earth tech

Overview

After installing MySQL, Apache2, and phpMyAdmin on an OpenSuSE 11.0 LAN server, phpMyAdmin (pma) shows two warnings on its main page.

The first regards the MySQL root user not having a password set, and telling us to configure MySQL. This problem was resolved peacefully and without incident by the simple expedient of opening the mysql.user table for edit (using phpMyAdmin — we are root, after all — and according to the warning…) and adding a password to the root account for access from both localhost and sturgeon [sturgeon being the host name].

The second is regarding something about potential problems with something called "Suhosin".

Suhosin

Suhosin, as it turns out, is a [software] "system" for "hardening" PHP installations against buffer overflows and other nasties both known and unknown — generally speaking, it sounds like something that we want to have installed on our [about to be] publicly accessible server.

The phpMyAdmin FAQ # 1.38 is quoted here:

1.38 Can I use phpMyAdmin on a server on which Suhosin is enabled?

Yes but the default configuration values of Suhosin are known to cause problems with some operations, for example editing a table with many columns and no primary key. Tuning information is available at http://www.hardened-php.net/hphp/troubleshooting.html, although the parameter names have changed (suhosin instead of hphp). See also the SuhosinDisableWarning directive.

Note that the information regarding the parameter names used in the parameter names &mdash I.E. Use [read] suhosin instead of hphp in the Hardened-PHP Project – PHP Security – Troubleshooting page [ http://www.hardened-php.net/hphp/troubleshooting.html] is not shown on the other pages referenced when one follows the link(s).

That means that the following passage from

The settings you need to adjust are:

• hphp.request.max_array_index_length
• hphp.request.max_totalname_length
• hphp.post.max_array_index_length
• hphp.post.max_totalname_length

… it then goes on to say: 

Additionally you might want to change the following settings because phpMyAdmin is an administrative backend and might needs many POST variables and the user might trigger SQL errors

• Increase hphp.request.max_vars, hphp.post.max_vars
• Disable hphp.sql.bailout_on_error
• Remove logging of failed SQL queries (⇒ S_SQL) from the log hphp.log.syslog, hphp.log.sapi, hphp.log.script

Labels: php, pma, suhosin, webappdev

posted by pd wilson   #   19:57