best practice for phpmyadmin and froxlor?

[hk@]

Hi,
we're running debian/ubuntu setups and depending on the version the usually packaged phpmyadmin does not always like the froxlor required php-version, also requirements might change in the future and therefore we are considering to move away from the current https://froxlor/phpmyadmin setup as we can't (easy) use different php-versions in folders/locations.

Now my question would be: is there a best practice on how to setup phpmyadmin side by side with froxlor, ideally we'd have both being updated using apt and not creating manual update-needs.

Additionally we have an additional authentication setup in front of phpmyadmin that requires users to login using their ftp credentials in order to reduce brute-force or other security issues with phpmyadmin itself.

Any input would be very welcome.

thx, hk

[d00p]

if you like to use the phpmyadmin debian/ubuntu package and you are using fcgid/php-fpm you will definetly need to adjust the virtual-host config for phpmyadmin to use fcgid/php-fpm as you like. 

If you want to be able to control these things via froxlor, another approach could be adding a 'phpmyadmin' customer and assign e.g. a subdomain to it for phpmyadmin usage

[hk@]

4 minutes ago, d00p said:

if you like to use the phpmyadmin debian/ubuntu package and you are using fcgid/php-fpm you will definetly need to adjust the virtual-host config for phpmyadmin to use fcgid/php-fpm as you like. 

If you want to be able to control these things via froxlor, another approach could be adding a 'phpmyadmin' customer and assign e.g. a subdomain to it for phpmyadmin usage

while having a phpmyadmin user has its advantages, the major set-back is that any admin-user could simply delete it and while it can be argued this must not happen and it's ones own fault - we'd very much like to avoid even the possibility to have this accidentially deleted and noone saying anything until it is needed and then all hell breaks loose to fix this asap.

if we look eg at debian v10 which would offer phpmyadmin v4.6.6 from its repository, this needs php7.1 and simply can not co-exist via an alias-path working in the at-least-php7.4-fpm-space of the froxlor v2 host itself.

What would be seriously nice would be to have an option to set a domain+customer to be locked and hidden from the panel until some un-hide-procedure is done via cli.

But in fact I don't see a good way except for a manual setup like adding a system-user and a manual site-config to have this running in its own context without being interferred by any other domain, which in turn creates a lot of other maintenance issues

[d00p]

1 minute ago, hk@ said:

while having a phpmyadmin user has its advantages, the major set-back is that any admin-user could simply delete it and while it can be argued this must not happen and it's ones own fault - we'd very much like to avoid even the possibility to have this accidentially deleted and noone saying anything until it is needed and then all hell breaks loose to fix this asap.

so having an admin do an `apt remove phpmyadmin` is no possibility? If "any admin could..." is your main concern then there are other issues I guess

2 minutes ago, hk@ said:

if we look eg at debian v10 which would offer phpmyadmin v4.6.6 from its repository, this needs php7.1 and simply can not co-exist via an alias-path working in the at-least-php7.4-fpm-space of the froxlor v2 host itself.

Hence add as customer, add php7.1 to your available php-fpm versions, assign to him and there you go.

4 minutes ago, hk@ said:

What would be seriously nice would be to have an option to set a domain+customer to be locked and hidden from the panel until some un-hide-procedure is done via cli.

You are free to enhance / fork froxlor for your needs - we currently do not see the necessity for such option/command

[hk@]

2 minutes ago, d00p said:

so having an admin do an `apt remove phpmyadmin` is no possibility? If "any admin could..." is your main concern then there are other issues I guess

usually web-admins don't get root, but ymmv.

[d00p]

then dont allow them to "see all customers" in froxlor and add the customer 'phpmyadmin' as (other) admin yourself for example