Access to Admin Panel

Managing Access to phpMyAdmin

The platform allows flexible control of access to the phpMyAdmin administration panel for MySQL, MariaDB, and PerconaDB servers. By default, phpMyAdmin accepts connections from all IP addresses, but access can be restricted to a selected list.

In this article

Access-Control Overview

phpMyAdmin access rules are configured in:

/etc/httpd/conf.d/phpMyAdmin-jel.conf

Locate the following directory section in the file:

<Directory /usr/share/phpMyAdmin/>
    ## REMOVE "Require all granted" TO RESTRICT ACCESS
    Require all granted

    ### UNCOMMENT THE REQUIRED LINES AND REPLACE THE SAMPLE IP
    #SetEnvIf X-Forwarded-For ^xxx\.xxx\.xxx\.xxx env_allow_1
    #Require env env_allow_1
    #Require ip xxx.xxx.xxx.xxx
    #Require all denied
</Directory>
Require all grantedAllows phpMyAdmin access from every IP address.
Require ipAllows a specified source address when the database node has a public IP.
SetEnvIf X-Forwarded-ForIdentifies an allowed client address when the database node is accessed through the platform proxy.
Require all deniedRejects any connection that does not match the allowed rules.

Open the Configuration File

1

Open phpMyAdmin-jel.conf

Use the platform Configuration File Manager or Web SSH to open /etc/httpd/conf.d/phpMyAdmin-jel.conf.

2

Disable access from all addresses

Comment out or remove the Require all granted line inside the <Directory /usr/share/phpMyAdmin/> section.

phpMyAdmin configuration file
Remove or comment the default rule that allows access from every IP address.

Allow Access When the Database Has a Public IP

When the database node has a public IP address, add one Require ip rule for each allowed client address:

Require ip {ipAddress}

Example:

Require ip 203.0.113.25
Configure phpMyAdmin access for a database with a public IP
Use Require ip rules when the database node has a public IP.

Allow Access When the Database Has an Internal IP Only

When the database node has no public IP and is accessed through the platform proxy, use the forwarded client address:

SetEnvIf X-Forwarded-For {ipAddress} {varName}
Require env {varName}

Example:

SetEnvIf X-Forwarded-For ^203\.0\.113\.25 env_allow_1
Require env env_allow_1
i

IP pattern format

Specify the address in a regular-expression style such as ^xxx\.xxx\.xxx\.xxx so Apache processes it correctly. The environment-variable name can be changed; env_allow_1 is only an example.

Configure phpMyAdmin access for an internal-IP database
Use the X-Forwarded-For value when access passes through the platform proxy.

Multiple allowed addresses can be added by creating additional Require ip rules or additional forwarded-IP environment variables.

Deny All Other Addresses

Uncomment the final line in the directory section:

Require all denied

This rule denies every client that is not included in the permitted IP rules.

Deny access from unlisted addresses
Enable Require all denied after defining the allowed IP addresses.

Save and Restart the Database Nodes

1

Save the configuration

Save the updated phpMyAdmin-jel.conf file.

2

Restart the nodes

Click Restart Nodes for the database-server layer to apply the updated phpMyAdmin access rules.

Restart database nodes
Restart the database nodes after saving the access configuration.

Expected Result

phpMyAdmin remains accessible from the listed IP addresses. A request from any other address is rejected with an HTTP 403 Forbidden response.

403 Forbidden response for blocked phpMyAdmin access
Clients outside the allowed IP list receive a 403 Forbidden response.

Important Notes

  • These settings apply to phpMyAdmin for MySQL, MariaDB, and PerconaDB database servers.
  • By default, Require all granted permits all connections.
  • Use Require ip for a database node with a public IP.
  • Use SetEnvIf X-Forwarded-For when the database has an internal IP only.
  • Multiple client addresses can be added to the allowed list.
  • Enable Require all denied only after adding the required allow rules.
  • Restart the database nodes after saving the changes.

Common Issues and Solutions

All clients can still connectRemove or comment the Require all granted rule and restart the database nodes.
An allowed public IP is blockedCheck the Require ip value, confirm the actual client public IP, and validate the file syntax.
An allowed proxied client is blockedCheck the X-Forwarded-For pattern, escaped dots, environment-variable name, and corresponding Require env rule.
Every client receives 403Confirm that at least one valid allow rule appears before Require all denied.
Changes do not take effectSave the correct configuration file and restart every affected database node.