Access a MySQL database

Use Border0 + Tailscale to provide fine-grained privileged access controls, credential management, and auditing for database sessions in your Tailscale network (known as a tailnet). This guide uses a MySQL Docker container as the database server.

Prerequisites

Before you begin, confirm you have the following:

• A connector.
• A device on your network that can run Docker.

Run a local MySQL server with Docker

1. At a command line on your tailnet device that will host the database, run

   docker run --name <your-database-name> \
     --rm -e MYSQL_ROOT_PASSWORD=<your-database-password> \
     -d -p 3306:3306 mysql
   

   Replace <your-database-name> and <your-database-password> with the database name and password that you want to use for the database.

   The preceding command will start a local MySQL server listening on port 3306, with<your-database-password> as root password.

2. Before proceeding to configure Border0 + Tailscale, verify your database is working locally as user root and password <your-database-password>.

   mysql -u root -p<your-database-password> \
     -h localhost --protocol TCP
   

3. If your database is working correctly, you command line shows a mysql> prompt. At the mysql> prompt, run a command to verify your database is working locally.

   SHOW VARIABLES LIKE 'version';
   

   If the command shows output similar to the following, your database is working locally.

   +---------------+--------+
   | Variable_name | Value  |
   +---------------+--------+
   | version       | 8.0.30 |
   +---------------+--------+
   1 row in set (0.00 sec)
   

Create a database socket

Create a database socket and link it to your connector.

1. In the Border0 admin portal, open the Sockets page.
2. Select Add New Socket.
3. Select Database.
4. In the list of database types, find the MySQL option and select Create.
5. Select I will use my own MySQL server.
6. In the Socket Information section:
   1. Provide a name for your socket. A socket name can have alphanumeric characters and hyphens, but it must start or end with an alphanumeric character.
   2. (Optional) Select Add display name and provide a display name for the socket.
   3. (Optional) Provide a description for the socket.
7. Choose whether the Session Recording option is enabled or disabled.
8. In the Upstream Configuration section:
   1. For Service Type, select Standard.
   2. For Protocol, select MySQL.
   3. For Hostname, use localhost. Adjust as needed for your database.
   4. For Protocol, use 3306. Adjust as needed for your database.
   5. For Authentication Type, select Username and Password.
   6. (Optional) Select Set database name and provide a name for the database.
   7. For Upstream Username, use root as the username, because the MySQL username defaults to root if not specified. Adjust as needed for your database.
   8. For Upstream Password, use the password that you used when you created the database.
9. In the Connectors section, select the connector that you want to use for this socket.
10. (Optional) In the Tags section, select Add tag to add any tags that you want to use for the socket.
11. Select Create New Socket.

Your database socket should be created. You can access it in the Sockets page.

Connect to your database

To access the database from the Border0 web client:

1. Open the Sockets page.
2. Select the database that you created.
3. Select Connect.
4. Follow the prompts to authenticate.
5. Successful authentication takes you to the client portal, where you have a web-based database session where you can run a SQL query like SHOW DATABASES;.

Secure your credentials

In this guide, the credentials used for the upstream database are statically defined in the connector configuration. Credentials are essential for the connector to establish a secure connection. While Border0 stores these credentials in encrypted form, we strongly recommend that you keep the credentials local to the connector, instead of statically defining them. Specifically, for enhanced security and to keep your credentials local, you should integrate your connector with a secret management solution. For more information, refer to Manage secrets and credentials.

By default, the Border0 proxy attempts to establish a secure database connection using Transport Layer Security (TLS). If a database server does not support TLS, it will fall back to a non-TLS connection.

Review session details and recordings

To review details like the identity, originating IP address, device, connection time, and a log of executed SQL queries, open the Sessions page and selection a session. For more information, refer to Session logs.

Troubleshooting

If you experience issues with your new database socket, it's typically because it can't connect to the upstream database. For recommended actions, refer to Troubleshooting Border0 connectors.