I know almost everyone in this forum advises against installing phpmyadmin on a FreePBX distro system but I don’t understand why it’s considered such a huge security risk if it’s setup properly.
I mean you could place a .htaccess in the phpmyadmin directory or configure phpmyadmin.conf to allow only trusted IPs to access phpmyadmin. You could even use IPtables to allow phpmyadmin access only from a specific IP address.
If that’s locked down then where is the risk? Am I missing something?
I advise against it because, if your webport get compromised you lose control over your database. Other people have other reasons.
If you want to use a database manager, I actually recommend the community version of SQLYog.
Also in FreePBX the database should be hands off. People assume FreePBX just takes mysql data and makes configs. This is only about 40% true. There is a lot going on under the hood and simply touching a database entry may not accomplish the desired goal. It may actually break things.
All web applications no matter how careful the user can have bugs and security holes. Many of the large exploits to SSL, Bash etc have been in the code for 10+ years. Adding phpmyadmin adds another 380K lines of potential security threats to your PBX.
A compromised PBX can cost you a ton of money (https://en.wikipedia.org/wiki/Phone_fraud)
tl;dr there is no valid reason to have it, using it may expose you and break things.