Monday, March 28, 2011

Changes to phpMyAdmin Authentication

During recent upgrades to cPanel the way that a user authenticates when logging into phpMyAdmin from cPanel was substantially changed. The purpose is to allow for multiple types of authentication to phpMyAdmin, as the user's cPanel account does not necessarily have to have the same password for MySQL as it uses for system authentication.

From cPanel:
When phpMyAdmin loads, it will now attempt to get authentication data from multiple sources. It will validate the authentication data by attempting a mysql_connect() against the configured MySQL server for each source, until it finds the correct authentication information. The order of sources that it will attempt to load is:

1. The user's system password.
2. The user and password contained in ~/.my.cnf
3. If both of these fail, it will prompt for authentication with a login form.

As a result of this change, users should take note of the following:

* When invalidated session data exists, it is possible for phpMyAdmin to have problems authenticating. So, if the user notices abnormalities in phpMyAdmin, clearing browser session data should always be the first step in attempting to resolve the issue.

Because of this change, there's been a few instances of users having trouble accessing phpMyAdmin; specifically using the phpMyAdmin link from within cPanel, and instead of the phpMyAdmin interface opening as usual the user is presented with a phpMyAdmin login screen. By rights your system password (the same one used for logging into cPanel) should work, but in a few reported cases it doesn't. Typically this will happen if you've changed your cPanel password recently, and for some reason cPanel's internal system hasn't synced up the password change.

By far the easiest solution to this is to go back to cPanel and change your cPanel system password (cPanel -> Preferences -> Change Password):

Change Your cPanel Password

Make sure to leave the box checked "Allow MySQL password change". Once the password change has processed, feel free to change your password back to what it was, again leaving the "Allow MySQL password change" box checked if you want phpMyAdmin to have the same password as cPanel (and FTP). As a reminder, it's good security practice to routinely change your password. cPanel has an integrated password generator that makes having a STRONG password very easy. Remember that when you change your cPanel system password this also changes your FTP password.

As always, if you have any questions, we're here to help!

A side note: our users may have noticed some recent interface/theme changes and new options being added. As soon as we're done implementing and testing all the new goodies (we've been working our butts off, there's a LOT!) announcements will be made in the upcoming watch for it!