mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Paul Gottschling
cc89378c3d
We are standardizing docs guides to add a page_type frontmatter field, with values for how-to guides, references, etc. We can then use this field to apply linting rules that ensure each guide type follows type-specific docs site conventions. The first convention is that each docs page must have an outcome statement, the structure of which depends on the guide's type. Human and AI agent readers can determine from the outcome statement whether to continue reading the guide or not. This change assigns the `page_type` frontmatter field to 55 guides. Where an outcome statement is missing, it adds one. Where an outcome statement exists, it ensures that the statement matches the standard structure so we can add a linter later on. (A majority of guides were already compliant.)
153 lines
5.0 KiB
Plaintext
153 lines
5.0 KiB
Plaintext
---
|
|
title: Database Access FAQ
|
|
sidebar_label: FAQ
|
|
description: Frequently asked questions about Teleport database access.
|
|
tags:
|
|
- faq
|
|
- zero-trust
|
|
- infrastructure-identity
|
|
page_type: faq
|
|
---
|
|
|
|
This page provides answers to frequently asked questions about enrolling
|
|
databases with Teleport. For a list of frequently asked questions about Teleport
|
|
in general, see [Frequently Asked Questions](../../faq.mdx).
|
|
|
|
## Which database protocols does Teleport the Database Service support?
|
|
|
|
The Teleport Database Service currently supports the following protocols:
|
|
|
|
- Cassandra
|
|
- ClickHouse
|
|
- CockroachDB
|
|
- DynamoDB
|
|
- MariaDB
|
|
- Microsoft SQL Server
|
|
- MongoDB
|
|
- MySQL
|
|
- Oracle
|
|
- OpenSearch
|
|
- PostgreSQL
|
|
- Redis and Valkey
|
|
- Snowflake
|
|
|
|
For PostgreSQL, Oracle and MySQL, the following Cloud-hosted versions are supported in addition to self-hosted deployments:
|
|
|
|
- Amazon RDS
|
|
- Amazon Aurora (except for Amazon Aurora Serverless, which doesn't support IAM authentication)
|
|
- Amazon Redshift
|
|
- Google Cloud SQL
|
|
- Azure Database
|
|
- Oracle Exadata
|
|
|
|
See the available [guides](guides/guides.mdx) for all supported configurations.
|
|
|
|
## Which PostgreSQL protocol features are not supported?
|
|
|
|
The following PostgreSQL protocol features aren't currently supported:
|
|
|
|
- Any [authentication methods](https://www.postgresql.org/docs/current/auth-methods.html)
|
|
except for client certificate authentication and IAM authentication for cloud
|
|
databases.
|
|
|
|
|
|
## Are database sessions listed under recorded sessions?
|
|
|
|
(!docs/pages/includes/database-access/db-audit-events.mdx!)
|
|
|
|
## Can database clients use a public address different from the web public address?
|
|
|
|
<Tabs>
|
|
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
|
|
|
|
When configuring the Teleport Proxy Service, administrators can set the
|
|
`postgres_public_addr` and `mysql_public_addr` configuration fields to public
|
|
addresses over which respective database clients should connect. See
|
|
[Proxy Configuration](../../reference/deployment/config.mdx#proxy-service) for
|
|
more details.
|
|
|
|
This is useful when the Teleport Web UI is running behind an L7 load balancer
|
|
(e.g. ALB in AWS), in which case the PostgreSQL/MySQL proxy needs to be exposed
|
|
on a plain TCP load balancer (e.g. NLB in AWS).
|
|
|
|
Using [TLS routing](../../reference/architecture/tls-routing.mdx) for the Teleport Proxy Service allows for all
|
|
database connections with the web public address.
|
|
|
|
</TabItem>
|
|
<TabItem scope={["cloud","team"]} label="Cloud-Hosted">
|
|
|
|
In Teleport Enterprise (Cloud), database connections use the web public address
|
|
since [TLS routing](../../reference/architecture/tls-routing.mdx) is applied.
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Do you support X database client?
|
|
|
|
Teleport relies on client certificates for authentication, so any database
|
|
client that supports this method of authentication and uses modern TLS (1.2+)
|
|
should work.
|
|
|
|
Standard command-line clients such as `psql`, `mysql`, `mongo` or `mongosh` are
|
|
supported. There are also instructions for configuring select
|
|
[graphical clients](../../connect-your-client/third-party/gui-clients.mdx).
|
|
|
|
## When will you support X database?
|
|
|
|
We plan to support more databases in the future based on customer demand.
|
|
|
|
See if the database you're interested in has already been requested among
|
|
[GitHub issues](https://github.com/gravitational/teleport/labels/database-access)
|
|
or open a [new issue](https://github.com/gravitational/teleport/issues/new/choose)
|
|
to register your interest.
|
|
|
|
## Can I provide a custom CA certificate?
|
|
|
|
Yes, you can pass custom CA certificate by using a
|
|
[configuration file](../../reference/deployment/config.mdx)
|
|
(look at `ca_cert_file`).
|
|
|
|
## Can I provide a custom DNS name for Teleport generated CA?
|
|
|
|
Yes, use `server_name` under the `tls` section in your Teleport configuration
|
|
file. Please see our reference
|
|
[configuration file](../../reference/deployment/config.mdx)
|
|
for more details.
|
|
|
|
## Can I disable CA verification when connecting to a database?
|
|
|
|
Yes, although it is not recommended. Certificate verification prevents
|
|
person-in-the-middle attacks and makes sure that you
|
|
are connected to the database that you intended to.
|
|
|
|
Teleport also allows you to edit your
|
|
[configuration file](../../reference/deployment/config.mdx)
|
|
to provide a custom CA certificate (`ca_cert_file`) or custom DNS name
|
|
(`server_name`), which is more secure.
|
|
|
|
If none of the above options work for you and you still want to disable the CA
|
|
check, you can use `mode` under the `tls` option in the Teleport configuration file.
|
|
|
|
For more details please refer to the reference
|
|
[configuration file](../../reference/deployment/config.mdx).
|
|
|
|
## Can I disable read-only and custom endpoints from auto-discovered databases?
|
|
|
|
Yes, you can use the Teleport generated label `endpoint-type` on your `aws`
|
|
matcher to filter the endpoints. For example, to disable read-only and custom
|
|
endpoints for RDS auto-discovery, you can specify other endpoint types to
|
|
match:
|
|
```
|
|
aws:
|
|
- types: ["rds"]
|
|
regions: ["us-west-1"]
|
|
tags:
|
|
"env": "dev"
|
|
"endpoint-type":
|
|
- "primary"
|
|
- "instance"
|
|
```
|
|
|
|
See [labels reference](reference/labels.mdx) for a full list of Teleport
|
|
generated labels and values.
|