2

I'm developing an enterprise web application, hosted on site and managed by the corporate IT team. I do not have remote access to the server, and the only way in is through the web interface. I'd like to install the phpMyAdmin-like Adminer (https://www.adminer.org/) so I can do database maintenance remotely.

How do I properly secure it? I don't feel comfortable just using the SQL database login, since the application contains sensitive information. I want to implement a multi-factor authentication. First logging in to the web application, then requesting a security token sent to my email, and only when I successfully provide both my password and the token, am I allowed access to Adminer, using which I will login to the database.

Update: One way I can think of is to put the Adminer.php file out of the publicly accessible directory, and then require it in after passing authentication tests? Would that be secure enough? Of course I would make a new SQL user with very limited privileges.

  • Your corporate IT/ security team might have a lot to say about this plan. Be sure to check with them. – Dan Pichelman May 3 '17 at 15:57
  • I will check with them after forming a detailed security plan for this, otherwise they will flat out reject it – iceman2992 May 3 '17 at 15:58
  • Why the IT team should give you acess to the PRO database? – Laiv Jun 3 '17 at 15:33
2

You can create login and loginForm methods in customization. This allows you to e.g. add a link to send the 2FA code to your e-mail to the login form, add another input field to insert this code there too and check it when logging. If you create this plugin then you can share it with other users at https://www.adminer.org/en/plugins/.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.