Install phpMyAdmin safely

phpMyAdmin is a web interface for managing MariaDB databases. It is handy, but a database login page open to the whole internet is a common target for attackers. This guide installs phpMyAdmin on an Apache (LAMP) server and locks it behind an IP allow-list and a password.

Before you begin

• A working LAMP stack with Apache, MariaDB and PHP (see Install a LAMP stack). This guide uses Apache because the Ubuntu package configures it automatically.
• MariaDB hardened (see Secure your MariaDB installation).
• SSH access as a sudo user (this guide uses alex), plus the public IPv4 address you will browse from. Your home or office address may change, so note how to update it.

Step 1: Install phpMyAdmin

Install the package. The installer asks a few questions:

sudo apt update
sudo apt install -y phpmyadmin

• Web server to reconfigure. Select apache2 with the spacebar, then press Enter. This adds phpMyAdmin to Apache automatically.
• Configure database for phpmyadmin with dbconfig-common. Answer Yes. The installer creates a database for phpMyAdmin's own settings and asks you to set its password. Use a generated password and store it safely.

Enable the phpMyAdmin configuration in Apache if the installer did not, then reload Apache:

sudo a2enconf phpmyadmin
sudo systemctl reload apache2

Step 2: Confirm it loads

Before you restrict access, check that the page exists. The response should be the login page or a redirect to it:

curl -I http://203.0.113.10/phpmyadmin/

HTTP/1.1 200 OK
Server: Apache/2.4.58 (Ubuntu)

Step 3: Create a password file

Basic authentication adds a second password prompt before the phpMyAdmin login. Install the tool that creates the password file, then create one for your user. The -c flag creates a new file, so use it only the first time. It overwrites any existing file.

sudo apt install -y apache2-utils
sudo htpasswd -c /etc/phpmyadmin/.htpasswd alex

htpasswd asks for a password twice. The file is stored in /etc/phpmyadmin, outside the public web folder, so Apache cannot serve it to visitors.

Step 4: Restrict access by IP and password

Create a new Apache configuration snippet. It requires a valid login and a request from your allowed IP address. Replace 198.51.100.25 with your own public IP (a documentation address is used here).

sudo nano /etc/apache2/conf-available/phpmyadmin-lock.conf

<Location /phpmyadmin>
    AuthType Basic
    AuthName "Restricted area"
    AuthUserFile /etc/phpmyadmin/.htpasswd
    <RequireAll>
        Require ip 198.51.100.25
        Require valid-user
    </RequireAll>
</Location>

Enable the snippet, check Apache's syntax, and reload. The apache2ctl configtest command should report Syntax OK before you reload.

sudo a2enconf phpmyadmin-lock
sudo apache2ctl configtest
sudo systemctl reload apache2

Syntax OK

Now test from your allowed IP without credentials. Apache should ask for the htpasswd login before anything else. From any other address, the request is refused outright, so requests from unknown addresses never reach the login page.

curl -I http://203.0.113.10/phpmyadmin/

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Restricted area"

Step 5: Turn it off when you do not need it

A tool you are not using does not need to be reachable. Disable the phpMyAdmin configuration and reload Apache, and re-enable it when you need it:

sudo a2disconf phpmyadmin
sudo systemctl reload apache2

Troubleshooting

• 403 Forbidden from your own computer. Your public IP has changed. Find your current address and update the Require ip line, then run configtest and reload Apache.
• The htpasswd prompt keeps reappearing. The username or password is wrong, or the path in AuthUserFile does not match the file. Check with sudo cat /etc/phpmyadmin/.htpasswd, which shows the username and a hash.
• "The mysqli extension is missing". Install php8.3-mysql and restart Apache.
• Lost config after a package update. The lock lives in its own file, phpmyadmin-lock.conf, so package updates should leave it alone. Check it still exists with ls /etc/apache2/conf-enabled/.

Next steps

Basic authentication sends passwords with every request, so serve phpMyAdmin only over HTTPS. Set up a certificate next, and consider keeping phpMyAdmin disabled between tasks.