search

phpmyadmin / docker

Docker container for phpMyAdmin
https://hub.docker.com/_/phpmyadmin
GNU General Public License v3.0
663 stars 453 forks source link

Enabled remoteip mod for Apache #434

Closed melle2 closed 6 months ago

melle2 commented 8 months ago

I've enabled the remoiteip mod for Apache during build time. The reason is that now the remote ip address is posted to the log file if phpmyadmin is running behind a proxy - with the correct proxy configuration. This can then be used i.e. with fail2ban to track and block IP addresses executing bruteforce attacks grafik

williamdes commented 8 months ago

Can you update https://github.com/phpmyadmin/docker/blob/master/Dockerfile-debian.template

And run ./update.sh

melle2 commented 8 months ago

Sorry, I should have read the comment on the top of the Apache Dockerfile :grimacing:

melle2 commented 8 months ago

OK, after reviewing the changes, this solution does not work with that approach. PHP-FPM doesn't use Apache. Hence. this would not work with PHP-FPM build and ultimatley fail.

melle2 commented 8 months ago

What could be done here https://github.com/phpmyadmin/docker/blob/272944cc5a10f7740acacbe2a35c2c1f6d9a98c7/update.sh#L49 is something like

if [ "$variant" == "fpm" ]; then
    cat "$template" | sed -e "/a2enmod remoteip; \\\/d" >> $variant/Dockerfile
else
    cat "$template" >> "$variant/Dockerfile"
fi

But this feels more like a hack than a solution :neutral_face:

@williamdes what do you think?

williamdes commented 8 months ago

See https://github.com/phpmyadmin/docker/blob/272944cc5a10f7740acacbe2a35c2c1f6d9a98c7/update.sh#L66C15-L66C46

You can add the line in the block, or add a new block with comments and it will be removed