Connect to a Database

You need to open a database session from your own machine — to inspect data, run
a query, or take a dump. Databases on the platform are not exposed to the
internet, so access is routed through Teleport, an audited tunnel that needs
no firewall change on your side.

This guide covers PostgreSQL and MySQL. The steps are the same for both engines.

Before you start

The Teleport CLI (tsh) installed locally. Install the version that matches
the Teleport cluster: open https://teleport.manage.cto2b.eu in a browser and
download the client version the login page reports, or run tsh version after
a first login and check it against the server version shown. A client that is
far behind the cluster will fail to connect.
A local database client such as psql, mysql, DBeaver, or TablePlus.
For a dump, the matching native tool (pg_dump or mysqldump) installed too.

If this is your first time using Teleport, raise a request for a setup link.

Step 1 — request database access

In SVIEW, go to Access requests.
Select the database and the role you need, for example read-only or write
access.
Submit the request.
Wait for approval from a teammate holding the Approver role, or from CTO2B
support.

The request status changes to Approved once it is granted.

Step 2 — log in to Teleport

tsh login --user [email protected] --proxy https://teleport.manage.cto2b.eu

You are prompted for your password and a second factor. After login, your
approved database access is listed in your session roles.

Step 3 — list the available databases

tsh db ls

The names match what you see in SVIEW.

Step 4 — connect

PostgreSQL:

tsh db connect <database-name> --db-user <your-db-user> --db-name <schema-name>

MySQL:

tsh db connect <database-name> --db-user <your-db-user>

To open a local port for a GUI client:

tsh db connect <database-name> --tunnel

Then point the GUI client at localhost on the port shown.

Step 5 — export a dump

For a dump, log in to the database rather than opening an interactive session.
This saves the certificates locally so native tools can use them:

tsh db login <database-name> --db-user <your-db-user> --db-name <schema-name>

Then ask Teleport for the exact connection string your native client needs:

tsh db config --format=cmd <database-name>

Run the printed command with the dump tool in place of the interactive client.

PostgreSQL:

pg_dump "<connection-string-from-tsh-db-config>" > dump.sql

MySQL:

mysqldump --defaults-extra-file=<(tsh db config --format=mysql <database-name>) <schema-name> > dump.sql

The dump is written to your local machine unless you redirect it elsewhere.
Treat it as production data and store it accordingly.

Step 6 — disconnect when done

Close the session, or run tsh logout.

Common issues

Issue	What to check
`tsh db ls` shows nothing	Is your access request approved? Check Access requests in SVIEW.
Connection refused or timeout	Is the database running? Check its Component status in SVIEW.
Authentication failed	Does `--db-user` match the role granted in the access request?
`tsh` not found	Install the Teleport client matching the cluster version, as described above.
`PAM Authentication Failure` in the application	See PostgreSQL Login Fails with PAM Authentication Failure.

If the issue persists, raise a request with the database name and the exact
error message.