I-HestiaCP inikeza ukuthunyelwa okuzenzakalelayo kweskripthi se-Adminer ngokuchofoza okukodwa (kufaka phakathi ukuqinisekiswa kwe-Nginx + ukuvikelwa okubili kwe-Fail2Ban).

Yeka ukufaka i-Adminer ngesandla! Iskripthi esisodwa singaphatha konke ukucushwa kokuphepha.

Ezinsukwini ezimbalwa ezedlule, umngane wami, osebenza ekuphathweni kwesistimu, ungikhonondile ngokuthi kumthatha isikhathi esiningi sosuku ukufaka i-Adminer kuseva yakhe. Akukhona ukuthi i-Adminer ngokwayo inzima ukuyifaka; yifayela le-PHP nje, ungayilahla nje bese isebenza. Kodwa inkinga iwukuthi, awukwazi ukuvele ulahle ifayela le-PHP bese ulibiza ngosuku olulodwa.

Udinga ukumisa ama-subdomain, ulayishe ama-plugin, usethe ukuqinisekiswa kwe-Nginx, futhi ulungiselele i-Fail2Ban ukuvimbela ukuhlaselwa kwe-brute-force. Isinyathelo ngasinye asiyinkimbinkimbi, kodwa ndawonye zakha inqwaba yemiyalo ehlukanisiwe namafayela okumisa.

Okucasula nakakhulu ukuthi ukucushwa okuhlobene nokuphepha okufana nokuqinisekiswa kanye nama-firewall kuthambekele kakhulu emaphutheni. Ukungalungi okuncane kungadalula isikhombimsebenzisi sokuphathwa kwedatha ku-inthanethi yomphakathi, okwenza kutholakale kalula kunoma ubani.

Ngahleka ngaleso sikhathi ngoba ngangikade ngenza into efanayo ngaphambili. Kamuva, ngangingasakwazi ukukubekezelela lokho, ngakho ngabhala iskripthi sokufaka ngokuchofoza kanye ukuze zenze zonke lezi zinyathelo zibe ngokuzenzakalela.

Kungani ungasebenzisiphpMyAdmin

Ungase ubuze, kungani ungasebenzisi i-phpMyAdmin, okuyiyona evame kakhulu?

Ngempela, i-phpMyAdmin inabasebenzisi abaningi kanye nomphakathi omkhulu. Kodwa ngicabanga ukuthi i-Adminer yenza umsebenzi ongcono ezindaweni ezimbalwa.

Okokuqala, ilula; I-Adminer iyifayela elilodwa le-PHP, kuyilapho i-phpMyAdmin iyinqwaba yamafayela. Okwesibili, iphephile; Ifilosofi yokuklama ye-Adminer "ayithenjwa ngokuzenzakalelayo," okusho ukuthi udinga ukumisa ngokucacile ulwazi lokuxhumana ukuze usebenzise isizindalwazi.

Esinye isici ukusebenza; I-Adminer ishesha kakhulu kune-phpMyAdmin lapho iphatha izizindalwazi ezinkulu.

Vele, akukho neyodwa kulezi zinto ezibaluleke kakhulu. Into ebaluleke kakhulu ukuthi lesi skripthi sisho ukuthi angisadingeki ngizilungiselele mathupha lezo zinto ezihlobene nokuphepha.

Yini ngempela eyenziwe yiskripthi?

Umqondo walesi skripthi empeleni ulula kakhulu: ukwenza zonke izinyathelo ovame ukuzenza ngesandla ngokuzenzakalela.

Ukuze uthole okufakwayo okusebenzisanayo, iskripthi sizokubuza imibuzo embalwa: Igama lomsebenzisi le- HestiaCP , igama lesizinda, igama lomsebenzisi lokuqinisekisa, kanye nephasiwedi. Udinga ukufaka lokhu kuphela, bese iskripthi sizophatha okunye.

Isikripthi sidala ngokuzenzakalelayo isiqondisi sempande yewebhu, sihlole ukuthi ama-apache2-utils (asetshenziselwa ukukhiqiza amafayela ephasiwedi) kanye nemvelo ye-PHP afakiwe, futhi siphatha ukudalwa kwesiqondisi kanye nokufakwa kokuxhomekeka.

Uma ulanda i-Adminer, iskripthi siqala ngokuzama ukulanda inguqulo yakamuva kusuka endaweni yokugcina esemthethweni. Uma indawo yokugcina esemthethweni ingatholakali, ishintshela ngokuzenzakalelayo endaweni yokugcina ezinzile ye-GitHub Releases. Ngicabanga ukuthi lokhu kubaluleke kakhulu, njengoba indawo yokugcina esemthethweni ngezinye izikhathi ingaba engazinzile; Ngike ngahlangabezana nesikhathi sokuphelelwa yisikhathi kokuxhumeka ngaphambili.

Ngokuphathelene nokulandwa kwama-plugin, iskripthi sizolanda ama-plugin amathathu ayinhloko: i-plugin.php iyisilayishi se-plugin, i-fc-sqlite-connection-without-credentials.php isetshenziselwa ukuphatha ukuxhumana okungenaphasiwedi, kanti i-login-password-less.php isekela ukungena ngemvume kwe-password hash.

Ngokuphathelene nokukhiqizwa kwe-hash yephasiwedi kanye ne-index.php, kunemininingwane emincane: iskripthi sisebenzisa i-getenv() ukuthola iphasiwedi esikhundleni sokusebenzisa ngqo i-$_ENV. Lokhu kugwema inkinga yokucushwa kwe-php.ini ebangela ukuba ukubalwa kwe-hash kungabi nalutho. Mina ngokwami ​​ngihlangane nalesi sihibe futhi ngachitha isikhathi eside ngithola ukuthi i-'E' scope ayivulwanga ku-php.ini.

Ukuze ulungiselele ukuqinisekiswa kwe-Nginx, iskripthi sisebenzisa indlela yokuhlanganisa ye-HestiaCP esikhundleni sokushintsha ngokuqondile ifayela lokucushwa eliyinhloko le-Nginx. Inzuzo yale ndlela ukuthi ukuqinisekiswa ngeke kwehluleke noma ngabe wakha kabusha ukucushwa kwesizinda.

Ekucushweni kwe-Fail2Ban, iskripthi sidala umthetho wokuhlunga ukuze kuqashwe amaphutha angu-401. Uma i-IP yehluleka ukungena izikhathi ezi-3 zingakapheli imizuzu eyi-10, izovinjelwa ihora eli-1.

Ngokuphathelene nokulungiswa kwezimvume kanye nokulayisha kabusha isevisi, iskripthi sizosetha ngokuzenzakalelayo izimvume zefayela ezifanele bese silayisha kabusha i-PHP-FPM, i-Nginx, kanye ne-Fail2Ban.

Ngizimisele ngokuphepha.

Ngokweqiniso, ukuphepha kwamathuluzi okuphatha isizindalwazi yinto engiyikhathalela kakhulu.

Cabanga ngakho, uMlawuli angakwazi ukulawula ngqo zonke izizindalwazi ezikuseva yakho. Uma ivezwa ku-inthanethi yomphakathi bese othile eyiskena, imiphumela ingaba yinto engacabangeki.

Lesi skripthi sinesivikelo esiphindwe kathathu.

Isendlalelo sokuqala yi-HTTP Basic Auth kaNginx. Uma ungena ku-Adminer, isiphequluli sakho sizovela ibhokisi lengxoxo elikucela ukuthi ufake igama lakho lomsebenzisi nephasiwedi. Kuphela ngemva kokufaka ulwazi olufanele lapho ungabona khona ikhasi lokungena le-Adminer.

Isendlalelo sesibili ukungena ngemvume kwe-hash yephasiwedi yoMphathi. Ngilungiselele i-hashing yephasiwedi ku-index.php, ngakho-ke noma umuntu edlula ukuqinisekiswa kwe-Nginx, ngeke ayazi iphasiwedi yokungena yoMphathi.

Isendlalelo sesithathu ukuvikelwa kwe-brute-force kwe-Fail2Ban. Uma othile ezama ukuphoqelela iphasiwedi yakho, i-Fail2Ban izovimba ngokuzenzakalelayo ikheli layo le-IP.

Njengoba lezi zingxenye ezintathu zokuvikela zihlanganisiwe, ungafaka uMlawuli ku-inthanethi yomphakathi ngokuthula kwengqondo.

Ukusebenza ngokuchofoza kanye, empeleni kuwukuchofoza kanye.

Inqubo yokufakwa ilula kakhulu.

#!/bin/bash
# ==============================================================================
# Adminer + 插件 + Nginx Auth + Fail2Ban 一键自动化部署脚本 (HestiaCP 完美版)
# ==============================================================================

set -e

# 必须以 root 权限运行
if [ "$EUID" -ne 0 ]; then
echo "❌ 错误：请使用 root 或 sudo 运行此脚本！"
exit 1
fi

# ------------------------------------------------------------------------------
# 1. 交互式输入配置参数
# ------------------------------------------------------------------------------
read -p "请输入 HestiaCP 用户名 [默认: admin]: " HESTIA_USER
HESTIA_USER=${HESTIA_USER:-admin}

read -p "请输入 Adminer 部署域名 [例如: adminer.example.com]: " DOMAIN
if [ -z "$DOMAIN" ]; then
echo "❌ 错误：域名不能为空！"
exit 1
fi

read -p "请输入 Nginx 网页认证用户名 [默认: adminuser]: " AUTH_USER
AUTH_USER=${AUTH_USER:-adminuser}

read -sp "请输入防护密码 (用于 Nginx 认证与 Adminer 登录): " AUTH_PASS
echo ""
if [ -z "$AUTH_PASS" ]; then
echo "❌ 错误：密码不能为空！"
exit 1
fi

# 核心路径变量定义
WEBROOT="/home/$HESTIA_USER/web/$DOMAIN/public_html"
ADMINER_FILE="$WEBROOT/adminer.php"
PLUGIN_DIR="$WEBROOT/plugins"
HTPASSWD_FILE="/etc/nginx/.htpasswd-$DOMAIN"

echo -e "\n🚀 开始部署 Adminer 到域名: $DOMAIN ..."

# ------------------------------------------------------------------------------
# 2. 创建目录与安装基础依赖
# ------------------------------------------------------------------------------
if [ ! -d "$WEBROOT" ]; then
echo "📁 创建 Web 根目录: $WEBROOT"
mkdir -p "$WEBROOT"
fi
mkdir -p "$PLUGIN_DIR"

echo "🔍 检查基础依赖环境..."
if ! command -v htpasswd >/dev/null 2>&1; then
echo "📦 安装 apache2-utils 工具包..."
apt-get update -qq && apt-get install -y -qq apache2-utils
fi

if ! command -v php >/dev/null 2>&1; then
echo "❌ 错误：未检测到系统的 PHP 环境！"
exit 1
fi

# ------------------------------------------------------------------------------
# 3. 安全下载 Adminer 核心程序
# ------------------------------------------------------------------------------
echo "📥 正在下载最新版 Adminer..."
curl -sL -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
-o "$ADMINER_FILE" "https://www.adminer.org/latest.php"

# 校验下载有效性
if ! grep -q "<?php" "$ADMINER_FILE"; then
echo "⚠️ 官方源连接异常，正在切换至 GitHub Releases 稳定源..."
curl -sL -o "$ADMINER_FILE" \
"https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1.php"
fi

# ------------------------------------------------------------------------------
# 4. 下载官方核心插件与加载器
# ------------------------------------------------------------------------------
echo "🧩 正在下载插件组件..."
curl -sL -o "$PLUGIN_DIR/plugin.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/plugin.php

curl -sL -o "$PLUGIN_DIR/fc-sqlite-connection-without-credentials.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/fc-sqlite-connection-without-credentials.php

curl -sL -o "$PLUGIN_DIR/login-password-less.php" \
https://raw.githubusercontent.com/vrana/adminer/master/plugins/login-password-less.php

# ------------------------------------------------------------------------------
# 5. 安全生成密码 Hash 并构建入口文件 index.php
# ------------------------------------------------------------------------------
echo "⚙️ 生成密码 Hash 与 index.php 配置..."
# 使用 getenv() 替代 $_ENV，防止 php.ini 未开启 E 作用域导致 Hash 计算为空
HASHED_PASSWORD=$(AUTH_PASS="$AUTH_PASS" php -r 'echo password_hash(getenv("AUTH_PASS"), PASSWORD_DEFAULT);')

cat > "$WEBROOT/index.php" <<EOF
<?php
function adminer_object() {
include_once "./plugins/plugin.php";
include_once "./plugins/fc-sqlite-connection-without-credentials.php";
include_once "./plugins/login-password-less.php";

return new AdminerPlugin([
new AdminerFCSqliteConnectionWithoutCredentials(),
new AdminerLoginPasswordLess('$HASHED_PASSWORD'),
]);
}
include "./adminer.php";
EOF

# ------------------------------------------------------------------------------
# 6. 配置 Nginx 基础认证 (完全依赖 HestiaCP 原生 Include 机制)
# ------------------------------------------------------------------------------
echo "🔒 配置 Nginx HTTP Basic Auth..."
htpasswd -b -c "$HTPASSWD_FILE" "$AUTH_USER" "$AUTH_PASS"
chmod 644 "$HTPASSWD_FILE"

HESTIA_CONF_DIR="/home/$HESTIA_USER/conf/web/$DOMAIN"
if [ -d "$HESTIA_CONF_DIR" ]; then
# HestiaCP 原生包含文件名格式：nginx.conf_* 与 nginx.ssl.conf_*
# 这样无需 sed 修改主配置文件，重建域名配置时也不会失效
cat > "$HESTIA_CONF_DIR/nginx.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF

cat > "$HESTIA_CONF_DIR/nginx.ssl.conf_adminer" <<EOF
auth_basic "Restricted Adminer Access";
auth_basic_user_file $HTPASSWD_FILE;
EOF
fi

# ------------------------------------------------------------------------------
# 7. 配置 Fail2Ban 防护规则
# ------------------------------------------------------------------------------
echo "🛡️ 配置 Fail2Ban 规则..."
cat > /etc/fail2ban/filter.d/nginx-adminer.conf <<'EOF'
[Definition]
failregex = ^<HOST> - .* "GET /.* HTTP/.*" 401
ignoreregex =
EOF

cat > /etc/fail2ban/jail.d/nginx-adminer.conf <<EOF
[nginx-adminer]
enabled = true
filter = nginx-adminer
port = http,https
logpath = /var/log/nginx/domains/$DOMAIN.log
maxretry = 3
findtime = 600
bantime = 3600
EOF

# ------------------------------------------------------------------------------
# 8. 修复权限、刷新缓存与重载服务
# ------------------------------------------------------------------------------
echo "🧹 修复权限并重载服务..."
chown -R $HESTIA_USER:$HESTIA_USER "$WEBROOT"
find "$WEBROOT" -type d -exec chmod 755 {} +
find "$WEBROOT" -type f -exec chmod 644 {} +

# 平滑重载 PHP-FPM（兼容多版本 PHP 环境）
for service in $(systemctl list-units --type=service --state=running --no-legend | awk '{print $1}' | grep -E 'php.*fpm'); do
systemctl reload "$service" || true
done

# 重载 Web 与防护服务
nginx -t && systemctl reload nginx
if systemctl is-active --quiet fail2ban; then
systemctl restart fail2ban
fi

echo -e "\n=================================================="
echo -e "✅ Adminer 一键部署成功！"
echo -e "--------------------------------------------------"
echo -e "🌐 访问地址 : https://$DOMAIN/index.php"
echo -e "👤 Nginx 认证账号 : $AUTH_USER"
echo -e "🔑 Nginx 认证密码 : [你输入的防护密码]"
echo -e "--------------------------------------------------"
echo -e "💡 Adminer 登录说明："
echo -e " 数据库用户名填写：root（或你的数据库账号）"
echo -e " 数据库密码填写：[你输入的防护密码]"
echo -e "=================================================="

Indlela yokusebenzisa iskripthi: Nikeza izimvume zokusebenzisa iskripthi:

sudo chmod +x /usr/local/bin/deploy-adminer.sh 

Sebenzisa iskripthi usebenzisa i-sudo:

sudo /usr/local/bin/deploy-adminer.sh 

Faka ulwazi lokucushwa njengoba uceliwe:

• Faka igama lakho lomsebenzisi le-HestiaCP (isb., umphathi).
• Faka isizinda esiphelele esilungisiwe (isb., adminer.example.com).
• Faka iphasiwedi yakho yokuphepha (isb., i-MySuperPassword123)

Iskripthi sizoqedela ngokuzenzakalelayo yonke inqubo yokucushwa ngaphandle kokushiya lutho.

Yonke inqubo ithatha cishe umzuzu owodwa noma emibili. Iskripthi sizosingatha konke ngokuzenzakalelayo, futhi awudingi ukwenza noma yimiphi imiyalo ngesandla.

Uma usuqedile, ungangena ku-Adminer nge-https://yourdomain/index.php

Eminye imibuzo ongase ukhathazeke ngayo

Abanye abangani bangase babuze, ingabe lesi skripthi sisekela izinguqulo eziningi ze-PHP?

Yebo, iyasekelwa. Iskripthi sizobona ngokuzenzakalelayo zonke izinsizakalo ze-PHP-FPM ezisebenza ohlelweni bese sizilayisha kabusha ngayinye ngayinye. Ngakho-ke kusebenza kahle noma ngabe usebenzisa i-PHP 7.4 noma i-PHP 8.2.

Abanye abangani bangase babuze, kuthiwani uma ngifuna ukushintsha iphasiwedi yami?

Kulula kakhulu; mane nje usebenzise kabusha iskripthi. Iskripthi sizophinda sikhiqize i-hash yephasiwedi, siphinde silungiselele ukuqinisekiswa kwe-Nginx, futhi siphinde silungiselele i-Fail2Ban. Ukucushwa okudala kuzobhalwa phansi.

Kuthiwani uma ngifuna ukuyikhipha?

Ungamane ususe i-web root directory, ifayela lephasiwedi, kanye nokucushwa kwe-Fail2Ban ngesandla. Iskripthi ngeke sishiye noma yiziphi ezinye izimpawu ohlelweni.

Bhala ekugcineni

Bengilokhu nginomuzwa wokuthi ukusebenza nokugcinwa kwempahla akufanele kube nzima kangaka.

Imisebenzi eminingi eyenziwa ngesandla empeleni ingenziwa ngokuzenzakalela kusetshenziswa izikripthi. Lokhu kukuvumela ukuthi uchithe isikhathi sakho ezintweni ezibaluleke kakhulu, njengokuthuthukisa ukusebenza kweseva, ukuqapha isimo sohlelo lokusebenza, kanye nokucwaninga ubuchwepheshe obusha.

Lokhu kungikhumbuza indaba yomlando. Ngawo-1880, ugesi waqala ukusabalala e-United States. Abanikazi bezimboni abaningi bachitha imali eningi ukuthenga amajeneretha nezinjini zikagesi futhi bazifaka emafektri abo. Kodwa-ke, ngemva kokufakwa, abaningi bathola ukuthi ukusebenza kahle kokukhiqiza akuzange kuthuthuke kakhulu. Lokhu kwakungenxa yokuthi babeshintshe izinjini zomusi kuphela ngezinjini zikagesi, kodwa ukwakheka, izinqubo, kanye nezindlela zokuphatha zefektri akushintshanga.

Labo abazuze ngempela ekukhuleni kukagesi baba ngabokuqala ukuqonda ukuthi kusho ukuthini ngempela ugesi. Bahlela kabusha imigqa yokukhiqiza, bahlela kabusha ama-workshop, futhi bahlela kabusha indlela abasebenzi ababesebenza ngayo.

Kunjalo nangokusebenza kanye nokulungisa okuzenzakalelayo. Abantu abaningi bayazi ukuthi izikripthi zingasetshenziswa, kodwa basathanda ukusebenza ngesandla, njengalabo abanikazi befektri esikhathini esidlule ababazi ngama-motor kagesi kodwa basasebenzisa indlela yokucabanga yezinjini zomusi ukuze bazisebenzise. Izikripthi azihloselwe ukuthatha indawo yokwahlulela kwakho, kodwa ukuzenzakalela imisebenzi ephindaphindwayo, yemishini, nevame ukwenza amaphutha, okukuvumela ukuthi ugxile amandla akho kulokho okudinga ngempela ukucabanga.

Le ndlela yavela ngayo le ncwadi. Ixazulule inkinga ebuhlungu kimi, futhi ngithemba ukuthi ingakusiza nawe.

Uma usebenzisa i-HestiaCP kanye ne-Adminer, ungase ufune ukuzama lesi skripthi. Kungase kukongele isikhathi esiningi.

Njengoba usufundile kuze kube manje, uma ukuthole kuwusizo, sicela uthande futhi wabelane ngakho. Uma ufuna ukuthola izibuyekezo kuqala, ungangilandela futhi!

Ngiyabonga ngokufunda isihloko sami. Sizobonana ngesikhathi esizayo.