SysAdmin

I love SSL. If it weren't for the extra payload that it puts on both the network, client, and server I'd suggest it for everything. I've baked-up a quick Apache mod_rewrite recipe that will force all traffic to SSL:

RewriteEngine On
RewriteCond %{HTTPS} !^on$
RewriteRule ^(.*)$ https://mydomain.com$1 [R,L]

While phpmyadmin looks quite complicated to install due the countless number of options that you can find in the config files, I've got a pretty simple way to install it that seems supporting of security policies that are placed on the server elsewhere.

NOTE: These settings are for Fecora, Cent, or RHEL machines as the paths follow the way these machines configure their services and the location of their configs.

One of the biggest pains in my life is the recent plague of phpShells scripts all over the Net. The phpShells scripts allow for three main features:

1. file browsing (including permissions) of the server executing the code
2. file installation or deployment on the server executing the code
3. file execution (using the exec() call in PHP) on the server executing the code

Allowing a mysql backup client to read all data in the database is critical to appropriately backup all data. Many people will do local dumps on their server and then simply copy those logs remotely. This is certainly safe, but you still don't want the passwords that provide write-access to all data in all of your databases stored in plain-text. Creating a user that has read-only access is key.

grant select,show databases,process on *.* to 'my-backup-client'@'ip-address' identified by 'my-password';