Install phpMyAdmin on Fedora 45 / 44 with Apache and MariaDB

If your team still manages MariaDB through a browser, phpMyAdmin on Fedora is one package away.

Original content from computingforgeeks.com - post 4477

The defaults stop most people at the first screen, though. Apache only serves the app to the server itself, and MariaDB’s root account cannot log in with a password at all.

We built this on a Fedora 45 server in October 2026 with phpMyAdmin 5.2.3, MariaDB 12.3.2 and Apache 2.4.68, then confirmed the same package on Fedora 44.

We will install phpMyAdmin, create an admin account, reach it through an SSH tunnel and open it to one admin subnet. After that we turn on the configuration storage it nags about and put it behind HTTPS.

What the Fedora package sets up

Fedora packages phpMyAdmin itself, so you do not need a tarball or a third-party repo.

Release	phpMyAdmin build	Repository
Fedora 45	5.2.3-3.fc45	fedora
Fedora 44	5.2.3-2.fc44	fedora

Behind the single package sit a generic webserver dependency, 18 PHP extensions and an Apache config in /etc/httpd/conf.d/phpMyAdmin.conf.

Its %post script also generates a 32-character blowfish_secret and writes it into /etc/phpMyAdmin/config.inc.php, so cookie login works without you editing anything.

In practice this means three defaults shape everything that follows:

• Both /phpMyAdmin and /phpmyadmin are aliased to /usr/share/phpMyAdmin.
• The app and its /setup/ directory are limited to Require local, so a browser on another machine gets a 403.
• The server entry points at localhost with cookie authentication, which means PHP talks to MariaDB over its Unix socket and no SELinux boolean is needed.

Install phpMyAdmin, Apache and MariaDB

One command pulls in the whole stack, because phpMyAdmin’s dependencies bring PHP-FPM and the extensions with it.

sudo dnf install -y httpd mariadb-server phpMyAdmin
sudo systemctl enable --now httpd mariadb

On our Fedora 45 server that was 68 packages in one transaction.

PHP-FPM is started by Apache through a systemd drop-in, so it does not need its own enable. The php command-line binary is not part of the set, which matters only if you planned to lint the config with php -l.

A request from the server itself confirms Apache is serving the app.

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/phpMyAdmin/

You should get 200 back.

If you need a firewall on the host, open HTTP now with sudo firewall-cmd --permanent --add-service=http followed by sudo firewall-cmd --reload. Our Cloud image did not ship firewalld, so we installed and enabled it first.

Create a MariaDB admin account

Do not plan on logging in as root.

On Fedora, MariaDB’s root authenticates through the Unix socket, which is why sudo mariadb works without a password. Any password login as root is refused. The mariadb client reports ERROR 1698 (28000), and the phpMyAdmin login form shows the same code:

mysqli::real_connect(): (HY000/1698): Access denied for user 'root'@'localhost'

We would rather leave that alone than weaken it, because a separate account with full rights is easier to audit and to revoke later.

Read the password into a variable so it never lands in your shell history, and keep it to letters and digits, since a quote or backslash breaks the SQL string.

read -rsp 'phpMyAdmin admin password: ' PMA_PASS; echo
sudo mariadb -e "CREATE USER 'pmaadmin'@'localhost' IDENTIFIED BY '$PMA_PASS'; GRANT ALL PRIVILEGES ON *.* TO 'pmaadmin'@'localhost' WITH GRANT OPTION;"

Test it from the shell before you open a browser.

mariadb -u pmaadmin -p"$PMA_PASS" -e "SELECT CURRENT_USER();"

It should print pmaadmin@localhost, while a password login as root still fails.

If your team needs narrower access, grant per database instead of *.*. phpMyAdmin only shows what the logged-in account can see.

Log in through an SSH tunnel

Your safest first login doesn’t change Apache at all.

An SSH tunnel makes your browser’s requests arrive from the server itself, so Require local lets them through.

Run this on your workstation, with your own user and server name.

ssh -N -L 18080:localhost:80 victor@app-eu-west-1a

Next, open http://localhost:18080/phpMyAdmin/ in your browser, and the login page is served through the tunnel.

Sign in as pmaadmin. On the home page you can confirm the whole stack, from Localhost via UNIX socket to the MariaDB, Apache and PHP versions.

We took this capture after the storage step further down, so unlike the capture, yours will still show a yellow storage notice and no phpmyadmin or inventory database yet.

For one or two admins, we would stop here.

A tunnel needs no firewall change, nothing is exposed to the network, and SSH keys are already your access control.

Allow your admin subnet

When a whole team needs a browser bookmark, allow one trusted subnet instead of the world.

Before the change, a host on our 10.0.1.0/24 admin network got a 403.

curl -s -o /dev/null -w '%{http_code}\n' http://10.0.1.52/phpMyAdmin/

It printed 403.

Add a Require ip line under the first Require local only, so /setup/ keeps its local-only rule. Replace the subnet with yours, and run the sed once, since a second run adds a duplicate line.

sudo sed -i '0,/   Require local/s//   Require local\n   Require ip 10.0.1.0\/24/' /etc/httpd/conf.d/phpMyAdmin.conf
sudo apachectl configtest
sudo systemctl reload httpd

Here the 0,/.../ address limits the edit to the first match, and the app block now reads as follows.

<Directory /usr/share/phpMyAdmin/>
   AddDefaultCharset UTF-8

   Require local
   Require ip 10.0.1.0/24
</Directory>

Several Require lines in one block are treated as alternatives, so either match is enough. From the same admin host, the app now answers and the setup script still refuses.

curl -s -o /dev/null -w "%{http_code}\n" http://10.0.1.52/phpMyAdmin/
curl -s -o /dev/null -w "%{http_code}\n" http://10.0.1.52/phpMyAdmin/setup/

You get 200 for the app and 403 for setup. Keep it that way, because the packaged config.inc.php already exists and the setup script has nothing to do here.

Expect configtest to warn with AH00558 about the server’s name. It is harmless here, and the LAMP stack on Fedora guide shows the one-line ServerName fix.

Turn on configuration storage

Your first login ends with a yellow notice at the bottom of the home page.

It reads “The phpMyAdmin configuration storage is not completely configured, some extended features have been deactivated.” Bookmarks, query history, designer layouts and saved user preferences live in that storage. Fedora ships the schema, and its config already lists every table, commented out.

Create the phpmyadmin database from the bundled SQL, then a control user that can only touch it:

sudo mariadb < /usr/share/phpMyAdmin/sql/create_tables.sql
read -rsp 'pma control user password: ' PMA_CTRL_PASS; echo
sudo mariadb -e "CREATE USER 'pma'@'localhost' IDENTIFIED BY '$PMA_CTRL_PASS'; GRANT SELECT, INSERT, UPDATE, DELETE ON phpmyadmin.* TO 'pma'@'localhost';"

Now uncomment the control user and storage lines, and swap the placeholder pmapass for the real password. One sed handles both, so keep the password to letters and digits:

sudo sed -i -e "/\['controluser'\]/,/'export_templates'/s|^// ||" -e "s|'pmapass'|'$PMA_CTRL_PASS'|" /etc/phpMyAdmin/config.inc.php

Because the range starts at controluser, the controlhost and controlport lines stay commented and the defaults apply. We printed the block back to check the edit, then tried to lint the file, which fails because the PHP CLI is not installed.

The last command was sudo mariadb -e "SHOW TABLES FROM phpmyadmin;" | wc -l, and all 20 lines it counted are the header plus 19 storage tables. No reload is needed, because PHP reads config.inc.php on every request.

After the next login the notice is gone, and features like Bookmark this SQL query appear under query results. We browsed a small inventory table to check:

Serve phpMyAdmin over HTTPS

Cookie login sends your MariaDB password with every sign-in, so plain HTTP is only acceptable through the tunnel.

For subnet access, add mod_ssl and open HTTPS. A self-signed certificate is created by the package on the next restart.

sudo dnf install -y mod_ssl
sudo systemctl restart httpd
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Our alias works on port 443 as well, because phpMyAdmin.conf sits outside any vhost. Test it from the admin host.

curl -sk -o /dev/null -w "%{http_code}\n" https://10.0.1.52/phpMyAdmin/

You get 200 again, and browsers will warn about the self-signed certificate.

On an internal network we would replace it with a certificate from your internal CA. A server with a public DNS name can use Certbot’s Apache plugin, as covered in the LAMP guide.

Once HTTPS works, close plain HTTP to the subnet if you opened it in firewalld earlier. Without firewalld, the subnet can still reach port 80, which is one more reason to run it on this host. The tunnel keeps working, because it reaches Apache on localhost, which the firewall does not filter. Ours still returned 200 after the change.

sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --reload

From the admin host, http://10.0.1.52/phpMyAdmin/ was then refused with curl exit code 7, while the https:// address still returned 200. Share only that address with your team.

If the server ever needs to face the internet, we would keep phpMyAdmin behind a VPN or the SSH tunnel rather than widen Require. Otherwise the login form is the only thing standing between a scanner and an account with every privilege.

For the database side of this host, the MariaDB on Fedora guide covers versions, remote clients and backups.