mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 16:38:35 +08:00
Paul Gottschling
176935cbfa
- Remove the `team` scope from config.json. - Edit the Edition comparison table to remove the "Team" column. - Change the Teleport Team getting started guide to a Teleport Enterprise Cloud getting started guide. - Remove other Teleport Team mentions from the docs.
144 lines
4.7 KiB
Plaintext
144 lines
4.7 KiB
Plaintext
---
|
|
title: Database Access FAQ
|
|
description: Frequently asked questions about Teleport database access.
|
|
---
|
|
|
|
## Which database protocols does Teleport the Database Service support?
|
|
|
|
The Teleport Database Service currently supports the following protocols:
|
|
|
|
- Cassandra
|
|
- ClickHouse
|
|
- CockroachDB
|
|
- DynamoDB
|
|
- MariaDB
|
|
- Microsoft SQL Server
|
|
- MongoDB
|
|
- MySQL
|
|
- Oracle
|
|
- PostgreSQL
|
|
- Redis
|
|
- Snowflake
|
|
|
|
For PostgreSQL and MySQL, the following Cloud-hosted versions are supported in addition to self-hosted deployments:
|
|
|
|
- Amazon RDS
|
|
- Amazon Aurora (except for Amazon Aurora Serverless, which doesn't support IAM authentication)
|
|
- Amazon Redshift
|
|
- Google Cloud SQL
|
|
- Azure Database
|
|
|
|
See the available [guides](./guides.mdx) for all supported configurations.
|
|
|
|
## Which PostgreSQL protocol features are not supported?
|
|
|
|
The following PostgreSQL protocol features aren't currently supported:
|
|
|
|
- Any [authentication methods](https://www.postgresql.org/docs/current/auth-methods.html)
|
|
except for client certificate authentication and IAM authentication for cloud
|
|
databases.
|
|
|
|
|
|
## Are database sessions listed under recorded sessions?
|
|
|
|
(!docs/pages/includes/database-access/db-audit-events.mdx!)
|
|
|
|
## Can database clients use a public address different from the web public address?
|
|
|
|
<Tabs>
|
|
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
|
|
|
|
When configuring the Teleport Proxy Service, administrators can set the
|
|
`postgres_public_addr` and `mysql_public_addr` configuration fields to public
|
|
addresses over which respective database clients should connect. See
|
|
[Proxy Configuration](./reference/configuration.mdx#proxy-configuration) for
|
|
more details.
|
|
|
|
This is useful when the Teleport Web UI is running behind an L7 load balancer
|
|
(e.g. ALB in AWS), in which case the PostgreSQL/MySQL proxy needs to be exposed
|
|
on a plain TCP load balancer (e.g. NLB in AWS).
|
|
|
|
</TabItem>
|
|
<TabItem scope={["cloud","team"]} label="Cloud-Hosted">
|
|
|
|
In Teleport Enterprise Cloud, the Proxy Service uses the following ports for
|
|
Database Service client traffic:
|
|
|
|
|Configuration setting|Port|
|
|
|---|---|
|
|
|`mysql_public_addr`|`3036`|
|
|
|`postgres_public_addr`|`443`|
|
|
|`mongo_public_addr`|`443`|
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Do you support X database client?
|
|
|
|
Teleport relies on client certificates for authentication, so any database
|
|
client that supports this method of authentication and uses modern TLS (1.2+)
|
|
should work.
|
|
|
|
Standard command-line clients such as `psql`, `mysql`, `mongo` or `mongosh` are
|
|
supported. There are also instructions for configuring select
|
|
[graphical clients](../connect-your-client/gui-clients.mdx).
|
|
|
|
## When will you support X database?
|
|
|
|
We plan to support more databases in the future based on customer demand.
|
|
|
|
See if the database you're interested in has already been requested among
|
|
[GitHub issues](https://github.com/gravitational/teleport/labels/database-access)
|
|
or open a [new issue](https://github.com/gravitational/teleport/issues/new/choose)
|
|
to register your interest.
|
|
|
|
## Can I provide a custom CA certificate?
|
|
|
|
Yes, you can pass custom CA certificate by using a
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration)
|
|
(look at `ca_cert_file`).
|
|
|
|
## Can I provide a custom DNS name for Teleport generated CA?
|
|
|
|
Yes, use `server_name` under the `tls` section in your Teleport configuration
|
|
file. Please look on our reference
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration)
|
|
for more details.
|
|
|
|
## Can I disable CA verification when connecting to a database?
|
|
|
|
Yes, although it is not recommended. Certificate verification prevents
|
|
person-in-the-middle attacks and makes sure that you
|
|
are connected to the database that you intended to.
|
|
|
|
Teleport also allows you to edit your
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration)
|
|
to provide a custom CA certificate (`ca_cert_file`) or custom DNS name
|
|
(`server_name`), which is more secure.
|
|
|
|
If none of the above options work for you and you still want to disable the CA
|
|
check, you can use `mode` under the `tls` option in the Teleport configuration file.
|
|
|
|
For more details please refer to the reference
|
|
[configuration file](./reference/configuration.mdx#database-service-configuration).
|
|
|
|
## Can I disable read-only and custom endpoints from auto-discovered databases?
|
|
|
|
Yes, you can use the Teleport generated label `endpoint-type` on your `aws`
|
|
matcher to filter the endpoints. For example, to disable read-only and custom
|
|
endpoints for RDS auto-discovery, you can specify other endpoint types to
|
|
match:
|
|
```
|
|
aws:
|
|
- types: ["rds"]
|
|
regions: ["us-west-1"]
|
|
tags:
|
|
"env": "dev"
|
|
"endpoint-type":
|
|
- "primary"
|
|
- "instance"
|
|
```
|
|
|
|
See [labels reference](./reference/labels.mdx) for a full list of Teleport
|
|
generated labels and values.
|