Fix phpMyAdmin SSO login and harden SSO/security posture
phpMyAdmin login was broken because phpmyadmin_install.sh never wired the private phpMyAdmin copy into the web server: no Apache Alias was registered via DirectAdmin CustomBuild, so the SSO redirect target was unreachable. Add configure_apache_alias()/apply_apache_alias() (Alias + Directory blocks, ./build rewrite_confs, httpd reload), detect the real Apache group instead of hardcoding diradmin:diradmin, stop silently swallowing chown/chmod failures, and verify an optional SHA256 for the downloaded phpMyAdmin tarball. Extend phpmyadmin_health_check.sh to detect a missing/incorrect Apache alias and to probe HTTP reachability. Security hardening: scope temporary phpMyAdmin SSO MySQL roles to 127.0.0.1 instead of '%', tighten SSO ticket file permissions to 0640 (they contain a plaintext MySQL password), and log MySQL connection failures for diagnosis instead of swallowing them silently. Bump version to 1.2.12 and rebuild the release archive.
This commit is contained in:
Marek Miklewicz
@@ -2,8 +2,10 @@
|
||||
set -euo pipefail
|
||||
|
||||
PHPMYADMIN_PRIVATE_DIR="${PHPMYADMIN_PRIVATE_DIR:-${PHPMYADMIN_DIR:-/var/www/html/alt-mysql-phpmyadmin}}"
|
||||
PHPMYADMIN_URL_PATH="${PHPMYADMIN_URL_PATH:-/alt-mysql-phpmyadmin}"
|
||||
PHPMYADMIN_VERSION="${PHPMYADMIN_VERSION:-5.2.3}"
|
||||
PHPMYADMIN_TARBALL_URL="${PHPMYADMIN_TARBALL_URL:-https://files.phpmyadmin.net/phpMyAdmin/5.2.3/phpMyAdmin-5.2.3-all-languages.tar.gz}"
|
||||
PHPMYADMIN_TARBALL_SHA256="${PHPMYADMIN_TARBALL_SHA256:-}"
|
||||
PHPMYADMIN_DOWNLOAD_DIR="${PHPMYADMIN_DOWNLOAD_DIR:-/usr/local/src}"
|
||||
PHPMYADMIN_SOURCE_DIR="${PHPMYADMIN_SOURCE_DIR:-}"
|
||||
RUNTIME_DIR="${PHPMYADMIN_PRIVATE_DIR}/runtime"
|
||||
@@ -12,6 +14,11 @@ CONFIG_INC="${PHPMYADMIN_PRIVATE_DIR}/config.inc.php"
|
||||
SIGNON_SCRIPT="${PHPMYADMIN_PRIVATE_DIR}/da_signon.php"
|
||||
SIGNON_URL_PAGE="${PHPMYADMIN_PRIVATE_DIR}/da_login.php"
|
||||
BLOWFISH_SECRET_FILE="${RUNTIME_DIR}/blowfish_secret"
|
||||
CUSTOMBUILD_DIR="${CUSTOMBUILD_DIR:-/usr/local/directadmin/custombuild}"
|
||||
CB_BUILD="${CUSTOMBUILD_DIR}/build"
|
||||
APACHE_ALIAS_CUSTOM="${CUSTOMBUILD_DIR}/custom/ap2/conf/extra/httpd-alias.conf"
|
||||
APACHE_ALIAS_SOURCE="/etc/httpd/conf/extra/httpd-alias.conf"
|
||||
APACHE_ALIAS_CONFIGURE="${CUSTOMBUILD_DIR}/configure/ap2/conf/extra/httpd-alias.conf"
|
||||
|
||||
if [ "${PHPMYADMIN_INSTALL_ASSUME_ROOT:-0}" != "1" ] && [ "${EUID:-$(id -u)}" -ne 0 ]; then
|
||||
echo "Skrypt musi być uruchomiony jako root." >&2
|
||||
@@ -22,11 +29,54 @@ log() {
|
||||
printf 'phpMyAdmin alt-mysql: %s\n' "$*"
|
||||
}
|
||||
|
||||
warn() {
|
||||
printf 'phpMyAdmin alt-mysql: WARNING: %s\n' "$*" >&2
|
||||
}
|
||||
|
||||
die() {
|
||||
printf 'phpMyAdmin alt-mysql: %s\n' "$*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
chown_or_warn() {
|
||||
local owner="$1" errfile
|
||||
shift
|
||||
errfile="$(mktemp)"
|
||||
chown "$owner" "$@" 2>"$errfile" || warn "chown $owner $* failed: $(cat "$errfile")"
|
||||
rm -f "$errfile"
|
||||
}
|
||||
|
||||
chmod_or_warn() {
|
||||
local mode="$1" errfile
|
||||
shift
|
||||
errfile="$(mktemp)"
|
||||
chmod "$mode" "$@" 2>"$errfile" || warn "chmod $mode $* failed: $(cat "$errfile")"
|
||||
rm -f "$errfile"
|
||||
}
|
||||
|
||||
detect_apache_group() {
|
||||
local group_name=""
|
||||
|
||||
if [ -f /etc/httpd/conf/httpd.conf ]; then
|
||||
group_name="$(awk 'tolower($1)=="group" {print $2; exit}' /etc/httpd/conf/httpd.conf | tr -d '[:space:]')"
|
||||
fi
|
||||
|
||||
if [ -z "$group_name" ] && [ -f /etc/apache2/apache2.conf ]; then
|
||||
group_name="$(awk 'tolower($1)=="group" {print $2; exit}' /etc/apache2/apache2.conf | tr -d '[:space:]')"
|
||||
fi
|
||||
|
||||
if [ -z "$group_name" ]; then
|
||||
for candidate in apache www-data nobody; do
|
||||
if getent group "$candidate" >/dev/null 2>&1; then
|
||||
group_name="$candidate"
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
printf '%s\n' "${group_name:-diradmin}"
|
||||
}
|
||||
|
||||
install_private_copy_from_source() {
|
||||
local source_dir="$1"
|
||||
[ -d "$source_dir" ] || die "Katalog źródłowy phpMyAdmin nie istnieje: $source_dir"
|
||||
@@ -49,6 +99,16 @@ download_private_copy() {
|
||||
curl -fL --retry 3 --connect-timeout 20 -o "$tarball" "$PHPMYADMIN_TARBALL_URL"
|
||||
fi
|
||||
|
||||
if [ -n "$PHPMYADMIN_TARBALL_SHA256" ]; then
|
||||
command -v sha256sum >/dev/null 2>&1 || die "Brak sha256sum do weryfikacji archiwum phpMyAdmin."
|
||||
local actual_sum
|
||||
actual_sum="$(sha256sum "$tarball" | awk '{print $1}')"
|
||||
[ "$actual_sum" = "$PHPMYADMIN_TARBALL_SHA256" ] || {
|
||||
rm -f "$tarball"
|
||||
die "Niezgodna suma SHA256 archiwum phpMyAdmin. Oczekiwano: ${PHPMYADMIN_TARBALL_SHA256}, otrzymano: ${actual_sum}"
|
||||
}
|
||||
fi
|
||||
|
||||
tmp_dir="$(mktemp -d)"
|
||||
tar -xzf "$tarball" -C "$tmp_dir"
|
||||
extracted="$(find "$tmp_dir" -mindepth 1 -maxdepth 1 -type d -name 'phpMyAdmin-*' -print -quit)"
|
||||
@@ -474,13 +534,86 @@ function get_login_credentials($user = ''): array
|
||||
}
|
||||
PHP
|
||||
|
||||
local apache_group
|
||||
apache_group="$(detect_apache_group)"
|
||||
|
||||
mkdir -p "$RUNTIME_DIR/tmp"
|
||||
chown -R diradmin:diradmin "$RUNTIME_DIR" "$CONFIG_INC" "$SIGNON_SCRIPT" "$SIGNON_URL_PAGE" 2>/dev/null || true
|
||||
chmod 755 "$RUNTIME_DIR" "$TICKETS_DIR" "$RUNTIME_DIR/tmp" 2>/dev/null || true
|
||||
chmod 644 "$CONFIG_INC" "$SIGNON_SCRIPT" "$SIGNON_URL_PAGE" "$RUNTIME_DIR/.htaccess" "$TICKETS_DIR/.htaccess" "$RUNTIME_DIR/index.html" "$TICKETS_DIR/index.html" 2>/dev/null || true
|
||||
chown_or_warn root:root "$PHPMYADMIN_PRIVATE_DIR"
|
||||
chmod_or_warn 755 "$PHPMYADMIN_PRIVATE_DIR"
|
||||
chown_or_warn "diradmin:${apache_group}" "$RUNTIME_DIR" "$TICKETS_DIR" "$RUNTIME_DIR/tmp" "$CONFIG_INC" "$SIGNON_SCRIPT" "$SIGNON_URL_PAGE"
|
||||
chmod_or_warn 711 "$RUNTIME_DIR" "$RUNTIME_DIR/tmp"
|
||||
chmod_or_warn 2733 "$TICKETS_DIR"
|
||||
chmod_or_warn 644 "$CONFIG_INC" "$SIGNON_SCRIPT" "$SIGNON_URL_PAGE" "$RUNTIME_DIR/.htaccess" "$TICKETS_DIR/.htaccess" "$RUNTIME_DIR/index.html" "$TICKETS_DIR/index.html"
|
||||
}
|
||||
|
||||
configure_apache_alias() {
|
||||
if [ ! -d "$CUSTOMBUILD_DIR" ]; then
|
||||
warn "Brak katalogu CustomBuild: ${CUSTOMBUILD_DIR} - pomijam konfigurację aliasu Apache. Skonfiguruj go ręcznie: Alias ${PHPMYADMIN_URL_PATH} ${PHPMYADMIN_PRIVATE_DIR}"
|
||||
return 0
|
||||
fi
|
||||
|
||||
mkdir -p "$(dirname "$APACHE_ALIAS_CUSTOM")"
|
||||
|
||||
if [ ! -f "$APACHE_ALIAS_CUSTOM" ]; then
|
||||
if [ -f "$APACHE_ALIAS_SOURCE" ]; then
|
||||
cp -p "$APACHE_ALIAS_SOURCE" "$APACHE_ALIAS_CUSTOM"
|
||||
elif [ -f "$APACHE_ALIAS_CONFIGURE" ]; then
|
||||
cp -p "$APACHE_ALIAS_CONFIGURE" "$APACHE_ALIAS_CUSTOM"
|
||||
else
|
||||
warn "Nie znaleziono źródłowego httpd-alias.conf - tworzę pusty szablon custom."
|
||||
: > "$APACHE_ALIAS_CUSTOM"
|
||||
fi
|
||||
fi
|
||||
|
||||
local tmp_file
|
||||
tmp_file="$(mktemp)"
|
||||
awk '
|
||||
BEGIN { skip = 0 }
|
||||
/^# BEGIN ALT_MYSQL_PHPMYADMIN$/ { skip = 1; next }
|
||||
/^# END ALT_MYSQL_PHPMYADMIN$/ { skip = 0; next }
|
||||
skip == 0 { print }
|
||||
' "$APACHE_ALIAS_CUSTOM" > "$tmp_file"
|
||||
|
||||
cat >> "$tmp_file" <<EOF
|
||||
|
||||
# BEGIN ALT_MYSQL_PHPMYADMIN
|
||||
Alias ${PHPMYADMIN_URL_PATH} ${PHPMYADMIN_PRIVATE_DIR}
|
||||
|
||||
<Directory "${PHPMYADMIN_PRIVATE_DIR}">
|
||||
AllowOverride None
|
||||
Options -Indexes
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
<Directory "${RUNTIME_DIR}">
|
||||
AllowOverride None
|
||||
Options -Indexes
|
||||
Require all denied
|
||||
</Directory>
|
||||
# END ALT_MYSQL_PHPMYADMIN
|
||||
EOF
|
||||
|
||||
mv "$tmp_file" "$APACHE_ALIAS_CUSTOM"
|
||||
chmod_or_warn 644 "$APACHE_ALIAS_CUSTOM"
|
||||
}
|
||||
|
||||
apply_apache_alias() {
|
||||
if [ -x "$CB_BUILD" ]; then
|
||||
(cd "$CUSTOMBUILD_DIR" && ./build rewrite_confs) || warn "rewrite_confs zakończyło się błędem - uruchom ręcznie: cd ${CUSTOMBUILD_DIR} && ./build rewrite_confs"
|
||||
else
|
||||
warn "Brak ${CB_BUILD} - uruchom ręcznie: cd ${CUSTOMBUILD_DIR} && ./build rewrite_confs"
|
||||
fi
|
||||
|
||||
if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet httpd 2>/dev/null; then
|
||||
systemctl reload httpd || warn "Nie udało się przeładować httpd."
|
||||
fi
|
||||
}
|
||||
|
||||
ensure_private_copy
|
||||
write_private_config
|
||||
configure_apache_alias
|
||||
if [ "${PHPMYADMIN_SKIP_APACHE_RELOAD:-0}" != "1" ]; then
|
||||
apply_apache_alias
|
||||
fi
|
||||
|
||||
log "Prywatna kopia phpMyAdmin dla alt-mysql jest gotowa w ${PHPMYADMIN_PRIVATE_DIR}."
|
||||
|
||||
Reference in New Issue
Block a user