Intended Audience

Anyone who wants to phpMyAdmin for administrating MySQL databases via a web browser. This guide is for a development environment running on localhost and communication being done over http: . Security by this method of installation bypasses security patches put out by Canonical/Ubuntu developers for phpMYAdmin. If you plan to use this method over the internet you will have to set up https: on Apache and read the phpMyAdmin documentation on how to harden phpMyAdmin.

The purpose of this method of installing phpMyAdmin is that Ubuntu developers have put out a secured implementation which requires PHP 8.1.2 . This does not work if you have installed PHP 7.4 environment. This guide assumes you have Ubuntu 22.4, Apache web server, PHP 7.4 and MySQL installed and running.

Download

1) Downloaded from https://www.phpmyadmin.net/ .

Verified the file has not been tampered with by running, from command line,

$ sha256sum /path to file/phpMyAdmin/phpMyAdmin-5.2.1-all-languages.zip

and checked the hashsum matched that supplied by the developers of https://www.phpmyadmin.net/ e.g 31c95fe5c00e0f899b5d31ac6fff506cf8061f2f746e9d7084c395f47451946e

Unzipped phpMyAdmin-5.2.1-all-languages.zip

Configuration of the Apache hosting folder.

This is /var/www/html

2) Gave my user account (joe_bloggs) and the www-data group access to var/www/html which is used by the Apache web server

I did this using the command

$ sudo chown -hR joe_bloggs:www-data /var/www/html

Added my user account as a member of the www-data group.

* www-data is also member of my user group joe_bloggs which I should change back

3) Copied the directory phpMyAdmin-5.2.1-all-languages to /var/www/html

Database configuration

Log into mysql command line with root permissions and create the database and user.

Running Server version: 8.0.40-0ubuntu0.22.04.1 (Ubuntu)

Copyright (c) 2000, 2024, Oracle and/or its affiliates.

Create database “phpmyadmin”

mysql> CREATE database phpmyadmin;

CREATE USER 'pma' IDENTIFIED BY 'some_password';

GRANT ALL ON phpmyadmin.* TO 'pma'@'%' WITH GRANT OPTION;

Run the script to create the tables

Log into mysql command line and run the following.

mysql> use phpmyadmin

Database changed

mysql> source /var/www/html/phpMyAdmin-5.2.1-all-languages/sql/create_tables.sql;

Query OK, 1 row affected, 3 warnings (0.00 sec)

mysql> show tables;

+------------------------+

| Tables_in_phpmyadmin |

+------------------------+

| pma__bookmark |

| pma__central_columns |

| pma__column_info |

| pma__designer_settings |

| pma__export_templates |

| pma__favorite |

| pma__history |

| pma__navigationhiding |

| pma__pdf_pages |

| pma__recent |

| pma__relation |

| pma__savedsearches |

| pma__table_coords |

| pma__table_info |

| pma__table_uiprefs |

| pma__tracking |

| pma__userconfig |

| pma__usergroups |

| pma__users |

+------------------------+

19 rows in set (0.00 sec)

I then ran the upgrade script:

mysql> source /var/www/html/phpMyAdmin-5.2.1-all-languages/sql/upgrade_tables_4_7_0+.sql

Database changed

Query OK, 0 rows affected, 1 warning (1.39 sec)

Records: 0 Duplicates: 0 Warnings: 1

The number of columns and names remained the same so it would appear to be unnecessary for a fresh install.

Edit the config.inc.php file.

Firstly rename the directory in var/www/html from phpMyAdmin-5.2.1-all-languages to phpmyadmin. This will make it easier to refernce the weblink http://localhost/phpmyadmin in the web browser.

With a text editor make a copy of the config.sample.inc.php and save it as config.inc.php in the root of the phpmyadmin directory.

Generate the blowfish_secret key for use in the cookie.

This is outlined in an extract from the phpMyAdmin documentation below. If you haven’t generated one do not worry as you can still log into phpMyAdmin. The system generates one on the fly but for security reasons you are advised to generate your own random key. This should be 64 alphanumeric character long (32 bytes). You can type it manually – it has to be 64 alphanumeric characters long, or use the method below from the documentation extract.

Extract from the phpMyAdmin documentation on how to generate the blowfish_secret key.

2.10 How to generate a string of random bytes

One way to generate a string of random bytes suitable for cryptographic use is using the random_bytes PHP function. Since this function returns a binary string, the returned value should be converted to printable format before being able to copy it.

For example, the $cfg['blowfish_secret'] configuration directive requires a 32-bytes long string. The following command can be used to generate a hexadecimal representation of this string.

php -r 'echo bin2hex(random_bytes(32)) . PHP_EOL;'

The above example will output something similar to: f16ce59f45714194371b48fe362072dc3b019da7861558cd4ad29e4d6fb13851

And then this hexadecimal value can be used in the configuration file $cfg['blowfish_secret'] = sodium_hex2bin('f16ce59f45714194371b48fe362072dc3b019da7861558cd4ad29e4d6fb13851');

The sodium_hex2bin is used here to convert the hexadecimal value back to the binary format.

End of Extract.

Config.inc.php settings that I used.

Below are the config.inc.php settings I changed from the default config.sample.inc.php

$cfg['blowfish_secret'] = 'my 32 byte long random key'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */

/* Authentication type */

$cfg['Servers'][$i]['auth_type'] = 'cookie';

/* Server parameters */

$cfg['Servers'][$i]['host'] = 'localhost';

$cfg['Servers'][$i]['compress'] = false;

$cfg['Servers'][$i]['AllowNoPassword'] = false;

/**

* phpMyAdmin configuration storage settings.

*/

/* User used to manipulate with storage */

$cfg['Servers'][$i]['controlhost'] = 'localhost';

// $cfg['Servers'][$i]['controlport'] = '';

$cfg['Servers'][$i]['controluser'] = 'pma';

$cfg['Servers'][$i]['controlpass'] = 'password for phpmyadmin database';

You can check that the correct database is being selected in the config line below.

/* Storage database and tables */

$cfg['Servers'][$i]['pmadb'] = 'phpmyadmin';

Testing

You should be able to connect via a web browser using

http://localhost/phpmyadmin/

After you login access some database you have and bookmark a query. Then access the pma__bookmark table in the phpmyadmin table and see if the qwery has been recorded. This will tell you if the pma user is authenticating correctly with the database. Please see the scrrenshot below. Here the bookmarked query run on the 'northwind' database - yes! from the days of MS Access and MS-SQL :), has been recorded.

This end the guide. Thank you for reading and thank you all at phpMyAdmin for creating and supporting this app.