12

Services like phpMyadmin needs a domain name to access. Instead of adding a global DNS record, one could make a local DNS record (e.g. in /etc/hosts) to access the site.

Would it increase security if no global DNS record was made, if one assumes that other typical security measures (HTTPS, Password Authentication, etc.) are in place?

Improve this question
6
  • 2
    I changed the title and rephrased your question a bit. I hope this is still true to your original question. If not, please edit the question to clarify further.
    – user163495
    Commented Sep 16, 2019 at 11:34
  • 3
    "Would it increase security" in what way? To accomplish what?
    – schroeder ♦
    Commented Sep 16, 2019 at 13:16
  • 51
    phpMyAdmin is a security risk.
    – Mark
    Commented Sep 16, 2019 at 20:05
  • 4
    Why do you think, phpmyadmin needs an own (sub-)domain? It works just fine in a subfolder. On the question: I would use http auth (e.g. with a .htaccess file when you're using apache) for the URL of the phpmyadmin installation, this adds much more security than keeping the domain secret.
    – allo
    Commented Sep 17, 2019 at 8:07
  • 3
    @Mark For that matter, having a web server and a SQL server running is already a security risk.
    – Federico Poloni
    Commented Sep 17, 2019 at 14:56

3 Answers 3

Reset to default
29

This would qualify as 'Security through Obscurity' and offers little to no protection whatsoever.

The /etc/hosts file is NOT DNS; it's the precursor of DNS and anyone can change their own records in it.

A domain name is mainly for human use... the computer will just convert this to an IP address and use that (and send the hostname with it in HTTP 1.1+). While the domain name has a function in virtual host configurations it is not part of a security defence.

To increase security consider adding one of the following:

  • IP whitelisting your own IP & blacklist all others
  • External login provider through oAuth / SAML. (such as Google's login system)
  • Use client-side certificates to authorize access

All of these would improve security from least to most, but also from easiest to most difficult.

Improve this answer
3
  • 3
    "While the domain name has a function in virtual host configurations it is not part of a security defence." Well, I am not sure if I would agree with this 100%. Having a vhost that only responds to the hostnames it expects (no wildcards/forwarding and a dummy default vhost to answer the bare IP w/ a 410) can cut down on autoprobing. I wouldn't rely on this, just layer it on (and yes, you will still get probed one you are fingerprinted as running PHP). I would also add (or expand the third bullet) to include non-routable database access, and admin via a bastion host with key-only access.
    – mpdonadio
    Commented Sep 17, 2019 at 2:50
  • While I agree that an in depth security solution would have 'something' on the IP / wildcard location. either a static page or a http error code. its would be out of scope for phpMyAdmin. There is simply no reason every to expose it based on just the IP or a wildcard (imho). Your additions are good from a Datbase access view. but are out of scope for the question since its scoped about DNS.
    – LvB
    Commented Sep 17, 2019 at 10:14
  • To further add to @mpdonadio comment, in the world of TLS mass hosting, that is with the SNI extension, the webserver may react differently based on what is passed at the TLS level in the SNI extension or if nothing is passed, even before judging what is in the host HTTP header. Hence just knowing the IP address may not be enough to get access, one may need to know the website hostname.
    – Patrick Mevzek
    Commented Sep 17, 2019 at 15:41
7

No, it would not increase security. An attacker could still connect to phpMyAdmin if they knew the domain and IP, independent of whether a DNS record for it exists. For example, they could put the information in their own hosts file.

Improve this answer
2
  • But a good configured webserver will not reply to requests for hostnames not being configured in it. So even if you scan IP addresses and found the good one, when connecting to it, you may need to have the proper HTTP host header and/or TLS SNI extension before getting back any useful content.
    – Patrick Mevzek
    Commented Sep 17, 2019 at 15:39
  • @PatrickMevzek Yes, like I said, you need to know both the IP and hostname beforehand. Hostnames are not usually considered secret information, so the described method is STO
    – Jenessa
    Commented Sep 17, 2019 at 19:34
0

This would minimize the attack surface, however as other posters told - it is "security by obscurity" which could be one part of your defense line but not the only part.

The reduction of attack surface is only working if its a virtualhost otherwise the attacker and theirs scripts will find our phpmyadmin installation when scanning all IPs with /phpMyAdmin appended.

You could also change the default port from 80/443 to some random Port to further reduce the attack surface and minimize the change simple scans will find your phpmyadmin installation.

Better solutions:

  • invest time in a IP whitelist
  • use a direct VPN to your server
  • or an SSH tunnel
  • .htaccess

Most important: Do Software Updates and choose long/secure passwords.

As you mentions HTTPS. This is for encrypting your traffic so no one can eavesdrop your connection. This itself does not make phpmyadmin more secure!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .