6.7.3 Configuring Credential Checkout for Other Databases

To enable credential checkout for databases, such as Microsoft SQL Server, MySQL, PostgreSQL, MariaDB, Sybase, and IBM Db2 perform the following:

In the agent that has the dbaudit module, perform the following:
1. Install the ODBC (Open Database Connectivity) package that is unixODBC rpm package which is part of the OS distribution.
2. Create the Symbolic links for ODBC Libraries in /lib64 or in /usr/lib64 as explained below:
  1. Create a link libodbc.so for libodbc.so.x.x.x
  2. Create a link libodbcinst.so for libodbcinst.so.x.x.x
3. Install the supporting ODBC driver of the respective database. This ODBC driver is available as part of the database provider’s server distribution.
  
  For Microsoft SQL Server, choose the drivers as follows:
  1. Microsoft SQL Driver is supported only on Linux 64-bit.
  2. Free TDS Driver is supported on Linux 32 bit and 64-bit.
4. Configure the database driver in ODBC by using odbcinst.ini file.
5. Configure Data Source Name (DSN) of the database in the odbc.ini file.
  
  For more information about how to configuring odbcinst.ini and odbc.ini files, see the Knowledge Base Article.
  
  NOTE:To enable password change for a Linux IBM Db2 database, refer to the IBM Db2 documentation. For more information on setting up ODBC application connectivity on Linux using the IBM Data Server Driver, refer to the IBM Support pages.
In the Privileged Account Manager administration console:
1. Set the ODBC library path:
  1. On the home page of the Privileged Account Manager administration console, click Hosts.
    
    On the middle pane, select the Privileged Account Manager host.
    
    On the right pane, click Packages.
  2. Select the dbaudit package.
  3. On the left pane, click Settings.
  4. In the ODBC Library Path field, specify the path where the symbolic links are created.
  You can use the appropriate policy template to automatically create a resource and rule for databases. This resource and rule can be customized as required. To create the resource and rule manually, continue with the following steps.
2. Add the database server details as a resource and add the privileged account of the database server. To add database resource and its credentials, click Credential Vault > Database > Database Type and click + next to the Resources. For more information about the resource configuration fields, see the contextual help.
3. Create a database rule:
  1. On the home page of the console, click Command Control.
  2. In the Command control pane, click Rules.
  3. In the details pane, click Add.
  4. Specify a name for the database rule, then click Add.
  5. To configure the rule, select the rule, click edit icon in the details pane and
    
    configure the following:
    
    Run User: Select Everyone from the drop-down list.
    
    Run Host: Specify the name of the Database resource created above.
    
    Authorize: Select Yes, then select Stop from the drop-down list.
  6. Click Modify. The settings you have defined for the rule are displayed in the console.
4. To add database password check out command to the rule, perform the following:
  1. In the middle pane, click the Commands icon.
  2. From the drop-down list of commands, drag the appropriate database command and drop it to the database rule.