Help Center/ Cloud Bastion Host/ FAQs/ User, Resource, and Policy Configuration in a CBH System/ Adding Resources to a CBH System/ How Can I Start Database Maintenance in a CBH System?
Updated on 2025-09-04 GMT+08:00
View PDF

How Can I Start Database Maintenance in a CBH System?

With CBH, you can manage databases in the host operations module or application operations module. The two modules can manage databases of different protocols. For details, see Which Types of Databases Can I Manage in a CBH System?. In the host operation module, you can audit database operations, such as adding, deleting, modifying, and querying database operations. In the application operation module, you can audit operation sessions through videos.

  • In CBH standard editions, directly managing databases is not available. To manage databases, an application publish server must be set up.
  • In CBH professional editions, directly managing databases is available in the host operation and application operation modules.

Prerequisites

  • You have purchased a CBH instance and the CBH system can be logged in. To manage databases by command, purchase a professional CBH instance. You can then manage databases by command in the host operation module.
  • The network connection between the databases and CBH instance is normal. The security group of the CBH instance allows inbound access through port 33306, and the database security group allows access from the IP address of the CBH instance.

Managing Databases in the Host O&M Module

The host O&M module makes it easy for you to maintain MySQL, SQL Server, Oracle, and DB2 databases by Single Sign-On (SSO) authentication.

  1. The administrator creates a host resource for databases.

    Choose Resource > Host, set Protocol Type to DB2, MySQL, SQL Server, or Oracle, and generate the corresponding database resource account.

  2. Assign access control permissions to users as an administrator.

    • Choose Policy > ACL Rules. Assign access permissions to users and associate the created database resource accounts.
    • Choose Policy > Database Control Rules. For MySQL and Oracle databases, you can configure key operation control rules to perform command interception. For details, see Database Control Rules.

  3. Log in to the database as an O&M user.

    Choose Operation > Host Operations and log in to the database as an authorized user. For details about the login mode, see Using an SSO Client to Log In to Database Resources for O&M.

    Operation users can run commands to add, delete, modify, and query database resources. They can also view the commands that are being executed on the Live Session page and view the historical command execution records on History Session page.

    When an operation user runs a key command, the dynamic authorization is triggered. The system automatically intercepts the command and generates a database approval ticket. To continue the O&M operation, the O&M user needs to submit an application to the administrator for approval.

    The host O&M module does not support the generation and download of historical database O&M session videos.

Managing Databases in the Application O&M Module

The application O&M module App Operation allows you to maintain all types of databases through web sessions and automatically inputs account usernames and passwords of databases. Before managing databases in this module, ensure that the network connection between the database to be managed and the application publishing server is normal and the network connection between the application publishing server and the CBH instance is normal.

  1. Create an application for databases to be managed as an administrator.

    Choose Resource > Application Publish, configure an application of database type, and add or let system generate a database account. For details about how to configure other parameters, see Adding an Application Server.

  2. Assign access control permissions to users as an administrator.

    Choose Policy > ACL Rules, grant the database access permissions to users, and relate the users to the account generated in the last step.

  3. Log in to the database as an O&M user.

    Choose Operation > App Operations and log in to the database as an authorized user. For details about session operations after login, see Application Operations.

    O&M users can record database O&M sessions by video and download session videos from the History Session module.

    The application O&M module does not support command interception during O&M sessions.