News for hackers. Stuff that matters.
Re:PhpMyAdmin Project Successfully Completes Security Audit by Xeoncross on Tuesday June 14, 2016 @04:24PM (#11905039)
I encourage people to google how to run phpMyAdmin, MySQL Workbench, or Sequel Pro locally, and use port forwarding over SSH. It's super simple.

Here is a command that forwards all traffic to localhost:3306 across the ssh tunnel to example.com:3306 (the mysql default port).

    ssh [email protected] -L 3306:localhost:3306
I would never run a DB admin application on the live server because it's just one more piece that might open a security hole.
Re:PhpMyAdmin Project Successfully Completes Security Audit by xrstf on Tuesday June 14, 2016 @05:35PM (#11905507)
On Windows, I recommend using HeidiSQL, which handles SSH tunnels for you using PuTTY's plink.exe.
Re:PhpMyAdmin Project Successfully Completes Security Audit by jredwards on Tuesday June 14, 2016 @06:06PM (#11905717)
I like some of the HeidiSQL tools so much that I run it via WINE on my mac.
Re:PhpMyAdmin Project Successfully Completes Security Audit by voycey on Tuesday June 14, 2016 @08:59PM (#11906534)
Be wary of Heidi and SSH tunnelling on windows - I'm sure the bugs have been fixed but I first hand realised that it re-used the tunnel for subsequent connections meaning you were not making changes on the database you thought you were - definitely caused some problems! However it is such a good client that I now use it on Linux under Wine :)
Re:PhpMyAdmin Project Successfully Completes Security Audit by voycey on Tuesday June 14, 2016 @09:02PM (#11906540)
https://sourceforge.net/p/heidisql/tickets/2832/

Found my original ticket! And yes, I truncated a few production tables :(

Re:PhpMyAdmin Project Successfully Completes Security Audit by RhodesianHunter on Tuesday June 14, 2016 @08:49PM (#11906504)
Take it a step further. Set up a locked down bastion server that can only be reached from your IP address, and disable all access to your DB from anything but your application and the bastion server. Then tunnel your local queries through your bastion server.

  ssh -fNg -L 3306:my-secure-db.com:3306 [email protected]
Re:PhpMyAdmin Project Successfully Completes Security Audit by codedokode on Wednesday June 15, 2016 @01:19AM (#11907292)
Another option is to install these tools at a separate domain and setup HTTP authorization on a webserver. So automated bots scanning for vulnerable apps will not get even to the login page.
Re:PhpMyAdmin Project Successfully Completes Security Audit by kgdinesh on Tuesday June 14, 2016 @07:14PM (#11906117)
Apart from security, are there any other benefits?
Re:PhpMyAdmin Project Successfully Completes Security Audit by paulannesley on Tuesday June 14, 2016 @08:09PM (#11906382)
Sequel Pro (free open source, despite name) is a native application which is much nicer to use than phpMyAdmin. So, yes there's benefits other than security.
Re:PhpMyAdmin Project Successfully Completes Security Audit by PavlovsCat on Wednesday June 15, 2016 @10:17AM (#11909445)
Re:PhpMyAdmin Project Successfully Completes Security Audit by bdcravens on Tuesday June 14, 2016 @08:06PM (#11906373)
I presume it'd be faster, since only remote data is MySQL data, as opposed to web server/PHP rendering.
Re:PhpMyAdmin Project Successfully Completes Security Audit by SeoxyS on Tuesday June 14, 2016 @08:25PM (#11906437)
Or learn how to use the CLI client to connect. No need to install a awkward wrapper software layer.
Re:PhpMyAdmin Project Successfully Completes Security Audit by coldtea on Tuesday June 14, 2016 @08:43PM (#11906488)
The "awkward wrapper software layer" has so many workflow enhancements and advantages over the ho-hum CLI client that it's not even funny.
Re:PhpMyAdmin Project Successfully Completes Security Audit by smt88 on Wednesday June 15, 2016 @12:01AM (#11907106)
You seem to be a software developer who is advocating that people not automate something that's tedious (writing and running SELECT and UPDATE queries). Weird.
Re:PhpMyAdmin Project Successfully Completes Security Audit by forgottenpass on Wednesday June 15, 2016 @03:07PM (#11911292)
phpMyAdmin is not automation. It's a less-painful manual interface.

Tedium in a GUI is still tedium.

Re:PhpMyAdmin Project Successfully Completes Security Audit by 3legcat on Wednesday June 15, 2016 @12:33AM (#11907170)
You can automate with scripts. No need to use a fancy GUI for this.
Re:PhpMyAdmin Project Successfully Completes Security Audit by smt88 on Wednesday June 15, 2016 @12:43AM (#11907189)
And what if I don't want to write scripts because other people have already automated all common database browsing/editing tasks for me? What if I don't want to reinvent the wheel?

With a GUI, you can click 3 times and browse 3 tables. That's just not possible without a GUI.

If GUIs didn't save people (lots of) time, no one would have invented them and the software industry would be moving away from them.

Besides being way faster and more efficient, GUIs do things that CLIs don't:

- linting/error-checking/autocomplete for SQL

- checking query sanity (warn before an unconstrained DELETE for example)

- copy/paste data (within the database and between applications)

- jump from FK cell to the row it references

The list goes on.

Re:PhpMyAdmin Project Successfully Completes Security Audit by codedokode on Wednesday June 15, 2016 @01:29AM (#11907323)
Scripted migrations have their advantages too:

- they can be stored in a version control system

- your coworkers can run them at their dev environment

- they can be used for automatic deployment

- you can test it in a dev environment before running at a production server. With GUI tools you have to remember and repeat exact steps you did before

- You can review the script or ask someone to look at it

I think GUI tools might be good for browsing and exploring database but not for making changes.

Re:PhpMyAdmin Project Successfully Completes Security Audit by Shorel on Tuesday June 14, 2016 @09:22PM (#11906609)
In that case I would add HeidiSQL to that list.

I use it with Wine in Ubuntu.