I didn't really like the idea of having to install a module in every site I manage... so I sought a way to bypass that.

I think it can be done using the single sign-on option of phpmyadmin. Patch coming.

This currently breaks the normal workflow and lets me login as the aegir db user.
Lets discuss if we want to maker it work both ways.

I placed a copy of phpMyAdmin in the hostmaster document root.

So this should be limited to administrators... therefore my attention to #2125109: Add access function

One concern I have is that the password is stored in a session... do we need to cleanup there?

CommentFileSizeAuthor
#1 hosting_dblogin-component-2125163-1.patch2.36 KBhelmo

Comments

helmo’s picture

helmo commented
Status: Active » Needs review
StatusFileSize
new hosting_dblogin-component-2125163-1.patch2.36 KB
helmo’s picture

helmo commented

Just had another idea...

It might be better to get phpMyAdmin access to the database of only one site.

The database specific user/password is only known in drush context.
To bridge this I was thinking about a provision task that could be run to inject a password in the php session.
Big limitation is that the aegir user normally does not have access to the php session files... with good reason ;)
But that could e.g. be fixed with sudo.

  $session_name = 'SignonSession';
  $id = 'xxx';
  session_name($session_name);
  session_id($id);
  session_start();

  // set something in $_SESSION

  // Close that session
  session_write_close();

Just thinking out loud here...

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented

Right, we only want access to that site's db from the link on the site node. If we want to allow broader access as the 'aegir' user, then I'd suggest adding a similar link to the db_server node.

The whole point of redirecting to the db_login path was to avoid having to store the site's db credentials on the Aegir front-end. The fact that we store the 'aegir root' credentials in the front-end is something anarcat and I have discussed trying to remove. So any solution that depends on these being available is questionable, imo.

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented

If you really want to do this, be my guest. But please make it optional, rather than default behaviour.

helmo’s picture

helmo commented

I also still have my doubts about the security ... I hope to run into a current phpMyAdmin team member this weekend on Fosdem.

helmo’s picture

helmo commented
Status: Needs review » Postponed (maintainer needs more info)

I had a bit of discussion about this but I'm not convinced about the security... postponing for now.