>/dev/null || true)"
if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" = "000" ]; then
warn "could not reach $PROBE_URL over HTTP (no response) - verify the webserver serves the Apache alias"
elif [ "$HTTP_CODE" = "404" ]; then
warn "$PROBE_URL returned HTTP 404 - the Apache alias may not be applied yet, run: cd ${CUSTOMBUILD_DIR} && ./build rewrite_confs && systemctl reload httpd"
fi
fi
fi
echo "phpMyAdmin alt-mysql health: OK"