> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/kcm-linux-rpm-method/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/kcm-linux-rpm-method/authentication/using-keeper-connection-manager-with-a-mysql-database.md).

# Using KCM with a MySQL Database

{% hint style="success" %}
**This documentation assumes that you already have access to a MySQL server** or hosted MySQL database, and that Guacamole has already been installed using Keeper Connection Manager. If you do not already a MySQL server ready, please [set up a MySQL or MariaDB instance ](/kcm-linux-rpm-method/authentication/using-keeper-connection-manager-with-a-mysql-database/installing-mariadb-for-guacamole-authentication.md)before proceeding. If you do not already have Guacamole installed, please see the [installation instructions](/kcm-linux-rpm-method/installation.md).
{% endhint %}

## Creating and initializing the Guacamole database <a href="#id-.usingguacamolewithamysqldatabasev2.x-creatingandinitializingtheguacamoledatabase" id="id-.usingguacamolewithamysqldatabasev2.x-creatingandinitializingtheguacamoledatabase"></a>

If you haven’t already done so, a database specific to Guacamole needs to be created within MySQL. The database can be called anything you like; all that matters is that the database be dedicated to Guacamole, and not shared by different applications. Get to the MySQL prompt with the command:

```bash
sudo mysql -u root
```

Next, create the database:

```sql
CREATE DATABASE guacamole_db;
```

Then exit MySQL with the "exit" command.

Guacamole will not automatically initialize the database with the required schema. You will need to do this yourself using the SQL scripts provided with the kcm-guacamole-auth-jdbc-mysql package, which are located within the `/opt/keeper/share/guacamole-auth-jdbc-mysql/schema` directory:

| Filename                    | Description                                                                                                                                                                    |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `001-create-schema.sql`     | Creates all tables and indexes which are required for the MySQL authentication extension to function.                                                                          |
| `002-create-admin-user.sql` | Creates a default administrative user, “guacadmin”, with password “guacadmin”. These credentials will need to be changed once MySQL authentication is confirmed to be working. |

The above scripts must be run in sequence, as it is the first script which actually creates the database schema. The second script, which defines a default administrative user, can only successfully run if the tables created by the first script exist. The simplest way to run both scripts in sequence is to concatenate them:

```
cat /opt/keeper/share/guacamole-auth-jdbc-mysql/schema/*.sql | mysql -u root -p guacamole_db
```

Alternatively, the scripts can be run individually, as long as the order is correct:

```markdown
mysql -u root guacamole_db < /opt/keeper/share/guacamole-auth-jdbc-mysql/schema/001-create-schema.sqlmysql -u root guacamole_db < /opt/keeper/share/guacamole-auth-jdbc-mysql/schema/002-create-admin-user.sql
```

## Connecting Guacamole to MySQL <a href="#id-.usingguacamolewithamysqldatabasev2.x-connectingguacamoletomysql" id="id-.usingguacamolewithamysqldatabasev2.x-connectingguacamoletomysql"></a>

To execute queries against the database, Guacamole will need its own database user with sufficient privileges. Because Guacamole does not automatically apply or update its own schema, the required privileges are minimal, dealing only with creation and maintenance of data within already-defined tables and indexes:

```sql
CREATE USER 'guacamole_user' IDENTIFIED BY 'some_password';
GRANT SELECT,INSERT,UPDATE,DELETE ON guacamole_db.* TO 'guacamole_user';
FLUSH PRIVILEGES;
```

### Advanced Linux Install Method

Keeper Connection Manager packages Guacamole’s MySQL support within the kcm-guacamole-auth-jdbc-mysql package. **This package must be installed before creating Guacamole’s database within MySQL**, as it includes the SQL scripts necessary for doing so:

```shell
sudo yum install kcm-guacamole-auth-jdbc-mysql
```

Guacamole's main configuration file, `/etc/guacamole/guacamole.properties`, must now be modified to specify the credntials of the MySQL user and to point the MySQL database:

```shell
sudo vi /etc/guacamole/guacamole.properties
```

The `guacamole.properties` file provided with Keeper Connection Manager is organized into sections documented with blocks of comments and example properties. The first section which must be modified is marked "JDBC-1" and defines the TCP connection information for the database in use. Uncomment the mysql-hostname and mysql-port properties, modifying their values to point to your MySQL server:

```markdown
##
## [JDBC-1] Database TCP connection information
##
## The TCP connection details for the PostgreSQL, MySQL / MariaDB, or SQL
## Server database.
##

mysql-hostname: localhost
mysql-port:     3306
```

The "JDBC-2" section, which defines the database name and associated credentials, must also be modified to specify the correct database name, username, and password. These values are given with the mysql-database, mysql-username, and mysql-password properties respectively:

```markdown
##
## [JDBC-2] Database name and credentials
##
## The name of the database to use, as well as the credentials to use when
## connecting to the database. THESE PROPERTIES ARE REQUIRED if one of the
## database authentication extensions will be used.
##

mysql-database: guacamole_db
mysql-username: guacamole_user
mysql-password: some_password
```

Guacamole will generally only load new extensions and reread `guacamole.properties` during the startup process. To apply the configuration changes, Guacamole must be restarted:

```bash
$ sudo systemctl restart guacamole
```

{% hint style="info" %}
**If you do not have a standalone "guacamole" service**

You will not have a standalone "guacamole" service if you have not deployed Guacamole automatically with the "kcm-guacamole-standalone" package. This will be the case if:

* You have chosen to manually deploy Guacamole under your own install of Apache Tomcat or JBoss, rather than use the provided version of Tomcat.
* You are maintaining a deployment of Glyptodon Enterprise that was originally installed before[ the 2.5 release](https://newdocs.keeper.io/kcm-linux-rpm-method/authentication/pages/ZqnMdyCaG68yVINbbLIh#id-.changelogv2.x-2.52.5version2.5) (2021-09-16).

You will instead need to manually restart your install of Tomcat:

```
$ sudo systemctl restart tomcat
```

If you are using SELinux (the default on both CentOS and RHEL), you must also configure SELinux to allow Tomcat to connect to the database over the network:

```
$ sudo setsebool -P tomcat_can_network_connect_db 1
```

If Guacamole is not accessible after the Tomcat service has been restarted, verify that you have indeed configured SELinux to allow Tomcat to connect to the database and check the SELinux audit logs (`/var/log/audit/audit.log`) for [AVC denials](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/chap-security-enhanced_linux-troubleshooting).

Updating SELinux is not necessary if using the version of Tomcat bundled with the kcm-guacamole-standalone package.
{% endhint %}

To make sure everything is working as expected, you should also visit your Guacamole instance with a web browser (most likely at [`http://HOSTNAME:8080/guacamole/`](http://hostname:8080/guacamole/), where “HOSTNAME” is the hostname or IP address of your server). If all is working correctly, you should see a login screen with a username/password prompt, and you will be able to log in using the default account created with the `002-create-admin-user.sql` script:

| Username: | guacadmin |
| --------- | --------- |
| Password: | guacadmin |

{% hint style="danger" %}
Once you have verified that you can log in successfully, **you should immediately change the password**. While logged into Keeper Connection Manager, you can access the built-in password changing interface by clicking on your username in the upper-right corner of the screen and selecting “Settings”.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/kcm-linux-rpm-method/authentication/using-keeper-connection-manager-with-a-mysql-database.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.