HestiaCP inopa kutumirwa otomatiki kweAdminer script nekudzvanya kamwe chete (kusanganisira Nginx authentication + Fail2Ban dual protection).

Mira kuisa Adminer nemaoko! Chinyorwa chimwe chete chinogona kubata zvese zvekuchengetedza.

Mazuva mashoma apfuura, shamwari yangu, inoshandawo muhurongwa hwekugadzirisa masystem, yakandinyunyuta kuti zvinomutorera nguva yakawanda yezuva kuisa Adminer paserver yake. Hazvirevi kuti Adminer pachayo inonetsa kuisa; ingori faira rePHP, unogona kungorirasa uye richashanda. Asi dambudziko nderekuti, haugone kungorirasa faira rePHP woridaidza rimwe zuva.

Unofanira kugadzirisa ma subdomain, kuisa ma plugins, kugadzira Nginx authentication, uye kugadzirisa Fail2Ban kudzivirira brute-force attacks. Danho rega rega harina kuoma, asi pamwe chete zvinoguma nemirairo yakawanda yakakamurwa uye mafaira ekugadzirisa.

Chinonyanya kunetsa ndechekuti magadzirirwo ane chekuita nekuchengetedzwa akadai se authentication uye firewalls anowanzoita zvikanganiso. Kusanyatsoongorora kunogona kuisa pachena nzira yekutarisira database pa internet yeruzhinji, zvichiita kuti iwanikwe nemunhu wese.

Ndakaseka panguva iyoyo nekuti ndaive ndamboita zvimwe chete kare. Gare gare, ndakanga ndisisakwanise kuzvitsungirira, saka ndakanyora script yekuiswa kwechinhu chimwe chete kuti ndiite otomatiki matanho ese aya.

Sei usingashandisephpMyAdmin

Ungabvunza kuti, sei usingashandise phpMyAdmin, iyo inonyanya kushandiswa?

Zvechokwadi, phpMyAdmin ine vashandisi vakawanda uye nharaunda yakakura. Asi ndinofunga kuti Adminer inoita basa riri nani mune dzimwe nzvimbo.

Chekutanga, yakareruka; Adminer ifaira rePHP rimwe chete, nepo phpMyAdmin iri mafaira akawanda. Chechipiri, yakachengeteka; hunyanzvi hwekugadzira hwaAdminer "hahuvimbike zvachose," zvichireva kuti unofanirwa kugadzirisa ruzivo rwekubatanidza kuti ushandise database.

Chimwe chinhu ndechekuita basa; Adminer inokurumidza kupfuura phpMyAdmin pakubata madhatabhesi makuru.

Ehe, hapana chimwe chezvinhu izvi chinonyanya kukosha. Chinhu chakakosha ndechekuti chinyorwa ichi chinoreva kuti handichafanire kugadzirisa zvinhu izvozvo zvine chekuita nekuchengetedza nemaoko.

Chii chaizvo chakaitwa nechinyorwa ichi?

Pfungwa iri shure kwechinyorwa ichi iri nyore kwazvo: kuita otomatiki matanho ese aunowanzoita nemaoko.

Kuti muwane mhinduro dzinoshanda pamwe chete, script ichakubvunzai mibvunzo mishoma: Zita rekushandisa reHestiaCP , zita redhomini, zita rekushandisa rekusimbisa, uye password. Munongoda kuisa izvi chete, uye script ichabata zvimwe zvese.

Chinyorwa ichi chinozvigadzira chega dhairekitori remidzi yewebhu, chinoongorora kana apache2-utils (inoshandiswa kugadzira mafaira epassword) nenzvimbo yePHP yakaiswa, uye chinotarisira kugadzirwa kwedhairekitori uye kuiswa kwekuvimba.

Pakudhawunirodha Adminer, script inotanga yaedza kudhawunirodha vhezheni yazvino kubva ku repository yepamutemo. Kana repository yepamutemo isipo, inochinja yega kuenda ku stable GitHub Releases repository. Ini ndinofunga izvi zvakakosha, sezvo repository yepamutemo dzimwe nguva inogona kusagadzikana; Ndakambosangana nenguva dzekubatanidza kare.

Nezvekudhawunirodha ma plugin, script iyi ichadhawunirodha ma plugin matatu makuru: plugin.php ndiyo plugin loader, fc-sqlite-connection-without-credentials.php inoshandiswa kubata ma connections asina password, uye login-password-less.php inotsigira password hash login.

Nezvekugadzirwa kwepassword hash uye index.php, pane kachidimbu kadiki: script inoshandisa getenv() kutora password pane kushandisa zvakananga $_ENV. Izvi zvinodzivirira dambudziko rekugadzirisa php.ini zvichiita kuti kuverenga kwehash kusave kwakazara. Ini pachangu ndakasangana nedambudziko iri uye ndakapedza nguva yakareba ndichifunga kuti 'E' scope yakanga isina kuvhurwa mu php.ini.

Pakugadzirisa Nginx authentication, script inoshandisa HestiaCP's native include mechanism pachinzvimbo chekugadzirisa zvakananga faira guru reNginx configuration. Chakanakira nzira iyi ndechekuti authentication haizokundikani kunyangwe ukavakazve domain configuration.

Mugadziriro yeFail2Ban, script inogadzira mutemo wekusefa kuti utarise zvikanganiso 401. Kana IP ikatadza kupinda katatu mukati memaminitsi gumi, ichavharwa kweawa imwe chete.

Nezve kugadziriswa kwemvumo uye kudzoreredzwa kwesevhisi, script ichaisa otomatiki mvumo dzefaira dzakakodzera uye kudzoreredza zvakare PHP-FPM, Nginx, uye Fail2Ban.

Ndiri kunyatsofunga nezvekuchengetedzwa.

Kutaura chokwadi, kuchengetedzeka kwezvishandiso zvekutarisira database ndicho chinhu chandinonyanya kufarira.

Funga nezvazvo, Admin anogona kuchinja zvakananga madhatabhesi ese ari paserver yako. Kana ikaonekwa pa internet yeruzhinji uye mumwe munhu akaiskena, mhedzisiro yacho haingafungidzike.

Chinyorwa ichi chine dziviriro katatu.

Danho rekutanga iNginx's HTTP Basic Auth. Paunopinda muAdminer, browser yako ichabuda bhokisi rekukurukurirana richikukumbira kuti uise zita rako rekushandisa nepassword. Mushure mekuisa ruzivo rwakarurama ndipo paunozokwanisa kuona peji rekupinda reAdminer.

Chikamu chechipiri ipassword hash login yeAdmin pachake. Ndakagadzirisa password hashing mu index.php, saka kunyangwe munhu akadarika Nginx authentication, haazozive password yeAdmin yekupinda.

Chikamu chechitatu ikudzivirira kweFail2Ban kwebrute-force. Kana mumwe munhu akaedza kumanikidza password yako, Fail2Ban inovhara kero yavo ye IP otomatiki.

Nezvikamu zvitatu izvi zvekudzivirira zvakabatana, unogona kuisa Administrator pa internet yeruzhinji nerunyararo rwepfungwa.

Kushanda nekudzvanya kamwe chete, kunenge kuri kudzvanya kamwe chete.

Maitiro ekuisa zvinhu ari nyore kwazvo.

#!/bin/bash
# ==============================================================================
# Adminer + 插件 + Nginx Auth + Fail2Ban 一键自动化部署脚本 (HestiaCP 完美版)
# ==============================================================================

set -e

# 必须以 root 权限运行
if [ "$EUID" -ne 0 ]; then
echo "❌ 错误：请使用 root 或 sudo 运行此脚本！"
exit 1
fi

# ------------------------------------------------------------------------------
# 1. 交互式输入配置参数
# ------------------------------------------------------------------------------
read -p "请输入 HestiaCP 用户名 [默认: admin]: " HESTIA_USER
HESTIA_USER=${HESTIA_USER:-admin}

read -p "请输入 Adminer 部署域名 [例如: adminer.example.com]: " DOMAIN
if [ -z "$DOMAIN" ]; then
echo "❌ 错误：域名不能为空！"
exit 1
fi

read -p "请输入 Nginx 网页认证用户名 [默认: adminuser]: " AUTH_USER
AUTH_USER=${AUTH_USER:-adminuser}

read -sp "请输入防护密码 (用于 Nginx 认证与 Adminer 登录): " AUTH_PASS
echo ""
if [ -z "$AUTH_PASS" ]; then
echo "❌ 错误：密码不能为空！"
exit 1
fi

# 核心路径变量定义
WEBROOT="/home/$HESTIA_USER/web/$DOMAIN/public_html"
ADMINER_FILE="$WEBROOT/adminer.php"
PLUGIN_DIR="$WEBROOT/plugins"
HTPASSWD_FILE="/etc/nginx/.htpasswd-$DOMAIN"

echo -e "\n🚀 开始部署 Adminer 到域名: $DOMAIN ..."

# ------------------------------------------------------------------------------
# 2. 创建目录与安装基础依赖
# ------------------------------------------------------------------------------
if [ ! -d "$WEBROOT" ]; then
echo "📁 创建 Web 根目录: $WEBROOT"
mkdir -p "$WEBROOT"
fi
mkdir -p "$PLUGIN_DIR"

echo "🔍 检查基础依赖环境..."
if ! command -v htpasswd >/dev/null 2>&1; then
echo "📦 安装 apache2-utils 工具包..."
apt-get update -qq && apt-get install -y -qq apache2-utils
fi

if ! command -v php >/dev/null 2>&1; then
echo "❌ 错误：未检测到系统的 PHP 环境！"
exit 1
fi

# ------------------------------------------------------------------------------
# 3. 安全下载 Adminer 核心程序
# ------------------------------------------------------------------------------
echo "📥 正在下载最新版 Adminer..."
curl -sL -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-o "$ADMINER_FILE" "https://www.adminer.org/latest.php"

# 校验下载有效性
if ! grep -q "<?php" "$ADMINER_FILE"; then
echo "⚠️ 官方源连接异常，正在切换至 GitHub Releases 稳定源..."
curl -sL -o "$ADMINER_FILE" \
"https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1.php"
fi

# ------------------------------------------------------------------------------
# 4. 下载官方核心插件与加载器
# ------------------------------------------------------------------------------
echo "🧩 正在下载插件组件..."
curl -sL -o "$PLUGIN_DIR/plugin.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/plugin.php

curl -sL -o "$PLUGIN_DIR/fc-sqlite-connection-without-credentials.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/fc-sqlite-connection-without-credentials.php

curl -sL -o "$PLUGIN_DIR/login-password-less.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/login-password-less.php

# ------------------------------------------------------------------------------
# 5. 安全生成密码 Hash 并构建入口文件 index.php
# ------------------------------------------------------------------------------
echo "⚙️ 生成密码 Hash 与 index.php 配置..."
# 使用 getenv() 替代 $_ENV，防止 php.ini 未开启 E 作用域导致 Hash 计算为空
HASHED_PASSWORD=$(AUTH_PASS="$AUTH_PASS" php -r 'echo password_hash(getenv("AUTH_PASS"), PASSWORD_DEFAULT);')

cat > "$WEBROOT/index.php" <<EOF
<?php
function adminer_object() {
include_once "./plugins/plugin.php";
include_once "./plugins/fc-sqlite-connection-without-credentials.php";
include_once "./plugins/login-password-less.php";

return new AdminerPlugin([
new AdminerFCSqliteConnectionWithoutCredentials(),
new AdminerLoginPasswordLess('$HASHED_PASSWORD'),
]);
}
include "./adminer.php";
EOF

# ------------------------------------------------------------------------------
# 6. 配置 Nginx 基础认证 (完全依赖 HestiaCP 原生 Include 机制)
# ------------------------------------------------------------------------------
echo "🔒 配置 Nginx HTTP Basic Auth..."
htpasswd -b -c "$HTPASSWD_FILE" "$AUTH_USER" "$AUTH_PASS"
chmod 644 "$HTPASSWD_FILE"

HESTIA_CONF_DIR="/home/$HESTIA_USER/conf/web/$DOMAIN"
if [ -d "$HESTIA_CONF_DIR" ]; then
# HestiaCP 原生包含文件名格式：nginx.conf_* 与 nginx.ssl.conf_*
# 这样无需 sed 修改主配置文件，重建域名配置时也不会失效
cat > "$HESTIA_CONF_DIR/nginx.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF

cat > "$HESTIA_CONF_DIR/nginx.ssl.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF
fi

# ------------------------------------------------------------------------------
# 7. 配置 Fail2Ban 防护规则
# ------------------------------------------------------------------------------
echo "🛡️ 配置 Fail2Ban 规则..."
cat > /etc/fail2ban/filter.d/nginx-adminer.conf <<'EOF'
[Definition]
failregex = ^<HOST> - .* "GET /.* HTTP/.*" 401
ignoreregex =
EOF

cat > /etc/fail2ban/jail.d/nginx-adminer.conf <<EOF
[nginx-adminer]
enabled = true
filter = nginx-adminer
port = http,https
logpath = /var/log/nginx/domains/$DOMAIN.log
maxretry = 3
findtime = 600
bantime = 3600
EOF

# ------------------------------------------------------------------------------
# 8. 修复权限、刷新缓存与重载服务
# ------------------------------------------------------------------------------
echo "🧹 修复权限并重载服务..."
chown -R $HESTIA_USER:$HESTIA_USER "$WEBROOT"
find "$WEBROOT" -type d -exec chmod 755 {} +
find "$WEBROOT" -type f -exec chmod 644 {} +

# 平滑重载 PHP-FPM（兼容多版本 PHP 环境）
for service in $(systemctl list-units --type=service --state=running --no-legend | awk '{print $1}' | grep -E 'php.*fpm'); do
systemctl reload "$service" || true
done

# 重载 Web 与防护服务
nginx -t && systemctl reload nginx
if systemctl is-active --quiet fail2ban; then
systemctl restart fail2ban
fi

echo -e "\n=================================================="
echo -e "✅ Adminer 一键部署成功！"
echo -e "--------------------------------------------------"
echo -e "🌐 访问地址 : https://$DOMAIN/index.php"
echo -e "👤 Nginx 认证账号 : $AUTH_USER"
echo -e "🔑 Nginx 认证密码 : [你输入的防护密码]"
echo -e "--------------------------------------------------"
echo -e "💡 Adminer 登录说明："
echo -e " 数据库用户名填写：root（或你的数据库账号）"
echo -e " 数据库密码填写：[你输入的防护密码]"
echo -e "=================================================="

Maitiro ekumhanyisa script: Ipa mvumo yekuita script:

sudo chmod +x /usr/local/bin/deploy-adminer.sh 

Mhanya script uchishandisa sudo:

sudo /usr/local/bin/deploy-adminer.sh 

Isa ruzivo rwekugadzirisa sezvakakurudzirwa:

• Isa zita rako rekushandisa reHestiaCP (semuenzaniso, admin).
• Isa subdomain yakazara yakagadzirirwa (semuenzaniso, adminer.example.com).
• Isa password yako yekuchengetedza (semuenzaniso, MySuperPassword123)

Chinyorwa chinozopedzisa otomatiki maitiro ese ekugadzirisa pasina kusiya chero chinhu.

Maitiro ese anotora maminetsi angangoita imwe kana maviri. Chinyorwa chichagadzirisa zvese otomatiki, uye haufanirwe kuita chero mirairo nemaoko.

Kana wapedza, unogona kupinda muAdminer kuburikidza ne https://yourdomain/index.php

Mimwe mibvunzo yaungave uchinetseka nayo

Dzimwe shamwari dzingabvunza, ko script iyi inotsigira shanduro dzakawanda dzePHP here?

Ehe, inotsigirwa. Chinyorwa ichi chinozoona otomatiki masevhisi ese ePHP-FPM ari kushanda pasystem uye chinoadzoreredza rimwe nerimwe. Saka zvinoshanda zvakanaka kunyangwe uri kushandisa PHP 7.4 kana PHP 8.2.

Dzimwe shamwari dzingabvunza kuti, ko kana ndichida kuchinja password yangu?

Zviri nyore kwazvo; ingo dzokorora script. Script ichagadzirisazve password hash, kugadzirisazve Nginx authentication, uye kugadzirisazve Fail2Ban. Magadzirirwo ekare achanyorwazve.

Ko kana ndichida kuibvisa?

Unogona kungodzima dhairekitori remidzi yewebhu, faira repassword, uye gadziriro yeFail2Ban nemaoko. Chinyorwa hachizosiyi zvimwe zviratidzo pasystem.

Nyora pakupedzisira

Ndagara ndichifunga kuti mashandiro nekuchengetedza hazvifanirwe kuoma zvakanyanya.

Mabasa mazhinji emaoko anogona kuitwa otomatiki uchishandisa ma script. Izvi zvinokutendera kuti upedze nguva yako pazvinhu zvakakosha, zvakaita sekugadzirisa mashandiro eseva, kutarisa mamiriro eapplication, uye kutsvaga matekinoroji matsva.

Izvi zvinondiyeuchidza nezvenyaya yenhoroondo. Mumakore ekuma1880, magetsi akatanga kupararira muUnited States. Varidzi vemafekitori vazhinji vakashandisa mari yakawanda kutenga majenareta nemamota emagetsi uye vakaaisa mumafekitori avo. Zvisinei, mushure mekuiswa, vazhinji vakaona kuti kushanda zvakanaka kwekugadzira hakuna kuwedzera zvakanyanya. Izvi zvaive nekuti vakangotsiva mainjini emhepo chete nemamota emagetsi, asi marongerwo ese, maitiro, uye nzira dzekutarisira fekitori hazvina kuchinja.

Avo vakanyatsobatsirwa nekuwedzera kwemagetsi ndivo vakatanga kunzwisisa zvairehwa nemagetsi chaizvo. Vakagadzirisa mitsetse yekugadzira, vakagadzirisa maworkshop, uye vakarongazve mashandiro evashandi.

Izvi zvinoshandawo pakushanda nekuchengetedza otomatiki. Vanhu vazhinji vanoziva kuti zvinyorwa zvinogona kushandiswa, asi vachiri kuda kushanda nemaoko, kungofanana nevaridzi vemafekitori kare vaiziva nezvemota dzemagetsi asi vachiri kushandisa mafungiro einjini dzesteam kuti vadzishandise. Zvinyorwa hazvina kuitirwa kutsiva zvaunofunga, asi kuti zviite otomatiki mabasa anodzokororwa, emakanika, uye anowanzoita zvikanganiso, zvichikubvumidza kuti utarise simba rako pane zvinoda kufunga chaizvo.

Izvi ndizvo zvakabuda muchinyorwa ichi. Chagadzirisa dambudziko rangu, uye ndinovimba kuti chinogona kukubatsirawo.

Kana uri kushandisa HestiaCP neAdminer, ungangoda kuedza script iyi. Izvi zvinogona kukusevha nguva yakawanda.

Sezvo waverenga kusvika pari zvino, kana wawana zvichibatsira, ndapota tumira like uye share. Kana uchida kugamuchira nhau dzichangoburwa, unogonawo kunditevera!

Ndatenda nekuverenga chinyorwa changu. Tichaonana nguva inotevera.