By default, phpMyAdmin in VestaCP is accessible via HTTP, which is not secure. To prevent unauthorized access and data interception, it is important to enable SSL (HTTPS) for phpMyAdmin.

Verify SSL Certificate

Before forcing SSL for phpMyAdmin, ensure that your domain has an SSL certificate installed. You can check if SSL is already enabled by running:

sudo ls /usr/local/vesta/ssl

If you see .crt and .key files, SSL is installed.

Edit the phpMyAdmin Nginx Configuration

  1. Open the configuration file for phpMyAdmin:
    2. sudo nano /etc/nginx/conf.d/phpmyadmin.conf
  2. Modify the configuration to force HTTPS:
    • Find the HTTP (port 80) block and update it to redirect to HTTPS:
server {
    listen 80;
    server_name your-domain.com;
    return 301 https://your-domain.com$request_uri;
}
  • Ensure your HTTPS (port 443) block contains the correct SSL paths:
server {
    listen 443 ssl;
    server_name your-domain.com;

    ssl_certificate /usr/local/vesta/ssl/certificate.crt;
    ssl_certificate_key /usr/local/vesta/ssl/certificate.key;

    location /phpmyadmin {
        alias /usr/share/phpMyAdmin;
        index index.php;
        include /etc/nginx/snippets/fastcgi-php.conf;
    }
}
  1. Save and Exit (Press Ctrl + X, then Y, then Enter).

Restart Nginx to Apply Changes

After modifying the configuration, restart Nginx:

sudo systemctl restart nginx

Alternative: Use Let's Encrypt for Free SSL

If your domain does not have SSL enabled, you can install a free Let's Encrypt SSL for phpMyAdmin:

  1. Install Let's Encrypt:
    2. sudo apt install certbot python3-certbot-nginx -y
  2. Generate SSL for phpMyAdmin subdomain:
    3. sudo certbot --nginx -d your-domain.com
  3. Verify SSL Installation:
    4. sudo ls /etc/letsencrypt/live/your-domain.com/
  4. Update Nginx Config with Let's Encrypt SSL:
    5. ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
  5. Restart Nginx:
    6. sudo systemctl restart nginx

Secure phpMyAdmin Further

  1. Restrict Access by IP:
    2. location /phpmyadmin {
        allow 192.168.1.100;
        deny all;
    }
  2. Password Protect phpMyAdmin (Basic Authentication):
    • Create a password file:
      • sudo htpasswd -c /etc/phpmyadmin/.htpasswd admin
    • Modify the Nginx config:
    3. location /phpmyadmin {
        auth_basic "Restricted Access";
        auth_basic_user_file /etc/phpmyadmin/.htpasswd;
    }
  3. Disable Root Login for MySQL:
    4. UPDATE mysql.user SET plugin = 'unix_socket' WHERE User = 'root';
    FLUSH PRIVILEGES;

Verify SSL Access

  • Open phpMyAdmin via:
    • https://your-domain.com/phpmyadmin
  • Ensure the padlock icon appears, indicating a secure HTTPS connection.
  • Forces HTTPS for phpMyAdmin to prevent security risks.
  • Uses Let's Encrypt for free SSL if needed.
  • Secures phpMyAdmin with IP restrictions and authentication.