This is an old revision of the document!


phpMyAdmin

Debian 10/11, other than Debian 9, require manual installation of phpmyadmin, phpmyadmin has been removed from Debian's repositories.

Installation

  1. Download the latest phpMyAdmin from the Downloads page, scroll down to the table with download links for the latest stable release, and copy the download link ending in tar.gz:
    $ wget https://files.phpmyadmin.net/phpMyAdmin/5.2.0/phpMyAdmin-5.2.0-english.tar.gz
  2. Unzip the tarball, then move the folder to a local folder outside of apache's document root (we will create a path alias in phpMyAdmin's apache.conf later) and set ownership:
    $ tar xvf phpMyAdmin-5.2.0-english.tar.gz
    sudo mv phpMyAdmin-5.2.0-english/ /home/user/html/phpMyAdmin
    $ sudo chown -R www-data:www-data /home/user/html/phpMyAdmin
  • Up to Debian 9, and in other distributions, phpMyAdmin could be installed via the package manager. Debian 10 dropped the support through the package manager.

Configuration

  1. We will not use any of the standard path used in Debian versions up to 9 or in other distributions. All files related to phpMyAdmin will remain in the custom path where we moved the downloaded files which is the easiest way to later maintain (/home/user/html/phpMyAdmin).
  2. Make a new directory for phpMyAdmin to store its temporary files:
    sudo mkdir -m770 /home/user/html/phpMyAdmin/tmp
  3. Copy config.sample.inc.php to config.inc.php and edit as follows
    1. Use the phpMyAdmin blowfish secret generator to create a new secret passphrase for cookie authentication:
      $ sudo vim /home/user/html/phpMyAdmin/config.inc.php
      $cfg['blowfish_secret'] = 'new 32 byte secret key';
    2. Add the following custom settings to config.inc.php:
      $cfg['FirstLevelNavigationItems'] = 150;		// number of databases in navigation, default: 100
      $cfg['MaxNavigationItems'] = 150;			// number of tables in db navigation, default: 50
      $cfg['NavigationWidth'] = 300;				// width of the navigation window, default: 240
      $cfg['RetainQueryBox'] = true;				// retain query box, results of query shown below box, default: false
      $cfg['ShowPhpInfo'] = true;				// show phpinfo link on home screen, default: false
      $cfg['TempDir'] = '/home/user/html/phpMyAdmin/tmp';	// you may omit this line as the default is ./tmp
    3. You may check phpMyAdmin’s documentation for other settings to add
    4. Leave the commented out settings in config.inc.php unchanged. The pma settings are better done within phpMyAdmin, where you click “Find out why” in the warning at the bottom of the screen when you first run phpMyAdmin, and then create the database phpmyadmin which will contain those settings.
  4. Create /home/user/html/phpMyAdmin/apache.conf:
    # phpMyAdmin default Apache configuration
    
    Alias /phpmyadmin /home/bco/html/phpMyAdmin
    
    <Directory /home/bco/html/phpMyAdmin>
        Options SymLinksIfOwnerMatch
        DirectoryIndex index.php
    
        <IfModule mod_php.c>
            <IfModule mod_mime.c>
                AddType application/x-httpd-php .php
            </IfModule>
            <FilesMatch ".+\.php$">
                SetHandler application/x-httpd-php
            </FilesMatch>
    
            php_value include_path .
            php_admin_value upload_tmp_dir /home/bco/html/phpMyAdmin/tmp
    	php_admin_value open_basedir /home/bco/html/phpMyAdmin/:/usr/share/
        </IfModule>
    
    </Directory>
    
    # Authorize for setup
    <Directory /home/bco/html/phpMyAdmin/setup>
        <IfModule mod_authz_core.c>
            <IfModule mod_authn_file.c>
                AuthType Basic
                AuthName "phpMyAdmin Setup"
                AuthUserFile /home/bco/html/phpMyAdmin/htpasswd.setup
            </IfModule>
            Require valid-user
        </IfModule>
    </Directory>
    
    # Disallow web access to directories that don't need it
    <Directory /home/bco/html/phpMyAdmin/templates>
        Require all denied
    </Directory>
    <Directory /home/bco/html/phpMyAdmin/libraries>
        Require all denied
    </Directory>
    <Directory /home/bco/html/phpMyAdmin/setup/lib>
        Require all denied
    </Directory>
  5. You can replace the directives for the setup directory with Require all denied as we will not use the setup script.
  6. Symlink the configuration file for Apache and restart the service:
    $ sudo ln -s /home/user/html/phpMyAdmin/apache.conf /etc/apache2/conf-enabled/phpmyadmin.conf
    $ sudo service apache2 restart
  • Copy folder phpmyadmin from a Debian 9 installation to /etc. Check the apache.conf file and remove path elements in php_admin_value open_basedir which do not exist in your system.
  • Symlink the configuration files for apache:
    cd /etc/apache2/conf-available
    ln -s ../../phpmyadmin/apache.conf phpmyadmin.conf
    cd ../conf-enabled
    ln -s ../conf-available/phpmyadmin.conf phpmyadmin.conf
  • Symlink the configuration files for phpmyadmin in it's root folder:
    cd /usr/share/phpmyadmin
    ln -s /etc/phpmyadmin/config.inc.php config.inc.php
    ln -s /etc/phpmyadmin/config.header.inc.php config.header.inc.php
    ln -s /etc/phpmyadmin/config.footer.inc.php config.footer.inc.php
  • Create a additional config file with the path to the tmp directory:
    vim /etc/phpmyadmin/conf.d/tempdir.php
    <?php
    $cfg['TempDir'] = '/var/lib/phpmyadmin/tmp';
  • Make sure the phpmyadmin user has been created in mysql:
    mysql -u <my-admin-user> -p
    SELECT user,host FROM mysql.user;
    CREATE USER 'user'@'localhost' IDENTIFIED BY 'password';
    GRANT USAGE ON phpmyadmin.* TO phpmyadmin
  • The password is in file /etc/phpmyadmin/config-db.php. Restrict permissions of that file as it contains a password:
    sudo chown root:www-data /etc/phpmyadmin/config-db.php
    sudo chmod 640 /etc/phpmyadmin/config-db.php
  • Create a regular MariaDB user for the purpose of managing databases through phpMyAdmin, as it’s recommended that you log in using another account than the pma user. You could create a user that has privileges to all tables within the database, as well as the power to add, change, and remove user privileges, with this command. Whatever privileges you assign to this user, be sure to give it a strong password as well:
    sudo mariadb
    GRANT ALL PRIVILEGES ON *.* TO 'user'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION;
    exit

Manual Upgrade on Debian 9

  • Check latest version of phpMyAdmin
  • Download and install
    cd /usr/share/phpmyadmin/
    sudo wget https://files.phpmyadmin.net/phpMyAdmin/5.1.0/phpMyAdmin-5.1.0-english.tar.gz
    tar xzf phpMyAdmin-5.1.0-english.tar.gz
    sudo mv phpMyAdmin-5.1.0-english phpmyadmin
  • Modify the following lines in /usr/share/phpmyadmin/libraries/vendor_config.php
    define('TEMP_DIR', '/var/lib/phpmyadmin/tmp/');
    define('CONFIG_DIR', '/etc/phpmyadmin/');

Securing Your phpMyAdmin Instance

Edit /etc/apache2/conf-available/phpmyadmin.conf:

Alias /phpmyadmin /usr/share/phpmyadmin
<Directory /usr/share/phpmyadmin>
  Options FollowSymLinks
  DirectoryIndex index.php

  # Allow user to access without password
  Include conf-available/user-access.conf

  <IfModule mod_php5.c>
      <IfModule mod_mime.c>
          AddType application/x-httpd-php .php
      </IfModule>
      <FilesMatch ".+\.php$">
          SetHandler application/x-httpd-php
      </FilesMatch>

      php_flag magic_quotes_gpc Off
      php_flag track_vars On
      php_flag register_globals Off
      php_admin_flag allow_url_fopen Off
      php_value include_path .
      php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
      php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/php-gettext/:/usr/share/javascript/:/usr/share/php/tcpdf/
  </IfModule>
</Directory>

conf-available/user-access.conf contains:

# Allow user to access without password
Require ip www.xx.yyy.zzz