From 14eb25d3857192f3b11208bb1def8c1f7bdfa52f Mon Sep 17 00:00:00 2001 From: Robin Johnson Date: Tue, 23 Oct 2001 22:28:30 +0000 Subject: [PATCH] Redid documentation of advanced authentication. --- ChangeLog | 3 ++ Documentation.html | 117 ++++++++++++++++----------------------------- 2 files changed, 44 insertions(+), 76 deletions(-) diff --git a/ChangeLog b/ChangeLog index 70f5db0611..d5edb61068 100755 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,9 @@ phpMyAdmin - Changelog $Id$ $Source$ +2001-10-23 Robin Johnson + * Documentation.html: Redid documentation of advanced authentication mode. + 2001-10-23 Loïc Chapeaux * config.inc.php3, Documentation.html: extended the use of stduser/stdpass to the basic authentication mode. diff --git a/Documentation.html b/Documentation.html index aa20617ed7..13e1a7fd4b 100755 --- a/Documentation.html +++ b/Documentation.html @@ -214,8 +214,8 @@ tar xzvf phpMyAdmin_x.x.x.tar.gz
  • Open the file config.inc.php3 in your favourite editor and change the values for host, user and password to fit your environment. - Have a look at Documentation.html for an explanation of all - values.
    • + Have a look at Configuration section + for an explanation of all values.
  • It is recommended that you protect the directory in which you installed phpMyAdmin (unless it's on a closed intranet), for example with HTTP-AUTH (in a .htaccess file). See the @@ -311,20 +311,13 @@
    - $cfgServers[n]['stduser'] string
    - $cfgServers[n]['stdpass'] string + $cfgServers[n]['user'] string
    + $cfgServers[n]['password'] string
    - A user/password pair used to get the privileges of the real user.
    - Since phpMyAdmin 2.2.1-rc3 this setting is available with both standard - and advanced authentication. This "fake" user must be able to connect - to MySQL and read the mysql.User and mysql.Db - tables.
    - Please note that if you try a phpMyAdmin login with this stduser, you - could get some errors, depending on the exact privileges you gave to - this stduser. phpMyAdmin does not support a direct login with the - stduser. -

    + The user/password-pair which phpMyAdmin will use to connect to this + MySQL-server. These are not needed when advanced authentication is used, + and should be empty.

    $cfgServers[n]['adv_auth'] boolean
    @@ -356,24 +349,25 @@ Advanced authentication is secure as the MySQL passwords does not need - to be set in the phpMyAdmin configuration file (except for the standard - user -see before-). + to be set in the phpMyAdmin configuration file. (except for the standard + user -see below-). +

    - See also the FAQ section for more information about security. + Please see the security section in the FAQ for more information.

    - $cfgServers[n]['user'] string
    - $cfgServers[n]['password'] string + $cfgServers[n]['stduser'] string
    + $cfgServers[n]['stdpass'] string
    - The user/password-pair which phpMyAdmin will use to connect to this - MySQL-server.
    - While $cfgServers[n]['user'] is always required, - $cfgServers[n]['password'] is not needed when using advanced - authentication (let it empty in this case). + When using advanced authentication mode, you need to supply the details + of a MySQL account that has SELECT access on the mysql.db & + mysql.user tables. This account is used to check the privileges + user logins. Please see the security section in the FAQ for more + information.

    @@ -384,10 +378,7 @@ Warning: this setting does not replace the privileges rules of the MySQL database server. If set, it just means only these databases will be displayed but not at - all other databases can't be used.
    - This setting is an efficient way to lower the server charge since the - later does not need a to send requests to MySQL to build the databases - list. + all other databases can't be used.

    @@ -431,9 +422,9 @@

    • - Note that stduser must have Select_Priv, Insert_Priv - and Delete_Priv set to "Y" in mysql.db table for the - bookmark database. + If you are using advanced authentication, users must have + Select_Priv, Insert_Priv and Delete_Priv set to "Y" + in mysql.db table for the bookmark database.

    @@ -773,19 +764,15 @@

    phpMyAdmin always gives "Access denied" when using advanced - authentication. -
    - This could happen for some reasons: + authentication.
    + This could happen for several reasons:

    • - $cfgServers[n]['user'] is wrong. Try to turn off - $cfgServers[n]['adv_auth'] and use this username and password - to connect to MySQL. + $cfgServers[n]['stduser'] and/or $cfgServers[n]['stdpass'] are wrong.
    • - The username/password your specify in the login-dialog is wrong. Try - the same as above and see if it works. + The username/password you specify in the login-dialog are invalid.
    • You have already setup a security mechanism for the @@ -877,46 +864,24 @@ Since version 2.0.3, you can setup a central copy of phpMyAdmin for all your users. The development of this feature was kindly sponsored by NetCologne GmbH. -
      - This requires a properly setup MySQL user management and phpMyAdmin's - advanced authentication. phpMyAdmin performs these steps, when - authenticating a user: + This requires a properly setup MySQL user management and phpMyAdmin + advanced authentication.

      -
        -
      1. - Select all entries from the mysql.user table where the - username/password matches the challenging user. If no rows are - returned, the authentication has failed. Otherwise, phpMyAdmin - continues with step 2. -
        2. -
      2. - If the user's global Select_Priv is "N" (ie the user - is not allowed to access all databases), phpMyAdmin searches the - mysql.db table for entries with - Select_Priv = "Y" belonging to the user. - If no entries are found, the authentication has failed. Otherwise, - phpMyAdmin shows all databases the user is allowed to view. -
        - If the user's global Select_Priv is "Y", - all databases in the system are shown. -
        3. -

      - This means that you need to add a user to the mysql database as - following:
      - INSERT INTO user (Host, User, Password, Select_priv, Insert_priv, Update_priv, - Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, - File_priv, Grant_priv, References_priv, Index_priv, Alter_priv) VALUES ('localhost', - 'foo', PASSWORD('bar'), 'N', 'N', 'N', 'N', 'N', 'N', 'N', 'N', 'N', 'N', 'N', - 'N', 'N', 'N')
      - INSERT INTO db (Host, Db, User, Select_priv, Insert_priv, Update_priv, Delete_priv, - Create_priv, Drop_priv, Grant_priv, References_priv, Index_priv, Alter_priv) - VALUES ('localhost', 'foo_db', 'foo', 'Y', 'Y', 'Y', 'Y', 'Y', 'Y', '', '', - '', '')
      - Then only the "foo_db" database will be displayed to user - "foo". + phpMyAdmin needs a control account that has only the SELECT privilege on the + mysql.db & mysql.user tables. You specify the details for + this account in the config.inc.php3 file under the $cfgServers[n]['stduser'] & + $cfgServers[n]['stdpass'] settings. + To create the control account:
      + REVOKE ALL ON *.* FROM 'user'@localhost;
      + GRANT USAGE ON *.* TO 'user'@localhost IDENTIFIED BY 'password';
      + GRANT SELECT ON mysql.db TO 'user'@localhost;
      + GRANT SELECT ON mysql.user TO 'user'@localhost;
      +

      +

      + What the user may now do is controlled entirely by the MySQL user management + system.

      -

      How can I GZip or Bzip a dump or a CSV export. It seem to not work?