Centralized phpMyAdmin Using SSH Tunnels

Instead of installing phpMyAdmin on every ColdFusion, Lucee, or WordPress server, install a single copy on your local workstation and connect securely to each server through SSH tunnels.

This approach keeps MySQL and MariaDB inaccessible from the public Internet while providing a simple, centralized administration interface.

Benefits

• One phpMyAdmin installation to maintain.
• No phpMyAdmin deployment on production servers.
• MySQL and MariaDB remain inaccessible from the public Internet.
• Encrypted SSH connections for all database administration.
• Easy to manage multiple production, staging, and development servers.

Architecture

Your local workstation hosts phpMyAdmin.

phpMyAdmin connects to a forwarded local port, which is securely tunneled through SSH to the database server.

Local Workstation

phpMyAdmin
127.0.0.1:3307
        │
        │ SSH Tunnel
        ▼
Remote Server
MySQL 127.0.0.1:3306

The database never accepts direct public connections.

SSH Configuration

Define each server in your SSH configuration file:

~/.ssh/config

Host production
    HostName 10.0.1.130
    User root
    LocalForward 3307 127.0.0.1:3306

Host staging
    HostName 10.0.1.132
    User root
    LocalForward 3308 127.0.0.1:3306

Each additional server simply uses a different forwarded local port.

Starting a Tunnel

Production

ssh -N production

Staging

ssh -N staging

Once connected, phpMyAdmin will connect to:

• Production: 127.0.0.1:3307
• Staging: 127.0.0.1:3308

phpMyAdmin Configuration

Add a server entry for each SSH tunnel inside config.inc.php.

$cfg['Servers'][$i]['verbose'] = 'Production';
$cfg['Servers'][$i]['host'] = '127.0.0.1';
$cfg['Servers'][$i]['port'] = '3307';
$cfg['Servers'][$i]['auth_type'] = 'cookie';

$i++;

$cfg['Servers'][$i]['verbose'] = 'Staging';
$cfg['Servers'][$i]['host'] = '127.0.0.1';
$cfg['Servers'][$i]['port'] = '3308';
$cfg['Servers'][$i]['auth_type'] = 'cookie';

Repeat the configuration for each additional server, assigning a unique local port.

Security Considerations

• Bind MySQL or MariaDB to 127.0.0.1.
• Never expose port 3306 to the public Internet.
• Use SSH authentication for all remote database access.
• Prefer dedicated database accounts instead of the MySQL root account.
• Protect SSH keys with a passphrase whenever practical.

Conclusion

A centralized phpMyAdmin installation combined with SSH tunnels provides a secure, low-maintenance solution for administering multiple WordPress, Adobe ColdFusion, or Lucee servers.

This architecture reduces the attack surface of production environments while simplifying administration. Adding another server requires only a new SSH host definition, a unique local forwarding port, and an additional phpMyAdmin server entry.