All Products
Search

This Product

    Bastionhost:Perform O&M operations on databases

    Document Center

    Bastionhost:Perform O&M operations on databases

    Last Updated:Mar 31, 2026

    Bastionhost routes database connections through an SSH tunnel, capturing all sessions for audit. This topic shows how to connect to a database from a macOS client using DBeaver or the command-line interface (CLI).

    Supported databases:

    CategoryDatabase engines
    ApsaraDB RDSMySQL, SQL Server, PostgreSQL
    PolarDBMySQL, PostgreSQL, PostgreSQL (Compatible with Oracle)
    Self-managedMySQL, SQL Server, PostgreSQL, Oracle

    Prerequisites

    Before you begin, make sure you have:

    • A database O&M tool that supports SSH tunnels — for example, DBeaver, DbVisualizer, Navicat Premium, or Navicat for MySQL

    • The O&M address of your bastion host, available in the Bastion Host Information section on the Overview page of the Bastionhost console. For details, see Log on to the console of a bastion host.

      Overview page showing O&M address location

    Use the O&M address rather than a raw IP address. Bastionhost supports both fixed and dynamic O&M IP addresses; raw IP addresses can change and cause connection failures.

    Get an O&M token

    An O&M token authenticates your database session through the SSH tunnel. Get one before connecting.

    For instructions, see Obtain an O&M token.

    If the database account is not hosted on Bastionhost, configure the account details in the O&M Token dialog box before obtaining the token. For details, see Use the database management feature.

    Token rules:

    RuleDetails
    Validity periodTokens are valid only within the period set by the Bastionhost administrator. If O&M review is enabled, the period approved by the administrator applies.
    RenewalIf the administrator allows renewals, renew before the token expires. After expiry, apply for a new token. Renewal is not allowed when O&M review is enabled. After the settings of O&M tokens are modified, you must apply for a new O&M token or update the existing O&M token for the change to take effect.
    Audit recordsAudit records identify the user who obtained the token, not the username or asset account specified in the client.

    Connect using DBeaver

    1. Log on to the Bastionhost console or O&M portal and get an O&M token.

    2. Open DBeaver and create a new database connection.

    3. On the General tab, enter the database connection details and click Next.

      ParameterDescription
      HostThe address of the database asset
      PortThe port of the target database
      User NameThe username for the database
      PasswordSee the password rules by database type below

      Password field by database type:

      Database typePassword value
      MySQL, SQL Server, or PostgreSQL (account hosted on Bastionhost)Leave blank
      MySQL, SQL Server, or PostgreSQL (account not hosted on Bastionhost)Enter the database password
      Oracle (account hosted on Bastionhost)Enter 123456 and specify the logon attribute as instructed by the O&M token
      Oracle (account not hosted on Bastionhost)Enter the actual database password and specify the logon attribute as instructed by the O&M token

    4. On the SSH tab, configure the SSH tunnel and click Finish.

      ParameterDescription
      Use SSH TunnelSelect Use SSH Tunnel
      Host/IPThe public O&M address of your bastion host
      PortThe O&M port for SSH tunnels (default: 60022)
      User NameThe username for your bastion host
      PasswordThe O&M token you obtained

    5. In DBeaver, double-click the new connection to log on to the database and start your O&M session.

    Connect using the CLI

    The CLI method is not supported for Oracle databases.

    This example uses MySQL.

    1. Log on to the O&M portal. For details, see Log on to the O&M portal.

    2. In the left-side navigation pane, click Databases.

    3. On the Databases page, find the target database and click O&M Token in the O&M Token column.

    4. In the O&M Token dialog box, select a database account and click Obtain O&M Token.

      If the database account is not hosted on Bastionhost, configure the account details in this dialog box first. See Use the database management feature.

    5. Open a terminal and run the following command to create the SSH tunnel:

      ParameterDescription
      localportA local port that is not currently in use
      databaseAddressThe address of the target database
      databasePortThe port of the target database
      bastionusernameYour bastion host username
      bastionAddressThe public O&M address of your bastion host
      bastionPortThe O&M port for SSH (default: 60022)
      ssh -N -L <localport>:<databaseAddress>:<databasePort> <bastionusername>@<bastionAddress> -p <bastionPort>

    6. When prompted for a password, enter the O&M token and press Enter.

      Password authentication step in CLI

    7. Open a new terminal window and verify the tunnel is active. The listening port should show LISTEN status.

      Port LISTEN status in CLI

    8. Connect to the MySQL database through the tunnel:

      ParameterDescription
      accountnameThe username of the MySQL database
      localportThe local port you specified in step 5
      mysql -h 127.0.0.1 -u <accountname> -P <localport>

      After connecting, run SQL commands to perform your O&M operations.

      Running O&M commands in MySQL CLI

    Troubleshooting

    The O&M token is valid but the connection fails.

    CauseResolution
    The concurrent O&M connection limit has been reachedContact the Bastionhost administrator to upgrade your bastion host or release idle connections
    Requests are blocked by an IP address or time-based restrictionContact the Bastionhost administrator to remove the restriction

    What's next