diff --git a/Documentation.html b/Documentation.html index 0c7e3555b..3ee2b0cb7 100644 --- a/Documentation.html +++ b/Documentation.html @@ -292,6 +292,14 @@ chmod o-rw config.inc.php # remove world read and write permissions in that folder, for other webservers, you should configure this yourself. Such configuration prevents from possible path exposure and cross side scripting vulnerabilities that might happen to be found in that code. +
  • + It is generally good idea to protect public phpMyAdmin installation + against access by robots as they usually can not do anything good + there. You can do this using robots.txt file in root of + your webserver or limit access by web server configuration. You can + find example .htaccess file which can help you achieve + this in contrib directory in phpMyAdmin. +
  • Linked-tables infrastructure

    diff --git a/contrib/htaccess b/contrib/htaccess new file mode 100644 index 000000000..6eebe0101 --- /dev/null +++ b/contrib/htaccess @@ -0,0 +1,19 @@ +RewriteEngine on + +# Allow only GET and POST verbs +RewriteCond %{REQUEST_METHOD} !^(GET|POST)$ [NC,OR] + +# Ban Typical Vulnerability Scanners and others +# Kick out Script Kiddies +RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR] +RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|wkito|pikto|scan|acunetix).* [NC,OR] +RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR] + +# Ban Search Engines, Crawlers to your administrative panel +# No reasons to access from bots +# Ultimately Better than the useless robots.txt +# Did google respect robots.txt? +# Try google: intitle:phpMyAdmin intext:"Welcome to phpMyAdmin *.*.*" intext:"Log in" -wiki -forum -forums -questions intext:"Cookies must be enabled" +RewriteCond %{HTTP_USER_AGENT} ^.*(AdsBot-Google|ia_archiver|Scooter|Ask.Jeeves|Baiduspider|Exabot|FAST.Enterprise.Crawler|FAST-WebCrawler|www\.neomo\.de|Gigabot|Mediapartners-Google|Google.Desktop|Feedfetcher-Google|Googlebot|heise-IT-Markt-Crawler|heritrix|ibm.com\cs/crawler|ICCrawler|ichiro|MJ12bot|MetagerBot|msnbot-NewsBlogs|msnbot|msnbot-media|NG-Search|lucene.apache.org|NutchCVS|OmniExplorer_Bot|online.link.validator|psbot0|Seekbot|Sensis.Web.Crawler|SEO.search.Crawler|Seoma.\[SEO.Crawler\]|SEOsearch|Snappy|www.urltrends.com|www.tkl.iis.u-tokyo.ac.jp/~crawler|SynooBot|crawleradmin.t-info@telekom.de|TurnitinBot|voyager|W3.SiteSearch.Crawler|W3C-checklink|W3C_Validator|www.WISEnutbot.com|yacybot|Yahoo-MMCrawler|Yahoo\!.DE.Slurp|Yahoo\!.Slurp|YahooSeeker).* [NC] +RewriteRule .* - [F] +