diff --git a/docs/config.json b/docs/config.json index fa5a6d40163..7d0ad43df8c 100644 --- a/docs/config.json +++ b/docs/config.json @@ -195,6 +195,7 @@ { "title": "Self-Hosted MySQL/MariaDB", "slug": "/database-access/guides/mysql-self-hosted/" }, { "title": "Self-Hosted MongoDB", "slug": "/database-access/guides/mongodb-self-hosted/" }, { "title": "Self-Hosted CockroachDB", "slug": "/database-access/guides/cockroachdb-self-hosted/" }, + { "title": "SQL Server (Preview)", "slug": "/database-access/guides/sql-server-ad/" }, { "title": "Database GUI Clients", "slug": "/database-access/guides/gui-clients/" }, { "title": "Dynamic Registration", "slug": "/database-access/guides/dynamic-registration/" }, { "title": "High Availability", "slug": "/database-access/guides/ha/" } diff --git a/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png b/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png new file mode 100644 index 00000000000..aae0ead2228 Binary files /dev/null and b/docs/img/database-access/guides/sqlserver/datagrip-connection@2x.png differ diff --git a/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png b/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png new file mode 100644 index 00000000000..be7e973075c Binary files /dev/null and b/docs/img/database-access/guides/sqlserver/dbeaver-connection@2x.png differ diff --git a/docs/img/database-access/guides/sqlserver/spn@2x.png b/docs/img/database-access/guides/sqlserver/spn@2x.png new file mode 100644 index 00000000000..a107fa50ebc Binary files /dev/null and b/docs/img/database-access/guides/sqlserver/spn@2x.png differ diff --git a/docs/pages/database-access/guides.mdx b/docs/pages/database-access/guides.mdx index 1aadb4a7f3a..675e7289900 100644 --- a/docs/pages/database-access/guides.mdx +++ b/docs/pages/database-access/guides.mdx @@ -6,56 +6,4 @@ layout: tocless-doc # Database Access Guides -## Cloud-hosted guides - - - - Connect AWS RDS or Aurora PostgreSQL or MySQL database. - - - Connect AWS Redshift database. - - - Connect GCP Cloud SQL PostgreSQL database. - - - Connect GCP Cloud SQL MySQL database. - - - Connect Azure PostgreSQL or MySQL. - - - Connect MongoDB Atlas cluster. - - - -## Self-hosted guides - - - - Connect self-hosted PostgreSQL database. - - - Connect self-hosted MySQL/MariaDB database. - - - Connect self-hosted MongoDB database. - - - Connect self-hosted CockroachDB database. - - - -## General guides - - - - Configure database graphical clients. - - - Register/unregister databases without restarting Teleport. - - - Deploy database access in HA configuration. - - +(!docs/pages/includes/database-access/guides.mdx!) diff --git a/docs/pages/database-access/guides/gui-clients.mdx b/docs/pages/database-access/guides/gui-clients.mdx index b3fc3be9cd3..eae7b53cd18 100644 --- a/docs/pages/database-access/guides/gui-clients.mdx +++ b/docs/pages/database-access/guides/gui-clients.mdx @@ -110,34 +110,7 @@ Optionally, click "Test Connection" to verify connectivity: Save the connection, and connect to the database. -## MongoDB Compass - -[Compass](https://www.mongodb.com/products/compass) is the official MongoDB -graphical client. - -On the "New Connection" panel, click on "Fill in connection fields individually". - -![MongoDB Compass new connection](../../../img/database-access/compass-new-connection@2x.png) - -On the "Hostname" tab, enter your Teleport proxy's hostname and port shown -by `tsh db config`. Leave "Authentication" as None. - -![MongoDB Compass hostname](../../../img/database-access/compass-hostname@2x.png) - -On the "More Options" tab set SSL to "Client and Server Validation" and set -CA as well as client key and certificate. Note the CA path must be provided -and be able to validate certificate presented by your Teleport proxy's web -endpoint. Client key and certificate locations are shown by `tsh db config`. - -![MongoDB Compass more options](../../../img/database-access/compass-more-options@2x.png) - -Click on the "Connect" button. - -## DBeaver - -DBeaver is a SQL client software application and database administration tool. - -### MySQL +## MySQL DBeaver Teleport's DBeaver MySQL integration only supports MySQL server (=mysql.dbeaver_min_ver=) or older. @@ -173,3 +146,49 @@ Navigate to the "SSL" tab, check the "Use SSL" box, uncheck the "Verify Server C Click "Ok" to finish and DBeaver should connect to the remote MySQL server automatically. +## MongoDB Compass + +[Compass](https://www.mongodb.com/products/compass) is the official MongoDB +graphical client. + +On the "New Connection" panel, click on "Fill in connection fields individually". + +![MongoDB Compass new connection](../../../img/database-access/compass-new-connection@2x.png) + +On the "Hostname" tab, enter your Teleport proxy's hostname and port shown +by `tsh db config`. Leave "Authentication" as None. + +![MongoDB Compass hostname](../../../img/database-access/compass-hostname@2x.png) + +On the "More Options" tab set SSL to "Client and Server Validation" and set +CA as well as client key and certificate. Note the CA path must be provided +and be able to validate certificate presented by your Teleport proxy's web +endpoint. Client key and certificate locations are shown by `tsh db config`. + +![MongoDB Compass more options](../../../img/database-access/compass-more-options@2x.png) + +Click on the "Connect" button. + +## SQL Server DBeaver + +(!docs/pages/includes/database-access/sql-server-local-proxy.mdx!) + +In DBeaver connection configuration use the local proxy's endpoint (`localhost:4242` +in the example above) as host/port. Use SQL Server Authentication option and keep +the Password field empty: + +![DBeaver connection options](../../../img/database-access/guides/sqlserver/dbeaver-connection@2x.png) + +Click OK to connect. + +## SQL Server DataGrip + +(!docs/pages/includes/database-access/sql-server-local-proxy.mdx!) + +In DataGrip connection configuration use the local proxy's endpoint (`localhost:4242` +in the example above) as host/port. Use Use & Password authentication option and +keep the Password field empty: + +![DataGrip connection options](../../../img/database-access/guides/sqlserver/datagrip-connection@2x.png) + +Click OK to connect. diff --git a/docs/pages/database-access/guides/sql-server-ad.mdx b/docs/pages/database-access/guides/sql-server-ad.mdx new file mode 100644 index 00000000000..24b167406da --- /dev/null +++ b/docs/pages/database-access/guides/sql-server-ad.mdx @@ -0,0 +1,337 @@ +--- +title: Database Access with Microsoft SQL Server with Active Directory authentication (Preview) +description: How to configure Teleport Database Access with Microsoft SQL Server with Active Directory authentication. +--- + +
+ Database access for Microsoft SQL Server with Active Directory authentication + is available starting from Teleport `9.0`. +
+ + + Database access for Microsoft SQL Server is currently in a Preview mode and + does not include audit logging of database query activity. + + +This guide will help you to: + +- Install and configure Teleport. +- Set up access to SQL Server using Active Directory authentication. +- Connect to SQL Server through Teleport. + +This guide will focus on Amazon RDS for SQL Server using AWS-managed Active +Directory authentication. + +## Prerequisites + +- Teleport version >= `9.0`. +- A SQL Server database with Active Directory authentication enabled. +- A Windows machine joined to the same Active Directory domain as the database. +- A Linux node joined to the same Active Directory domain as the database. This + guide will walk you through the joining steps if you don't have one. + +## Step 1/7. Set up Teleport Auth and Proxy + +(!docs/pages/includes/database-access/start-auth-proxy.mdx!) + +## Step 2/7. Create a Teleport user + +(!docs/pages/includes/database-access/create-user.mdx!) + +## Step 3/7. Join the Linux node to Active Directory + + + You can skip this step if you already have a Linux node joined to the same + Active Directory domain as your SQL Server. + + +The Linux node where the Database Service will run must be joined to the same +Active Directory domain as the SQL Server database. + +Note that in order to be able to join, the Linux node must be able to resolve +your Active Directory fully-qualified domain name. For example, for AWS-managed +AD, use nameservers provided under "Networking details" on the directory's +overview page. + +Install necessary packages: + + + + ```bash + $ sudo apt-get update + $ sudo apt-get -y install sssd realmd krb5-user samba-common packagekit adcli + ``` + + + ```bash + $ sudo yum -y update + $ sudo yum -y install sssd realmd krb5-workstation samba-common-tools + ``` + + + +Edit `/etc/krb5.conf` to disable reverse DNS resolution and set the default +realm. Make sure that the `[realms]` section contains your domain definition +and has `admin_server` and `kdc` fields set pointing to the domain controllers: + +```ini +[libdefaults] +default_realm = EXAMPLE.COM +rdns = false + +[realms] + EXAMPLE.COM = { + kdc = example.com + admin_server = example.com + } +``` + +Join the realm: + +```bash +$ sudo realm join -v -U admin@EXAMPLE.COM example.com +... + * Successfully enrolled machine in realm +``` + + + Note that the realm name in `admin@EXAMPLE.COM` **must** be capital case, + otherwise the node might not be able to join. + + +To confirm the node has joined the realm, use the `realm list` command: + +```bash +$ sudo realm list +example.com + type: kerberos + realm-name: EXAMPLE.COM + domain-name: example.com + configured: kerberos-member + server-software: active-directory + client-software: sssd + ... +``` + +## Step 4/7. Create keytab file + +Teleport requires a keytab file to obtain Kerberos service tickets from your +Active Directory for authentication with SQL Server. The easiest way to generate +it is to use the `adutil` Linux CLI utility. + +Install `adutil` on the Linux node you have joined to your Active Directory +domain: + + + + ```bash + $ curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add - + $ sudo curl https://packages.microsoft.com/config/ubuntu/18.04/prod.list | sudo tee /etc/apt/sources.list.d/msprod.list + $ sudo apt-get update + $ sudo ACCEPT_EULA=Y apt-get install -y adutil + ``` + + + ```bash + $ sudo wget -qO /etc/apt/trusted.gpg.d/microsoft.asc https://packages.microsoft.com/keys/microsoft.asc + $ sudo curl https://packages.microsoft.com/config/ubuntu/20.04/prod.list | sudo tee /etc/apt/sources.list.d/msprod.list + $ sudo apt-get update + $ sudo ACCEPT_EULA=Y apt-get install -y adutil + ``` + + + ```bash + $ sudo curl -o /etc/yum.repos.d/msprod.repo https://packages.microsoft.com/config/rhel/8/prod.repo + $ sudo ACCEPT_EULA=Y yum install -y adutil + ``` + + + +Log into your Active Directory using the `kinit` command: + +```bash +$ kinit admin@EXAMPLE.COM +``` + +Use the `adutil keytab create` command to generate keytab entries for each +Active Directory user that will be connecting to the SQL Server database: + +```bash +$ adutil keytab create teleport.keytab alice +$ adutil keytab create teleport.keytab bob +``` + +You will be prompted to enter each user's password. All keytab entries will +be merged into the same `teleport.keytab` file. + + + For the `adutil keytab create` command to work, each user account must be + assigned a Service Principal Name, otherwise the command will not be able + to determine its `kvno` (key version number). + + To check if the user has any SPNs assigned, run the following command on the + Windows machine joined to your Active Directory domain: + + ```code + $ setspn -L alice + ``` + + To assign an SPN to a user account, use the following command: + + ```code + $ setspn -s user/alice alice + ``` + + +You can verify entries in the keytab file using `klist` command: + +```bash +$ klist -ke teleport.keytab +Keytab name: FILE:teleport.keytab +KVNO Principal +---- -------------------------------------------------------------------------- + 5 alice@EXAMPLE.COM (aes256-cts-hmac-sha1-96) + 2 bob@EXAMPLE.COM (aes256-cts-hmac-sha1-96) +``` + + + You must update the keytab file after updating a user's password to avoid + authentication failures. + + +## Step 5/7. Set up Teleport Database Service + +(!docs/pages/includes/database-access/token.mdx!) + + + Teleport Database Service must run on a Linux server joined to the same + Active Directory domain as the SQL Server. + + +Start Teleport Database Service. Make sure to update `--auth-server` to point to +your Teleport Proxy Service address and `--uri` to the SQL Server endpoint. + + ```bash + $ teleport db start \ + --token=/tmp/token \ + --auth-server=teleport.example.com:3080 \ + --name=sqlserver \ + --protocol=sqlserver \ + --uri=sqlserver.example.com:1433 \ + --ad-keytab=/path/to/teleport.keytab \ + --ad-domain=EXAMPLE.COM \ + --ad-spn=MSSQLSvc/sqlserver.example.com:1433 \ + --labels=env=dev + ``` + +Provide Active Directory parameters: + +| Flag | Description | +| ---- | ----------- | +| `--ad-keytab` | Path to Kerberos keytab file generated above. | +| `--ad-domain` | Active Directory domain (Kerberos realm) that SQL Server is joined. | +| `--ad-spn` | Service Principal Name for SQL Server to fetch Kerberos tickets for. | + + + You can start Teleport Database Service using a configuration file instead of + CLI flags. See [YAML reference](../reference/configuration.mdx). + + +### Service Principal Name + +You can use `ldapsearch` command to see the SPNs registered for your SQL +Server. Typically, they take a form of `MSSQLSvc/.:`. + +For example, an AWS RDS SQL Server named `sqlserver` and joined to an AWS managed +Active Directory domain `EXAMPLE.COM` will have the following SPNs registered: + +```bash +$ ldapsearch -x -h example.com -D admin -W -b DC=example,DC=com servicePrincipalName +... +# EC2AMAZ-4KN05DU, RDS, AWS Reserved, example.com +dn: CN=EC2AMAZ-4KN05DU,OU=RDS,OU=AWS Reserved,DC=example,DC=com +servicePrincipalName: MSSQLSvc/sqlserver-rds.example.com:1433 +servicePrincipalName: MSSQLSvc/EC2AMAZ-4KN05DU.example.com:1433 +servicePrincipalName: MSSQLSvc/EC2AMAZ-4KN05DU.example.com +... +``` + +Alternatively, you can look SPNs up in the Attribute Editor of the Active Directory +Users and Computers dialog on your AD-joined Windows machine. The RDS SQL Server +object typically resides under the AWS Reserved / RDS path: + +![SPN](../../../img/database-access/guides/sqlserver/spn@2x.png) + + + If you don't see Attribute Editor tab, make sure that "View > Advanced Features" + toggle is enabled. + + +## Step 6/7. Create SQL Server AD users + + + You can skip this step if you already have Active Directory logins in your + SQL Server. + + +Connect to your SQL Server as an administrative account (e.g. `sa`) and create +logins that will use Active Directory authentication: + +```sql +master> CREATE LOGIN [EXAMPLE\alice] FROM WINDOWS WITH DEFAULT_DATABASE = [master], DEFAULT_LANGUAGE = [us_english]; +``` + +## Step 7/7. Connect + +Log into your Teleport cluster. Your SQL Server database should appear in the +list of available databases: + +```code +$ tsh login --proxy=teleport.example.com --user=alice +$ tsh db ls +# Name Description Labels +# --------- ------------------- ------- +# sqlserver env=dev +``` + +Fetch the short-lived client certificate for it using the `tsh db login` command: + +```code +$ tsh db login --db-user=teleport sqlserver +``` + + + You can be logged into multiple databases simultaneously. + + +Now connect to the database: + +```code +$ tsh db connect sqlserver +``` + + + The `mssql-cli` command-line client should be available in PATH of the machine + you're running `tsh db connect` from. + + +To log out of the database and remove credentials: + +```code +$ tsh db logout sqlserver +``` + +## Next steps + +(!docs/pages/includes/database-access/guides-next-steps.mdx!) + +## Further reading + +- [Manually join a Linux instance](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html) in the AWS documentation. +- [Introduction to `adutil`](https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-ad-auth-adutil-introduction) in the Microsoft documentation. diff --git a/docs/pages/database-access/introduction.mdx b/docs/pages/database-access/introduction.mdx index bece5998af8..f4d052d7932 100644 --- a/docs/pages/database-access/introduction.mdx +++ b/docs/pages/database-access/introduction.mdx @@ -49,59 +49,7 @@ with Github, execute a few SQL queries and observe them in the audit log: -## Cloud-hosted guides - - - - Connect AWS RDS or Aurora PostgreSQL or MySQL database. - - - Connect AWS Redshift database. - - - Connect GCP Cloud SQL PostgreSQL database. - - - Connect GCP Cloud SQL MySQL database. - - - Connect Azure PostgreSQL or MySQL. - - - Connect MongoDB Atlas cluster. - - - -## Self-hosted guides - - - - Connect self-hosted PostgreSQL database. - - - Connect self-hosted MySQL/MariaDB database. - - - Connect self-hosted MongoDB database. - - - Connect self-hosted CockroachDB database. - - - -## General guides - - - - Configure database graphical clients. - - - Register/unregister databases without restarting Teleport. - - - Deploy database access in HA configuration. - - +(!docs/pages/includes/database-access/guides.mdx!) ## Resources diff --git a/docs/pages/database-access/reference/configuration.mdx b/docs/pages/database-access/reference/configuration.mdx index 888d6f807c7..df6aad3c23a 100644 --- a/docs/pages/database-access/reference/configuration.mdx +++ b/docs/pages/database-access/reference/configuration.mdx @@ -9,72 +9,7 @@ The following snippet shows full YAML configuration of a Database Service appearing in `teleport.yaml` configuration file: ```yaml -db_service: - # Enables the Database Service. - enabled: "yes" - - # Matchers for database resources created with "tctl create" command. - resources: - - labels: - "*": "*" - - # Matchers for registering AWS-hosted databases. - aws: - # Database types. Valid options are: - # 'rds' - discovers and registers AWS RDS and Aurora databases. - # 'redshift' - discovers and registers AWS Redshift databases. - - types: ["rds", "redshift"] - # AWS regions to register databases from. - regions: ["us-west-1", "us-east-2"] - # AWS resource tags to match when registering databases. - tags: - "*": "*" - - # Lists statically registered databases proxied by this agent. - databases: - # Name of the database proxy instance, used to reference in CLI. - - name: "prod" - # Free-form description of the database proxy instance. - description: "Production database" - # Database protocol. Can be "postgres", "mysql" or "mongodb". - protocol: "postgres" - # Database connection endpoint. Must be reachable from Database Service. - uri: "postgres.example.com:5432" - # Optional TLS configuration. - tls: - # TLS verification mode. Valid options are: - # 'verify-full' - performs full certificate validation (default). - # 'verify-ca' - the same as `verify-full`, but skips the server name validation. - # 'insecure' - accepts any certificate provided by database (not recommended). - mode: verify-full - # Optional database DNS server name. It allows to override the DNS name on - # a client certificate when connecting to a database. - # Use only with 'verify-full' mode. - server_name: db.example.com - # Optional path to the CA used to validate the database certificate. - ca_cert_file: /path/to/pem - # AWS specific configuration, only required for RDS/Aurora/Redshift. - aws: - # Region the database is deployed in. - region: "us-east-1" - # Redshift specific configuration. - redshift: - # Redshift cluster identifier. - cluster_id: "redshift-cluster-1" - # GCP specific configuration for Cloud SQL databases. - gcp: - # GCP project ID. - project_id: "xxx-1234" - # Cloud SQL instance ID. - instance_id: "example" - # Static labels to assign to the database. Used in RBAC. - static_labels: - env: "prod" - # Dynamic labels ("commands"). Used in RBAC. - dynamic_labels: - - name: "hostname" - command: ["hostname"] - period: 1m0s +(!docs/pages/includes/database-access/database-config.yaml!) ``` ## Proxy configuration @@ -126,21 +61,27 @@ version: v3 metadata: # Database resource name. name: example + # Database resource description. description: "Example database" + # Database resource static labels. labels: env: example + spec: # Database protocol. protocol: "postgres" + # Database connection endpoint. uri: "localhost:5432" + # Optional CA for validating the database certificate. ca_cert: | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- + # Optional AWS configuration for RDS/Aurora/Redshift. Can be auto-detected from the endpoint. aws: # Region the database is deployed in. @@ -149,12 +90,25 @@ spec: redshift: # Redshift cluster identifier. cluster_id: "redshift-cluster-1" + # Optional GCP configuration for Cloud SQL. gcp: # GCP project ID. project_id: "xxx-1234" # Cloud SQL instance ID. instance_id: "example" + + # Settings specific to Active Directory authentication e.g. for SQL Server. + ad: + # Path to Kerberos keytab file. + keytab_file: /path/to/keytab + # Active Directory domain name. + domain: EXAMPLE.COM + # Service Principal Name to obtain Kerberos tickets for. + spn: MSSQLSvc/ec2amaz-4kn05du.dbadir.teleportdemo.net:1433 + # Optional path to Kerberos configuration file. Defaults to /etc/krb5.conf. + krb5_file: /etc/krb5.conf + # Optional dynamic labels. dynamic_labels: - name: "hostname" diff --git a/docs/pages/includes/database-access/database-config.yaml b/docs/pages/includes/database-access/database-config.yaml new file mode 100644 index 00000000000..65587c4d0ea --- /dev/null +++ b/docs/pages/includes/database-access/database-config.yaml @@ -0,0 +1,85 @@ +db_service: + # Enables the Database Service. + enabled: "yes" + + # Matchers for database resources created with "tctl create" command. + resources: + - labels: + "*": "*" + + # Matchers for registering AWS-hosted databases. + aws: + # Database types. Valid options are: + # 'rds' - discovers and registers AWS RDS and Aurora databases. + # 'redshift' - discovers and registers AWS Redshift databases. + - types: ["rds", "redshift"] + # AWS regions to register databases from. + regions: ["us-west-1", "us-east-2"] + # AWS resource tags to match when registering databases. + tags: + "*": "*" + + # Lists statically registered databases proxied by this agent. + databases: + # Name of the database proxy instance, used to reference in CLI. + - name: "prod" + + # Free-form description of the database proxy instance. + description: "Production database" + + # Database protocol. Can be: "postgres", "mysql", "mongodb", "cockroachdb", "sqlserver". + protocol: "postgres" + + # Database connection endpoint. Must be reachable from Database Service. + uri: "postgres.example.com:5432" + + # Optional TLS configuration. + tls: + # TLS verification mode. Valid options are: + # 'verify-full' - performs full certificate validation (default). + # 'verify-ca' - the same as `verify-full`, but skips the server name validation. + # 'insecure' - accepts any certificate provided by database (not recommended). + mode: verify-full + # Optional database DNS server name. It allows to override the DNS name on + # a client certificate when connecting to a database. + # Use only with 'verify-full' mode. + server_name: db.example.com + # Optional path to the CA used to validate the database certificate. + ca_cert_file: /path/to/pem + + # AWS specific configuration, only required for RDS/Aurora/Redshift. + aws: + # Region the database is deployed in. + region: "us-east-1" + # Redshift specific configuration. + redshift: + # Redshift cluster identifier. + cluster_id: "redshift-cluster-1" + + # GCP specific configuration for Cloud SQL databases. + gcp: + # GCP project ID. + project_id: "xxx-1234" + # Cloud SQL instance ID. + instance_id: "example" + + # Settings specific to Active Directory authentication e.g. for SQL Server. + ad: + # Path to Kerberos keytab file. + keytab_file: /path/to/keytab + # Active Directory domain name. + domain: EXAMPLE.COM + # Service Principal Name to obtain Kerberos tickets for. + spn: MSSQLSvc/ec2amaz-4kn05du.dbadir.teleportdemo.net:1433 + # Optional path to Kerberos configuration file. Defaults to /etc/krb5.conf. + krb5_file: /etc/krb5.conf + + # Static labels to assign to the database. Used in RBAC. + static_labels: + env: "prod" + + # Dynamic labels ("commands"). Used in RBAC. + dynamic_labels: + - name: "hostname" + command: ["hostname"] + period: 1m0s diff --git a/docs/pages/includes/database-access/guides.mdx b/docs/pages/includes/database-access/guides.mdx new file mode 100644 index 00000000000..cdb6296b8be --- /dev/null +++ b/docs/pages/includes/database-access/guides.mdx @@ -0,0 +1,51 @@ +## Database guides + + + + Connect AWS RDS or Aurora PostgreSQL or MySQL database. + + + Connect AWS Redshift database. + + + Connect GCP Cloud SQL PostgreSQL database. + + + Connect GCP Cloud SQL MySQL database. + + + Connect Azure PostgreSQL or MySQL. + + + Connect MongoDB Atlas cluster. + + + Connect self-hosted PostgreSQL database. + + + Connect self-hosted MySQL or MariaDB database. + + + Connect self-hosted MongoDB database. + + + Connect self-hosted CockroachDB database. + + + Connect Microsoft SQL Server with Active Directory authentication. + + + +## Other guides + + + + Configure database graphical clients. + + + Register/unregister databases without restarting Teleport. + + + Deploy database access in HA configuration. + + diff --git a/docs/pages/includes/database-access/sql-server-local-proxy.mdx b/docs/pages/includes/database-access/sql-server-local-proxy.mdx new file mode 100644 index 00000000000..bc07fbc0834 --- /dev/null +++ b/docs/pages/includes/database-access/sql-server-local-proxy.mdx @@ -0,0 +1,24 @@ +SQL Server clients connect to a Teleport cluster via the local proxy in +[TLS Routing](../../architecture/tls-routing.mdx) mode. + +Log into your SQL Server database with `tsh db login` and execute `tsh db config` +to locate the paths to the client certificate and key pair: + +```bash +$ tsh db config sqlserver +Name: sqlserver +... +Cert: /home/alice/.tsh/keys/teleport.example.com/alice-db/cluster/example-x509.pem +Key: /home/alice/.tsh/keys/teleport.example.com/alice +``` + +Start the local TLS proxy providing the cert/key paths and, optionally, the port +number to listen on: + +```bash +$ tsh proxy db \ + --port 4242 \ + --cert-file /home/alice/.tsh/keys/teleport.example.com/alice-db/cluster/example-x509.pem \ + --key-file /home/alice/.tsh/keys/teleport.example.com/alice \ + sqlserver +``` diff --git a/docs/pages/index.mdx b/docs/pages/index.mdx index 63e6bf87ef3..e579c391413 100644 --- a/docs/pages/index.mdx +++ b/docs/pages/index.mdx @@ -25,7 +25,7 @@ Teleport is a Certificate Authority and an Access Plane for your infrastructure. Single Sign-On, audit and unified access for Kubernetes clusters. - Secure access to PostgreSQL, MySQL, MariaDB and MongoDB databases. + Secure access to SQL and NoSQL databases. Secure browser-based access to desktop environments. diff --git a/docs/pages/setup/reference/config.mdx b/docs/pages/setup/reference/config.mdx index 3b4340d75b0..98ac098ca87 100644 --- a/docs/pages/setup/reference/config.mdx +++ b/docs/pages/setup/reference/config.mdx @@ -696,70 +696,7 @@ kubernetes_service: period: 1m0s # This section configures the 'database service'. -db_service: - # Enables the database service. Default is "no". - enabled: "yes" - - # Matchers for registering AWS-hosted databases. - aws: - # Database types. Valid options are: - # 'rds' - discovers and registers AWS RDS and Aurora databases. - # 'redshift' - discovers and registers AWS Redshift databases. - - types: ["rds", "redshift"] - # AWS regions to register databases from. - regions: ["us-west-1", "us-east-2"] - # AWS resource tags to match when registering databases. - tags: - "*": "*" - - # This section contains definitions of all databases proxied by this - # service, it can contain multiple database instances. - databases: - # Name of the database proxy instance used to reference in CLI. - - name: "prod" - # Free-form description of the database proxy instance. - description: "Production database" - # Database protocol. Can be "postgres", "mysql", or "mongodb". - protocol: "postgres" - # Database connection endpoint. Must be reachable from Database Service. - uri: "postgres.example.com:5432" - # Optional TLS configuration. - tls: - # TLS verification mode. Valid options are: - # 'verify-full' - performs full certificate validation (default). - # 'verify-ca' - the same as `verify-full`, but skips the server name - # validation. - # 'insecure' - accepts any certificate provided by database (not - # recommended). - mode: verify-full - # Optional database DNS server name. It allows to override the DNS name - # on a client certificate when connecting to a database. - # Use only with 'verify-full' mode. - server_name: db.example.com - # Optional path to the CA used to validate the database certificate. - ca_cert_file: /path/to/pem - # AWS specific configuration, only required for RDS/Aurora/Redshift. - aws: - # Region the database is deployed in. - region: "us-east-1" - # Redshift specific configuration. - redshift: - # Redshift cluster identifier. - cluster_id: "redshift-cluster-1" - # GCP specific configuration for Cloud SQL databases. - gcp: - # GCP project ID. - project_id: "xxx-1234" - # Cloud SQL instance ID. - instance_id: "example" - # Static labels to assign to the database. Used in RBAC. - static_labels: - env: "prod" - # Dynamic labels ("commands"). Used in RBAC. - dynamic_labels: - - name: "hostname" - command: ["hostname"] - period: 1m0s +(!docs/pages/includes/database-access/database-config.yaml!) # This section configures the windows desktop service (!docs/pages/includes/desktop-access/desktop-config.yaml!)