Putting phpPgAdmin behind SSL virtualhost and securing it a bit more

This could be a huge post, but I am cutting it short:

1. configure pg_hba.conf right, e.g. set host stuff to password md5
2. try to connect to your database locally to test it,
   e.g. psql -U user "psql -U user dbname -W" and type in the password
3. install phppgadmin, e.g. on debian I could not find a /etc/phppgadmin/apache.conf but a /etc/apache2/conf.d/phppgadmin
4. your apache2 should be able to serve SSL, otherwise look a my post from yesterday: SSL virtualhost after you setup a SSH connection through rsa keys and always redirect to it
5. in order to serve multiple site using SSL you should change to *:443 instead of _default_
6. also you have to tell /etc/apache2/ports.conf to use NameVirtualhost when listening on 443; otherwise apache will tell you about conflicting virtualhosts.
7. apache2: now its time to copy the content of conf.d/phppgadmin into a sites-available file and dont forget to delete the alias line and adjust names and folders.
8. From now on I followed these steps: Step Two—Adjust The Security Settings which is basically a htpasswd in front of the virtualhost

Even though you cant login into phpPgAdmin as root or postgres you database could be exposed. Now the attacker has to listen to a SSL conversation, hack it, sneack though apaches htpasswd system, and then hack phppgadmin.

But in any case its always good to close ports due to misconfiguration, e.g. postgresql exposed to the internet, or other services but SSH:
iptables - setting up a decent firewall