> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup/connecting-target-systems/manage-databases.md).

# Manage databases

**Manage Databases** onboards databases reached through the SECUREpass proxy, so queries run under policy and are recorded.

![The Manage Databases page.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/05SVG2ZYYq0fPxSvp3aC/assets/image4e.png)

The page lists the databases already connected.

![The databases list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/LA4MKXE7ZmgSPWTfDsP2/assets/image3f.png)

**Import Database** brings databases in from an existing connection. Setting up those connections is covered in *Integrations*.

{% stepper %}
{% step %}

## System details

Click **Add Database**.

![The Add Database button.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Lsryd8Z5q1P7g2J0kpi7/assets/image40.png)

![Step 1 of the Add Database wizard.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/GYSAexs44Ty9QR8GvPyy/assets/image41.png)

| Field                     | Description                                                            |
| ------------------------- | ---------------------------------------------------------------------- |
| **System Name**           | Required. The name shown in the databases list                         |
| **IP Address / Hostname** | Required. Where the database is reached                                |
| **Type**                  | Fixed as **Database**                                                  |
| **Database Port**         | Required. Defaults to the engine's standard port — 5432 for PostgreSQL |
| **Status**                | **Active** or inactive                                                 |
| **SSH Tunnel Port**       | Optional. Leave blank for a direct connection                          |
| **Hostname / FQDN**       | Optional                                                               |
| **Description**           | Optional                                                               |
| {% endstep %}             |                                                                        |

{% step %}

## Database configuration and admin credentials

![The database configuration fields.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/7Chl8XXrjlh3vBnybpO5/assets/image42.png)

| Setting                          | What it does                                                                                                                                                                    |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Database Engine**              | Which database this is — PostgreSQL, MySQL, Oracle and so on. Required, and it sets the default port and command syntax, so pick it first                                       |
| **Default Database / Schema**    | Where a session lands on connect. Set it to save users a step; leave blank to use the server default                                                                            |
| **Query Timeout (seconds)**      | Kills any single query running longer than this. 30 is a sensible default; raise it if you legitimately run long reports                                                        |
| **Connection Timeout (seconds)** | How long to wait for the initial connection before giving up. 30 is fine; lower to 10–15 for faster failure on unreachable hosts                                                |
| **Max Result Rows**              | Caps rows returned by one query. `0` means no cap; something like 10000 prevents accidental full-table dumps                                                                    |
| **Enable SSL / TLS**             | Encrypts traffic between the proxy and the database. Turn on for anything crossing a network boundary or holding sensitive data                                                 |
| **Read-Only Mode**               | Forces all sessions to read-only. Turn on for reporting, audit or analyst access                                                                                                |
| **Additional JDBC Properties**   | Extra connection parameters appended to the JDBC URL as `key=value&key=value`. Leave blank unless you need something specific such as a character encoding or timezone override |

### Admin credentials

| Field              | Description                                                                                                                                                                           |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Admin Username** | Required. A privileged database account SECUREpass uses to discover accounts, rotate passwords and run connection tests. Use a dedicated service account rather than a person's login |
| **Admin Password** | Required. **Test Connection** will not run without it. **Show** reveals it temporarily so you can check for typos                                                                     |
| {% endstep %}      |                                                                                                                                                                                       |

{% step %}

## PAM security policy

![The PAM Security Policy section for a database.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/j7TmmRmjJjHcuCPNY6mN/assets/image4f.png)

| Setting                     | What it does                                                                                                                                                         |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Max Concurrent Sessions** | Caps how many people can be connected at once. Leave blank for unlimited                                                                                             |
| **Requires Dual Control**   | Requires a second approver before a session can start. Turn on for production or regulated databases                                                                 |
| **Emergency (Break-Glass)** | Marks this as an emergency-access system, bypassing normal approval. Keep off unless this is specifically your break-glass path — it weakens your controls by design |
| **Record Sessions**         | Records the full session for audit playback. Turn on for anything holding sensitive or regulated data                                                                |
| **Blocked SQL Commands**    | A JSON list of statements the proxy refuses to execute. Keep the destructive ones — `DROP`, `TRUNCATE`, `DELETE` without `WHERE` — blocked on production             |
| **Idle Timeout (minutes)**  | Disconnects a session after this many minutes of inactivity. `0` means never; 15–30 stops abandoned sessions sitting open                                            |

Click **Test Connection**.

![Testing the database connection.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/2unwnTI1TRXUSXz2rQ11/assets/image51.png)

A success message confirms the connection. Click **Next**.

![A successful database connection test.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/1DkDhdUMHVam0UPKIhF1/assets/image52.png)
{% endstep %}

{% step %}

## Steps 2 to 4

**Local Accounts** — click **Fetch Accounts** to discover the accounts on the database and add them.

**Assign Roles** — shows the database roles granted to each account. These are what authentication policies attach to in step 4.

![The Assign Roles step for a database.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Z7Pkw1bHLP6Tp4ddjgPj/assets/image53.png)

**Authentication** — set the authentication modes for the database.

![The Authentication step for a database.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/n49thoqP8wfXPrEdccpO/assets/image54.png)

Click **Add**. The database appears in the list.

![The new database in the list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/qQhwzIscdP9kRAXWM96I/assets/image55.png)
{% endstep %}
{% endstepper %}