Hāʻawi ʻo HestiaCP i ka hoʻolaha ʻakomi hoʻokahi-kaomi o ka script Adminer (me ka hōʻoia ʻana o Nginx + ka pale pālua ʻo Fail2Ban).

E ho'ōki i ka hoʻouka lima ʻana iā Adminer! Hiki i hoʻokahi palapala ke lawelawe i ka hoʻonohonoho palekana holoʻokoʻa.

I kekahi mau lā i hala aku nei, ua hoʻopiʻi mai kekahi hoaaloha oʻu, nāna hoʻi e hana ana ma ka hoʻokele ʻōnaehana, iaʻu no ka mea, ua lilo iā ia ka hapa nui o ka lā e hoʻokomo iā Adminer ma kāna kikowaena. ʻAʻole ia he mea paʻakikī ke hoʻokomo iā Adminer; he faila PHP wale nō ia, hiki iā ʻoe ke hoʻolei wale a e hana ia. Akā, ʻo ka pilikia, ʻaʻole hiki iā ʻoe ke hoʻolei wale i kahi faila PHP a kapa aku he lā.

Pono ʻoe e hoʻonohonoho i nā subdomains, hoʻouka i nā plugins, hoʻonohonoho i ka hōʻoia Nginx, a hoʻonohonoho iā Fail2Ban e pale aku i nā hoʻouka kaua brute-force. ʻAʻole paʻakikī kēlā me kēia ʻanuʻu, akā hui pū lākou e hana i kahi pūʻulu o nā kauoha i ʻāpana ʻia a me nā faila hoʻonohonoho.

ʻO ka mea hoʻonāukiuki hou aku, ʻo ia ka maʻalahi o nā hoʻonohonoho e pili ana i ka palekana e like me ka hōʻoia a me nā pā ahi i nā hewa. Hiki i kahi nānā ʻole iki ke hōʻike i ka interface hoʻokele waihona ʻikepili i ka pūnaewele lehulehu, e hiki ai i kekahi ke komo.

Ua ʻakaʻaka au i kēlā manawa no ka mea ua hana mua wau i ka mea like. Ma hope mai, ʻaʻole hiki iaʻu ke hoʻomanawanui hou, no laila ua kākau wau i kahi palapala hoʻolaha hoʻokahi-kaomi e hoʻokele pono i kēia mau ʻanuʻu āpau.

No ke aha e hoʻohana ʻole aiphpMyAdmin

E nīnau paha ʻoe, no ke aha e hoʻohana ʻole ai i ka phpMyAdmin, ʻo ia ka mea nui?

ʻOiaʻiʻo, ʻoi aku ka nui o nā mea hoʻohana a me ke kaiāulu nui o phpMyAdmin. Akā manaʻo wau he hana maikaʻi aʻe ka Adminer ma kekahi mau wahi.

ʻO ka mea mua, he māmā ia; He faila PHP hoʻokahi wale nō ʻo Adminer, ʻoiai he hui pū ʻana o nā faila ʻo phpMyAdmin. ʻO ka lua, palekana ia; ʻO ke akeakamai hoʻolālā o Adminer "ʻaʻole hilinaʻi ʻia ma ka paʻamau," ʻo ia hoʻi, pono ʻoe e hoʻonohonoho pono i ka ʻike pili e hoʻokele i ka waihona ʻikepili.

ʻO kekahi ʻano ʻē aʻe ka hana; ʻOi aku ka wikiwiki o ka Adminer ma mua o phpMyAdmin i ka wā e lawelawe ana i nā waihona ʻikepili nui.

ʻOiaʻiʻo, ʻaʻole kekahi o kēia mau mea nui loa. ʻO ka mea nui loa, ʻo ia hoʻi, ʻaʻole pono wau e hoʻonohonoho lima i kēlā mau mea e pili ana i ka palekana.

He aha ka mea a ka palapala i hana ai?

He mea maʻalahi loa ka manaʻo ma hope o kēia palapala: e hoʻokele pono i nā ʻanuʻu āpau āu e hana mau ai me ka lima.

No ka hoʻokomo ʻana i ka pilina, e nīnau ka script iā ʻoe i kekahi mau nīnau: inoa inoa HestiaCP , inoa kikowaena, inoa inoa hōʻoia, a me ka ʻōlelo huna. Pono ʻoe e hoʻokomo i kēia mau mea, a na ka script e mālama i ke koena.

Hoʻokumu koke ka script i ka papa kuhikuhi kumu pūnaewele, nānā inā ua hoʻokomo ʻia ka apache2-utils (hoʻohana ʻia e hana i nā faila ʻōlelo huna) a me ke kaiapuni PHP, a lawelawe i ka hana ʻana o ka papa kuhikuhi a me ka hoʻokomo ʻana i ka hilinaʻi.

I ka hoʻoiho ʻana iā Adminer, hoʻāʻo mua ka script e hoʻoiho i ka mana hou loa mai ka waihona kūhelu. Inā ʻaʻole loaʻa ka waihona kūhelu, hoʻololi koke ia i ka waihona GitHub Releases paʻa. Manaʻo wau he mea nui loa kēia, no ka mea, hiki i ka waihona kūhelu ke paʻa ʻole i kekahi manawa; Ua hālāwai mua au me nā manawa pau o ka pilina.

E pili ana i nā hoʻoiho plugin, e hoʻoiho ka script i ʻekolu mau plugin koʻikoʻi: ʻo plugin.php ka mea hoʻouka plugin, hoʻohana ʻia ʻo fc-sqlite-connection-without-credentials.php e lawelawe i nā pilina ʻōlelo huna ʻole, a kākoʻo ʻo login-password-less.php i ka hash login password.

E pili ana i ka hana ʻana o ka hash password a me ka index.php, aia kahi kikoʻī liʻiliʻi: hoʻohana ka script i ka getenv() e kiʻi i ka ʻōlelo huna ma kahi o ka hoʻohana pololei ʻana i ka $_ENV. Hōʻalo kēia i kahi pilikia hoʻonohonoho php.ini e hoʻolilo ana i ka helu hash i mea ʻole. Ua hālāwai wau iho me kēia pahele a ua hoʻolilo i ka manawa lōʻihi e noʻonoʻo ana ʻaʻole i hoʻā ʻia ka laulā 'E' ma php.ini.

No ka hoʻonohonoho ʻana i ka hōʻoia ʻana o Nginx, hoʻohana ka script i ka ʻōnaehana hoʻokomo maoli o HestiaCP ma kahi o ka hoʻololi pololei ʻana i ka faila hoʻonohonoho nui o Nginx. ʻO ka pōmaikaʻi o kēia ʻano hana, ʻaʻole e hāʻule ka hōʻoia ʻana inā ʻoe e kūkulu hou i ka hoʻonohonoho kikowaena.

Ma ka hoʻonohonoho Fail2Ban, hana ka script i kahi lula kānana e nānā i nā hewa 401. Inā ʻaʻole hiki i kahi IP ke komo i 3 mau manawa i loko o 10 mau minuke, e ālai ʻia no 1 hola.

E pili ana i ka hoʻoponopono ʻana i nā ʻae a me ka hoʻouka hou ʻana o ka lawelawe, e hoʻonohonoho pono ka script i nā ʻae faila pololei a hoʻouka hou iā PHP-FPM, Nginx, a me Fail2Ban.

He mea nui iaʻu ka palekana.

ʻO kaʻoiaʻiʻo, ʻo ka palekana o nā mea hana hoʻokele waihona ʻikepili ka mea aʻu e mālama nui ai.

E noʻonoʻo e pili ana i ia mea, hiki i ka Luna Hoʻomalu ke hoʻoponopono pololei i nā waihona ʻikepili āpau ma kāu kikowaena. Inā hōʻike ʻia i ka pūnaewele lehulehu a nānā kekahi iā ia, ʻaʻole hiki ke noʻonoʻo ʻia nā hopena.

He ʻekolu ka palekana o kēia palapala.

ʻO ka papa mua ʻo Nginx's HTTP Basic Auth. Ke komo ʻoe iā Adminer, e hōʻike ʻia kahi pahu kamaʻilio e noi ana iā ʻoe e hoʻokomo i kou inoa inoa a me ka ʻōlelo huna i kāu polokalamu kele pūnaewele. Ma hope wale nō o ke komo ʻana i ka ʻike pololei hiki iā ʻoe ke ʻike i ka ʻaoʻao komo Adminer.

ʻO ka papa ʻelua ka ʻaoʻao komo hash ʻōlelo huna ponoʻī a ka Admin. Ua hoʻonohonoho au i ka hashing ʻōlelo huna ma index.php, no laila inā e kāpae kekahi i ka hōʻoia Nginx, ʻaʻole lākou e ʻike i ka ʻōlelo huna komo a ka Admin.

ʻO ke kolu o ka papa ka palekana brute-force a Fail2Ban. Inā hoʻāʻo kekahi e hoʻoikaika i kāu ʻōlelo huna, e ālai koke ʻo Fail2Ban i kā lākou helu wahi IP.

Me kēia mau papa palekana ʻekolu i hui pū ʻia, hiki iā ʻoe ke kau iā Administrator ma ka pūnaewele lehulehu me ka maluhia o ka noʻonoʻo.

Hana hoʻokahi kaomi, hoʻokahi kaomi maoli nō ia.

He maʻalahi loa ke kaʻina hana hoʻolaha.

#!/bin/bash
# ==============================================================================
# Adminer + 插件 + Nginx Auth + Fail2Ban 一键自动化部署脚本 (HestiaCP 完美版)
# ==============================================================================

set -e

# 必须以 root 权限运行
if [ "$EUID" -ne 0 ]; then
echo "❌ 错误：请使用 root 或 sudo 运行此脚本！"
exit 1
fi

# ------------------------------------------------------------------------------
# 1. 交互式输入配置参数
# ------------------------------------------------------------------------------
read -p "请输入 HestiaCP 用户名 [默认: admin]: " HESTIA_USER
HESTIA_USER=${HESTIA_USER:-admin}

read -p "请输入 Adminer 部署域名 [例如: adminer.example.com]: " DOMAIN
if [ -z "$DOMAIN" ]; then
echo "❌ 错误：域名不能为空！"
exit 1
fi

read -p "请输入 Nginx 网页认证用户名 [默认: adminuser]: " AUTH_USER
AUTH_USER=${AUTH_USER:-adminuser}

read -sp "请输入防护密码 (用于 Nginx 认证与 Adminer 登录): " AUTH_PASS
echo ""
if [ -z "$AUTH_PASS" ]; then
echo "❌ 错误：密码不能为空！"
exit 1
fi

# 核心路径变量定义
WEBROOT="/home/$HESTIA_USER/web/$DOMAIN/public_html"
ADMINER_FILE="$WEBROOT/adminer.php"
PLUGIN_DIR="$WEBROOT/plugins"
HTPASSWD_FILE="/etc/nginx/.htpasswd-$DOMAIN"

echo -e "\n🚀 开始部署 Adminer 到域名: $DOMAIN ..."

# ------------------------------------------------------------------------------
# 2. 创建目录与安装基础依赖
# ------------------------------------------------------------------------------
if [ ! -d "$WEBROOT" ]; then
echo "📁 创建 Web 根目录: $WEBROOT"
mkdir -p "$WEBROOT"
fi
mkdir -p "$PLUGIN_DIR"

echo "🔍 检查基础依赖环境..."
if ! command -v htpasswd >/dev/null 2>&1; then
echo "📦 安装 apache2-utils 工具包..."
apt-get update -qq && apt-get install -y -qq apache2-utils
fi

if ! command -v php >/dev/null 2>&1; then
echo "❌ 错误：未检测到系统的 PHP 环境！"
exit 1
fi

# ------------------------------------------------------------------------------
# 3. 安全下载 Adminer 核心程序
# ------------------------------------------------------------------------------
echo "📥 正在下载最新版 Adminer..."
curl -sL -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-o "$ADMINER_FILE" "https://www.adminer.org/latest.php"

# 校验下载有效性
if ! grep -q "<?php" "$ADMINER_FILE"; then
echo "⚠️ 官方源连接异常，正在切换至 GitHub Releases 稳定源..."
curl -sL -o "$ADMINER_FILE" \
"https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1.php"
fi

# ------------------------------------------------------------------------------
# 4. 下载官方核心插件与加载器
# ------------------------------------------------------------------------------
echo "🧩 正在下载插件组件..."
curl -sL -o "$PLUGIN_DIR/plugin.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/plugin.php

curl -sL -o "$PLUGIN_DIR/fc-sqlite-connection-without-credentials.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/fc-sqlite-connection-without-credentials.php

curl -sL -o "$PLUGIN_DIR/login-password-less.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/login-password-less.php

# ------------------------------------------------------------------------------
# 5. 安全生成密码 Hash 并构建入口文件 index.php
# ------------------------------------------------------------------------------
echo "⚙️ 生成密码 Hash 与 index.php 配置..."
# 使用 getenv() 替代 $_ENV，防止 php.ini 未开启 E 作用域导致 Hash 计算为空
HASHED_PASSWORD=$(AUTH_PASS="$AUTH_PASS" php -r 'echo password_hash(getenv("AUTH_PASS"), PASSWORD_DEFAULT);')

cat > "$WEBROOT/index.php" <<EOF
<?php
function adminer_object() {
include_once "./plugins/plugin.php";
include_once "./plugins/fc-sqlite-connection-without-credentials.php";
include_once "./plugins/login-password-less.php";

return new AdminerPlugin([
new AdminerFCSqliteConnectionWithoutCredentials(),
new AdminerLoginPasswordLess('$HASHED_PASSWORD'),
]);
}
include "./adminer.php";
EOF

# ------------------------------------------------------------------------------
# 6. 配置 Nginx 基础认证 (完全依赖 HestiaCP 原生 Include 机制)
# ------------------------------------------------------------------------------
echo "🔒 配置 Nginx HTTP Basic Auth..."
htpasswd -b -c "$HTPASSWD_FILE" "$AUTH_USER" "$AUTH_PASS"
chmod 644 "$HTPASSWD_FILE"

HESTIA_CONF_DIR="/home/$HESTIA_USER/conf/web/$DOMAIN"
if [ -d "$HESTIA_CONF_DIR" ]; then
# HestiaCP 原生包含文件名格式：nginx.conf_* 与 nginx.ssl.conf_*
# 这样无需 sed 修改主配置文件，重建域名配置时也不会失效
cat > "$HESTIA_CONF_DIR/nginx.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF

cat > "$HESTIA_CONF_DIR/nginx.ssl.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF
fi

# ------------------------------------------------------------------------------
# 7. 配置 Fail2Ban 防护规则
# ------------------------------------------------------------------------------
echo "🛡️ 配置 Fail2Ban 规则..."
cat > /etc/fail2ban/filter.d/nginx-adminer.conf <<'EOF'
[Definition]
failregex = ^<HOST> - .* "GET /.* HTTP/.*" 401
ignoreregex =
EOF

cat > /etc/fail2ban/jail.d/nginx-adminer.conf <<EOF
[nginx-adminer]
enabled = true
filter = nginx-adminer
port = http,https
logpath = /var/log/nginx/domains/$DOMAIN.log
maxretry = 3
findtime = 600
bantime = 3600
EOF

# ------------------------------------------------------------------------------
# 8. 修复权限、刷新缓存与重载服务
# ------------------------------------------------------------------------------
echo "🧹 修复权限并重载服务..."
chown -R $HESTIA_USER:$HESTIA_USER "$WEBROOT"
find "$WEBROOT" -type d -exec chmod 755 {} +
find "$WEBROOT" -type f -exec chmod 644 {} +

# 平滑重载 PHP-FPM（兼容多版本 PHP 环境）
for service in $(systemctl list-units --type=service --state=running --no-legend | awk '{print $1}' | grep -E 'php.*fpm'); do
systemctl reload "$service" || true
done

# 重载 Web 与防护服务
nginx -t && systemctl reload nginx
if systemctl is-active --quiet fail2ban; then
systemctl restart fail2ban
fi

echo -e "\n=================================================="
echo -e "✅ Adminer 一键部署成功！"
echo -e "--------------------------------------------------"
echo -e "🌐 访问地址 : https://$DOMAIN/index.php"
echo -e "👤 Nginx 认证账号 : $AUTH_USER"
echo -e "🔑 Nginx 认证密码 : [你输入的防护密码]"
echo -e "--------------------------------------------------"
echo -e "💡 Adminer 登录说明："
echo -e " 数据库用户名填写：root（或你的数据库账号）"
echo -e " 数据库密码填写：[你输入的防护密码]"
echo -e "=================================================="

Pehea e holo ai i ka script: Hāʻawi i nā ʻae e hoʻokō i ka script:

sudo chmod +x /usr/local/bin/deploy-adminer.sh 

E holo i ka script me ka hoʻohana ʻana i ka sudo:

sudo /usr/local/bin/deploy-adminer.sh 

E hoʻokomo i ka ʻike hoʻonohonoho e like me ka mea i koi ʻia:

• E hoʻokomo i kou inoa inoa HestiaCP (e.g., admin).
• E hoʻokomo i ka subdomain piha i hoʻomākaukau ʻia (e.g., adminer.example.com).
• E hoʻokomo i kāu ʻōlelo huna palekana (e.g., MySuperPassword123)

E hoʻopau koke ka script i ke kaʻina hoʻonohonoho holoʻokoʻa me ka waiho ʻole ʻana i kekahi mea.

Hoʻokahi a ʻelua paha mau minuke ka lōʻihi o ke kaʻina hana holoʻokoʻa. E mālama pono ka script i nā mea āpau, a ʻaʻole pono ʻoe e hoʻokō lima i kekahi mau kauoha.

Ma hope o kou pau ʻana, hiki iā ʻoe ke komo i ka Adminer ma o https://yourdomain/index.php

ʻO kekahi mau nīnau āu e hopohopo nei

E nīnau paha kekahi mau hoaaloha, ke kākoʻo nei kēia palapala i nā mana PHP he nui?

ʻAe, kākoʻo ʻia. E ʻike koke ka script i nā lawelawe PHP-FPM āpau e holo ana ma ka ʻōnaehana a hoʻouka hou iā lākou pākahi. No laila e hana maikaʻi ana inā ʻoe e hoʻohana ana iā PHP 7.4 a i ʻole PHP 8.2.

E nīnau paha kekahi mau hoaaloha, pehea inā makemake wau e hoʻololi i kaʻu ʻōlelo huna?

He mea maʻalahi loa ia; e holo hou i ka script. E hana hou ka script i ka hash ʻōlelo huna, e hoʻonohonoho hou i ka hōʻoia Nginx, a e hoʻonohonoho hou iā Fail2Ban. E kākau hou ʻia ka hoʻonohonoho kahiko.

He aha inā makemake wau e wehe iā ia?

Hiki iā ʻoe ke holoi wale i ka papa kuhikuhi kumu pūnaewele, ka faila ʻōlelo huna, a me ka hoʻonohonoho Fail2Ban me ka lima. ʻAʻole e waiho ka script i nā kaha ʻē aʻe ma ka ʻōnaehana.

Kākau ma ka hopena

Ua manaʻo mau wau ʻaʻole pono e paʻakikī loa ka hana a me ka mālama ʻana.

Hiki ke hoʻokele pono ʻia nā hana lima he nui me ka hoʻohana ʻana i nā palapala. Hiki iā ʻoe ke hoʻolilo i kou manawa i nā mea nui aʻe, e like me ka hoʻonui ʻana i ka hana o ke kikowaena, ka nānā ʻana i ke kūlana o nā noi, a me ka noiʻi ʻana i nā ʻenehana hou.

Hoʻomanaʻo mai kēia iaʻu i kahi moʻolelo mōʻaukala. I nā makahiki 1880, ua hoʻomaka ka hoʻolaha ʻana o ka uila ma ʻAmelika Hui Pū ʻIa. Ua hoʻolilo ka nui o nā mea nona nā hale hana i ke kālā he nui e kūʻai i nā mīkini hana a me nā mīkini uila a hoʻokomo iā lākou i loko o kā lākou mau hale hana. Eia naʻe, ma hope o ke kau ʻana, ua ʻike ka nui ʻaʻole i hoʻomaikaʻi nui ʻia ka pono o ka hana ʻana. ʻO kēia no ka mea ua pani wale lākou i nā mīkini mahu me nā mīkini uila, akā ʻaʻole i loli ke ʻano holoʻokoʻa, nā kaʻina hana, a me nā ʻano hoʻokele o ka hale hana.

ʻO ka poʻe i pōmaikaʻi maoli mai ka ulu ʻana o ka uila, ʻo lākou ka poʻe mua i maopopo i ke ʻano maoli o ka uila. Ua hoʻolālā hou lākou i nā laina hana, hoʻonohonoho hou i nā hale hana, a hoʻonohonoho hou i ke ʻano o ka hana a nā limahana.

Pēlā nō hoʻi i nā hana hana a me ka mālama pono ʻana. Ua ʻike ka poʻe he nui hiki ke hoʻohana ʻia nā palapala, akā makemake lākou i ka hana lima, e like me kēlā mau mea nona ka hale hana i ka wā ma mua i ʻike e pili ana i nā mīkini uila akā ua hoʻohana mau i ka noʻonoʻo o nā mīkini mahu e hoʻohana iā lākou. ʻAʻole i manaʻo ʻia nā palapala e pani i kou noʻonoʻo ʻana, akā e hoʻokele pono i nā hana hana hou, mīkini, a me nā hana hewa, e ʻae ana iā ʻoe e kālele i kou ikaika i ka mea e pono ai ka noʻonoʻo.

Penei i hiki mai ai kēia palapala. Ua hoʻoponopono ia i kahi pilikia noʻu, a ke lana nei koʻu manaʻo e hiki iā ia ke kōkua iā ʻoe pū kekahi.

Inā ʻoe e hoʻohana ana iā HestiaCP a me Adminer, makemake paha ʻoe e hoʻāʻo i kēia palapala. Hiki paha iā ia ke mālama i kou manawa nui.

No ka mea ua heluhelu ʻoe a hiki i kēia manawa, inā ua ʻike ʻoe he kōkua ia, e ʻoluʻolu e makemake a kaʻana like. Inā makemake ʻoe e loaʻa mua nā mea hou, hiki iā ʻoe ke hahai mai iaʻu!

Mahalo no ka heluhelu ʻana i kaʻu ʻatikala. A hui hou kākou.