From 147e256f0d7948a4497da6da487ff40f6973c720 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 13 Feb 2012 13:18:04 +0100 Subject: [PATCH 1/3] Move contrib/htaccess into documentation The contrib folder is too hidden for this. --- Documentation.html | 29 +++++++++++++++++++++++++++++ contrib/htaccess | 19 ------------------- 2 files changed, 29 insertions(+), 19 deletions(-) delete mode 100644 contrib/htaccess diff --git a/Documentation.html b/Documentation.html index e4fc7d5340..20c2c03bc9 100644 --- a/Documentation.html +++ b/Documentation.html @@ -3183,6 +3183,35 @@ ProxyPassReverseCookiePath /%7Euser/phpmyadmin /mirror/foo

The MySQL server's privilege tables are not up to date, you need to run the mysql_upgrade command on the server.

+

+ 1.42 How can I prevent robots from accessing phpMyAdmin?

+ +

You can add various rules to .htaccess to filter access +based on user agent field. This is quite easy to circumvent, but could prevent at least +some robots accessing your installation.

+ +
+RewriteEngine on
+
+# Allow only GET and POST verbs
+RewriteCond %{REQUEST_METHOD} !^(GET|POST)$ [NC,OR]
+
+# Ban Typical Vulnerability Scanners and others
+# Kick out Script Kiddies
+RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
+RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|wkito|pikto|scan|acunetix).* [NC,OR]
+RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
+
+# Ban Search Engines, Crawlers to your administrative panel
+# No reasons to access from bots
+# Ultimately Better than the useless robots.txt
+# Did google respect robots.txt?
+# Try google: intitle:phpMyAdmin intext:"Welcome to phpMyAdmin *.*.*" intext:"Log in" -wiki -forum -forums -questions intext:"Cookies must be enabled"
+RewriteCond %{HTTP_USER_AGENT} ^.*(AdsBot-Google|ia_archiver|Scooter|Ask.Jeeves|Baiduspider|Exabot|FAST.Enterprise.Crawler|FAST-WebCrawler|www\.neomo\.de|Gigabot|Mediapartners-Google|Google.Desktop|Feedfetcher-Google|Googlebot|heise-IT-Markt-Crawler|heritrix|ibm.com\cs/crawler|ICCrawler|ichiro|MJ12bot|MetagerBot|msnbot-NewsBlogs|msnbot|msnbot-media|NG-Search|lucene.apache.org|NutchCVS|OmniExplorer_Bot|online.link.validator|psbot0|Seekbot|Sensis.Web.Crawler|SEO.search.Crawler|Seoma.\[SEO.Crawler\]|SEOsearch|Snappy|www.urltrends.com|www.tkl.iis.u-tokyo.ac.jp/~crawler|SynooBot|crawleradmin.t-info@telekom.de|TurnitinBot|voyager|W3.SiteSearch.Crawler|W3C-checklink|W3C_Validator|www.WISEnutbot.com|yacybot|Yahoo-MMCrawler|Yahoo\!.DE.Slurp|Yahoo\!.Slurp|YahooSeeker).* [NC]
+RewriteRule .* - [F]
+
+ +

Configuration

diff --git a/contrib/htaccess b/contrib/htaccess deleted file mode 100644 index 6eebe01013..0000000000 --- a/contrib/htaccess +++ /dev/null @@ -1,19 +0,0 @@ -RewriteEngine on - -# Allow only GET and POST verbs -RewriteCond %{REQUEST_METHOD} !^(GET|POST)$ [NC,OR] - -# Ban Typical Vulnerability Scanners and others -# Kick out Script Kiddies -RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR] -RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|wkito|pikto|scan|acunetix).* [NC,OR] -RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR] - -# Ban Search Engines, Crawlers to your administrative panel -# No reasons to access from bots -# Ultimately Better than the useless robots.txt -# Did google respect robots.txt? -# Try google: intitle:phpMyAdmin intext:"Welcome to phpMyAdmin *.*.*" intext:"Log in" -wiki -forum -forums -questions intext:"Cookies must be enabled" -RewriteCond %{HTTP_USER_AGENT} ^.*(AdsBot-Google|ia_archiver|Scooter|Ask.Jeeves|Baiduspider|Exabot|FAST.Enterprise.Crawler|FAST-WebCrawler|www\.neomo\.de|Gigabot|Mediapartners-Google|Google.Desktop|Feedfetcher-Google|Googlebot|heise-IT-Markt-Crawler|heritrix|ibm.com\cs/crawler|ICCrawler|ichiro|MJ12bot|MetagerBot|msnbot-NewsBlogs|msnbot|msnbot-media|NG-Search|lucene.apache.org|NutchCVS|OmniExplorer_Bot|online.link.validator|psbot0|Seekbot|Sensis.Web.Crawler|SEO.search.Crawler|Seoma.\[SEO.Crawler\]|SEOsearch|Snappy|www.urltrends.com|www.tkl.iis.u-tokyo.ac.jp/~crawler|SynooBot|crawleradmin.t-info@telekom.de|TurnitinBot|voyager|W3.SiteSearch.Crawler|W3C-checklink|W3C_Validator|www.WISEnutbot.com|yacybot|Yahoo-MMCrawler|Yahoo\!.DE.Slurp|Yahoo\!.Slurp|YahooSeeker).* [NC] -RewriteRule .* - [F] - From ee3d0bf1b1d6fb6c7c266ac997449f899e1da904 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 13 Feb 2012 13:20:04 +0100 Subject: [PATCH 2/3] Consistent refering to .htaccess --- Documentation.html | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/Documentation.html b/Documentation.html index 20c2c03bc9..158526009d 100644 --- a/Documentation.html +++ b/Documentation.html @@ -312,7 +312,7 @@ rm -rf config # remove not needed directory authentication mode.
  • You should deny access to the ./libraries and ./setup/lib subfolders in your webserver configuration. For - Apache you can use supplied .htaccess file in that folder, for other + Apache you can use supplied .htaccess file in that folder, for other webservers, you should configure this yourself. Such configuration prevents from possible path exposure and cross side scripting vulnerabilities that might happen to be found in that code.
    • @@ -480,7 +480,7 @@ GRANT ALL PRIVILEGES ON user_base.* TO 'real_user'@localhost IDENTIFIED BY 'real 1.35.
  • See also FAQ 4.4 about not - using the .htaccess mechanism along with + using the .htaccess mechanism along with 'HTTP' authentication mode.
    • @@ -538,7 +538,7 @@ GRANT ALL PRIVILEGES ON user_base.* TO 'real_user'@localhost IDENTIFIED BY 'real
  • Unlike cookie and http, does not require a user to log in when first loading the phpMyAdmin site. This is by design but could allow any user to access your installation. Use of some restriction method is - suggested, perhaps a .htaccess file with the + suggested, perhaps a .htaccess file with the HTTP-AUTH directive or disallowing incoming HTTP requests at one’s router or firewall will suffice (both of which are beyond the scope of this manual but easily searchable with Google).
    • @@ -3061,7 +3061,7 @@ the order of the server paragraph in config.inc.php. Options FollowSymLinks and AllowOverride FileInfo enabled for directory where phpMyAdmin is installed and you need mod_rewrite to be enabled. Then you just need to create following - .htaccess file in root folder of phpMyAdmin installation + .htaccess file in root folder of phpMyAdmin installation (don't forget to change directory name inside of it):

    @@ -3613,7 +3613,7 @@ have either the APC extension
     This depends on your system.
    
     If you're running a server which cannot be accessed by other people, it's
     sufficient to use the directory protection bundled with your webserver
-    (with Apache you can use .htaccess files, for example).
    
+    (with Apache you can use .htaccess files, for example).
    
     If other people have telnet access to your server, you should use
     phpMyAdmin's HTTP or cookie authentication features.
     

    
@@ -3657,7 +3657,7 @@ have either the APC extension
         are wrong.
     
  • The username/password you specify in the login dialog are invalid.
    • 
     
  • You have already setup a security mechanism for the
-        phpMyAdmin-directory, eg. a .htaccess file. This would interfere with
+        phpMyAdmin-directory, eg. a .htaccess file. This would interfere with
         phpMyAdmin's authentication, so remove it.
    • 
 
 
@@ -3673,7 +3673,7 @@ have either the APC extension
 
    
     4.6 How can I use the Host-based authentication additions?
    
 
-
     If you have existing rules from an old .htaccess file, you can take them
+
     If you have existing rules from an old .htaccess file, you can take them
     and add a username between the 'deny'/'allow' and
     'from' strings. Using the username wildcard of '%' would
     be a major benefit here if your installation is suited to using it. Then

From 9892dd69a0f8ce178ec4eb5e6b69de50a34fdc46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= 
Date: Mon, 13 Feb 2012 13:20:43 +0100
Subject: [PATCH 3/3] Point to new FAQ instead of contrib folder

---
 Documentation.html | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Documentation.html b/Documentation.html
index 158526009d..96c5de4c52 100644
--- a/Documentation.html
+++ b/Documentation.html
@@ -320,9 +320,8 @@ rm -rf config                      # remove not needed directory
         It is generally good idea to protect public phpMyAdmin installation
         against access by robots as they usually can not do anything good
         there. You can do this using robots.txt file in root of
-        your webserver or limit access by web server configuration. You can
-        find example .htaccess file which can help you achieve
-        this in contrib directory in phpMyAdmin.
+        your webserver or limit access by web server configuration, see 
+        FAQ 1.42.