mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 13:39:37 +08:00
Paul Gottschling
91c89b6126
* Organize docs guide sections chronologically This change aims to make docs navigation easier by organizing some docs sections according to the sequence of steps a user would take to set up Teleport. The current docs organization uses a variety of categories and schemes to organize the docs. For example, there is a "Home" section that includes the Changelog, Installation page, and Getting Started guides; a "Setup" section that includes references and admin guides; and edition-specific sections (Enterprise, Cloud). For a user who is setting up Teleport--or who has already done some setup work and wants more advanced instructions--it's difficult to know where in the docs to find the right information. This change organizes our how-to guides into the following categories that describe the process of setting up Teleport: - Try out Teleport - Deploy a Cluster (including choosing an edition) - Configure Access (including SSO, RBAC, and Access Requests) - Manage your Cluster (admin guides, operations, etc.) - Use Teleport (this section already exists) I moved the Reference section after this chronology, since users can access the reference guides anywhere in the setup process. As part of the change, I have also moved the content from the "Enterprise" and "Cloud" sections into "Deploy a Cluster", since this content has to do with how to deploy a specific edition of Teleport. Note that this change does _not_ attempt to reorganize our protocol-specific sections. While adding resources is part of the Teleport setup process, we have a lot of content in our protocol-specific sections, and moving it all into a single section related to adding resources to a cluster would (a) exceed the maximum depth for subsections in the nav bar and (b) cause more confusion than it alleviates. * Respond to PR feedback - Create a "Compliance Frameworks" section of "Configure Access" with the FedRAMP and SOC 2 guides - Rename "Use Teleport" to "Connect your Client" - Move the database GUI client guide into "Connect your Client" * Add redirects * Fix linter issues
117 lines
4.2 KiB
Plaintext
117 lines
4.2 KiB
Plaintext
---
|
|
title: Database Access FAQ
|
|
description: Frequently asked questions about Teleport Database Access.
|
|
---
|
|
|
|
## Which database protocols does Teleport Database Access support?
|
|
|
|
Teleport Database Access currently supports the following protocols:
|
|
|
|
- MariaDB
|
|
- Microsoft SQL Server
|
|
- MongoDB
|
|
- MySQL
|
|
- PostgreSQL
|
|
- Redis
|
|
- Snowflake
|
|
|
|
For PostgreSQL and MySQL, the following Cloud-hosted versions are supported in addition to self-hosted deployments:
|
|
|
|
- Amazon RDS
|
|
- Amazon Aurora (except for Amazon Aurora Serverless, which doesn't support IAM authentication)
|
|
- Amazon Redshift
|
|
- Google Cloud SQL
|
|
- Azure Database
|
|
|
|
See the available [guides](./guides.mdx) for all supported configurations.
|
|
|
|
## Which PostgreSQL protocol features are not supported?
|
|
|
|
The following PostgreSQL protocol features aren't currently supported:
|
|
|
|
- [Canceling requests in progress](https://www.postgresql.org/docs/current/protocol-flow.html#id-1.10.5.7.9).
|
|
Cancel requests issued by the PostgreSQL clients connected to the Teleport
|
|
Proxy Service won't be passed to the database server.
|
|
- Any [authentication methods](https://www.postgresql.org/docs/current/auth-methods.html)
|
|
except for client certificate authentication and IAM authentication for cloud
|
|
databases.
|
|
|
|
## Can database clients use a public address different from the web public address?
|
|
|
|
<Tabs>
|
|
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
|
|
|
|
When configuring the Teleport Proxy Service, administrators can set the
|
|
`postgres_public_addr` and `mysql_public_addr` configuration fields to public
|
|
addresses over which respective database clients should connect. See
|
|
[Proxy Configuration](./reference/configuration.mdx#proxy-configuration) for
|
|
more details.
|
|
|
|
This is useful when the Teleport Web UI is running behind an L7 load balancer
|
|
(e.g. ALB in AWS), in which case the PostgreSQL/MySQL proxy needs to be exposed
|
|
on a plain TCP load balancer (e.g. NLB in AWS).
|
|
|
|
</TabItem>
|
|
<TabItem scope={["cloud"]} label="Teleport Cloud">
|
|
|
|
In Teleport Cloud, the Proxy Service uses the following ports for
|
|
Database Access client traffic:
|
|
|
|
|Configuration setting|Port|
|
|
|---|---|
|
|
|`mysql_public_addr`|`3036`|
|
|
|`postgres_public_addr`|`443`|
|
|
|`mongo_public_addr`|`443`|
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Do you support X database client?
|
|
|
|
Teleport relies on client certificates for authentication, so any database
|
|
client that supports this method of authentication and uses modern TLS (1.2+)
|
|
should work.
|
|
|
|
Standard command-line clients such as `psql`, `mysql`, `mongo` or `mongosh` are
|
|
supported. There are also instructions for configuring select
|
|
[graphical clients](../connect-your-client/gui-clients.mdx).
|
|
|
|
## When will you support X database?
|
|
|
|
We plan to support more databases in the future based on customer demand.
|
|
|
|
See if the database you're interested in has already been requested among
|
|
[GitHub issues](https://github.com/gravitational/teleport/labels/database-access)
|
|
or open a [new issue](https://github.com/gravitational/teleport/issues/new/choose)
|
|
to register your interest.
|
|
|
|
## Can I provide a custom CA certificate?
|
|
|
|
Yes, you can pass custom CA certificate by using a
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration)
|
|
(look at `ca_cert_file`).
|
|
|
|
## Can I provide a custom DNS name for Teleport generated CA?
|
|
|
|
Yes, use `server_name` under the `tls` section in your Teleport configuration
|
|
file. Please look on our reference
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration)
|
|
for more details.
|
|
|
|
## Can I disable CA verification when connecting to a database?
|
|
|
|
Yes, although it is not recommended. Certificate verification prevents
|
|
person-in-the-middle attacks and makes sure that you
|
|
are connected to the database that you intended to.
|
|
|
|
Teleport also allows you to edit your
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration)
|
|
to provide a custom CA certificate (`ca_cert_file`) or custom DNS name
|
|
(`server_name`), which is more secure.
|
|
|
|
If none of the above options work for you and you still want to disable the CA
|
|
check, you can use `mode` under the `tls` option in the Teleport configuration file.
|
|
|
|
For more details please refer to the reference
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration).
|