Bastionhost:Database O&M

1. Log on to the Bastionhost console or O&M portal and obtain an O&M token. For more information, see Obtain an O&M token.

   Note

   • When you obtain an O&M token from the O&M portal, if the current database account is not managed by Bastionhost, you must first configure the basic information of the database account in the O&M Token dialog box. For more information about how to create a database account, see Database management.

   • O&M tokens must be used within their validity periods. An administrator can set the validity period in the Bastionhost console. If O&M approval is enabled, the validity period that is set by the administrator during the approval process is used.

   • If an administrator allows O&M users to renew their own tokens, the users can renew the tokens before they expire. After a token expires, the user must request a new one. If O&M approval is enabled, users cannot renew tokens. After token settings are changed, you must request a new token or update the existing one for the new settings to take effect.

   • If a token is valid but the O&M connection fails, the number of concurrent O&M connections may have reached the upper limit. In this case, contact an administrator to upgrade the instance type of your Bastionhost instance or release idle connections. Another possible reason is that an administrator has blocked O&M requests from your source IP address or during the current time period. In this case, contact the administrator to remove the restrictions.

   • The audit logs record the user who requested the token, not the username or asset account that is entered on the client.

2. Open DBeaver and create a new connection to the target database.

   1. On the General tab, configure the database asset information as described in the following table, and then click Next.

      Parameter	Description
      Host	The address of the database asset.
      Port	The port of the database asset.
      User Name	The username for the database asset.
      Password	For MySQL, SQL Server, and PostgreSQL databases: If the password for the database account is hosted on Bastionhost, leave this field blank. If the password is not hosted, enter the database account's password. For Oracle databases: If the password for the database account is hosted on Bastionhost, enter 123456 and select the logon properties as indicated when you obtain the O&M token. If the password is not hosted, enter the actual logon password for the database account and select the logon properties as indicated when you obtain the O&M token.

   2. On the SSH tab, configure the SSH tunnel information, and then click Finish.

      Parameter	Description
      Use SSH Tunnel	Select the Use SSH Tunnel checkbox.
      Host/IP	The O&M address of the Bastionhost instance.
      Port	The SSH O&M port for Bastionhost. The default is 60022.
      User Name	The username for logging on to Bastionhost.
      Password	Enter the O&M token that you obtained.

3. In DBeaver, double-click the new database connection to log on to the database asset and perform O&M tasks.

Connect via SSH tunnel with the CLI

1. Log on to the O&M portal. For more information, see Log on to the O&M portal.

2. In the navigation pane on the left, click Databases.

3. On the Databases page, find the target database and click the corresponding O&M token in the O&M Token column.

4. In the O&M Token dialog box, select a database account and click Obtain O&M Token.

   Note

   • When you obtain an O&M token from the O&M portal, if the current database account is not managed by Bastionhost, you must first configure the basic information of the database account in the O&M Token dialog box. For more information about how to create a database account, see Database management.

   • O&M tokens must be used within their validity periods. An administrator can set the validity period in the Bastionhost console. If O&M approval is enabled, the validity period that is set by the administrator during the approval process is used.

   • If an administrator allows O&M users to renew their own tokens, the users can renew the tokens before they expire. After a token expires, the user must request a new one. If O&M approval is enabled, users cannot renew tokens. After token settings are changed, you must request a new token or update the existing one for the new settings to take effect.

   • If a token is valid but the O&M connection fails, the number of concurrent O&M connections may have reached the upper limit. In this case, contact an administrator to upgrade the instance type of your Bastionhost instance or release idle connections. Another possible reason is that an administrator has blocked O&M requests from your source IP address or during the current time period. In this case, contact the administrator to remove the restrictions.

   • The audit logs record the user who requested the token, not the username or asset account that is entered on the client.

5. Open a CLI tool and run the following command.

   ssh -N -L <localport>:<databaseAddress>:<databasePort>
   <bastionusername>@<bastionAddress> -p <bastionPort>

   Parameter description

   Parameter	Description
   localport	A local listening port for the tunnel. Ensure this port is not already in use on your local machine.
   databaseAddress	The address of the database asset.
   databasePort	The port of the database asset.
   bastionusername	The username for your Bastionhost instance.
   bastionAddress	The O&M address of your Bastionhost instance.
   bastionPort	The SSH O&M port for Bastionhost. The default is 60022.

6. When prompted for the password, enter the O&M token and press Enter.

   [root@10.xxx.x2 ~]# ssh -N -L 33061:rm-uxxx xxxncs.com:3306 tesxxx xxxncs.com -p 60022
   The authenticity of host '[ucyqraxxx xxxncs.com]:60022 ([10xxx.126]:60022)' can't be established.
   RSA key fingerprint is SHA256:ji2v1Txxx xLKU.
   RSA key fingerprint is MD5:61:0exxx 9e:01.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added '[ucyqrxxx xxxncs.com]:60022,[101.xxx.126]:60022' (RSA) to the list of known hosts.
   test@ucycxxx xxxncs.com's password:

7. Open another terminal window and verify that the custom local port is listening. In the output, LISTEN indicates that the port is listening.

   [root@1xxx2 ~]# ss -an | grep 33061
   tcp    LISTEN    0      128    127.0.0.1:33061                              *:*
   tcp    LISTEN    0      128    ::1:33061                                    :::*
   [root@1xxx2 ~]#

8. Run the following command to connect to the MySQL database.

   mysql -h 127.0.0.1 -u <accountname> -P <localport>

   • <accountname> is a required parameter. accountname represents the database username.

   • <localport> is a required parameter. localport represents the local listening port that you specified in Step 5.

   You can now run O&M commands.

   [root@10.xxx~]# mysql -h 127.0.0.1 -u a***t -P 33061
   Welcome to the MariaDB monitor.  Commands end with ; or \g.
   Your MySQL connection id is 4041
   Server version: 8.0.13 Source distribution
   Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
   Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
   MySQL [(none)]>