Securing after third party access?

[Jono]

Hi, I'm new to DirectAdmin and VPS's in general.

I currently have a VPS running Ubuntu 11.04 x86 and DirectAdmin only. I planned on running a script that had a few requirements:

- PHP v5.1+ with the extensions zlib, exif, mbstring, curl, zip, freetype, XML-DOM, PDO_MYSQL
- Ability to execute system() function within PHP.
- The allow_url_fopen() option in PHP enabled.
- One clean mySQL v5+ database
- Apache mod_rewrite module
- Ability to execute scripts via crontab
- ionCube Loader

A chap from fiverr was recommended to me, and he has carried out the above configuration without problems.

He advised me to change the root password and phpmyadmin password when he had finished.

Can I get some advice please regarding:

1. - Is it enough to change the root and phpmyadmin passwords only?
2. - I can change the root password from inside my VPS control panel (and have done so), but how do I change the phpmyadmin password?
3. - He had access to /usr/local/directadmin/scripts/setup.txt, is there anything else I need to worry about?

Thank you for any help with the above,

Jono.

 

[zEitEr]

Hello,

1. - Is it enough to change the root and phpmyadmin passwords only?

Yes, in most cases, if he is a person of trust. Also you might need to change your admin password into Directadmin.

2. - I can change the root password from inside my VPS control panel (and have done so), but how do I change the phpmyadmin password?

Steps 2,3,4 of this guide http://help.directadmin.com/item.php?id=45

3. - He had access to /usr/local/directadmin/scripts/setup.txt, is there anything else I need to worry about?

If you change directadmin password and password of MySQL user da_admin, that should be OK.

 

[Jono]

Hi zEitEr,

Many thanks for the quick, detailed reply.

I have carried out the items listed and all seems to be working well.

Thanks again,

Jono.