Database MFA · PostgreSQL · MySQL

Add MFA to every database connection.

A stolen database password is all it takes. AuthNull puts a push in front of every PostgreSQL and MySQL connection — without changing the database engine or the client tools.

Book a demo
Does
MFA on every database connection, before it opens
Replaces
Password-only database logins
Needs
The DB agent on each database host
Setup
Same day
Supported databases & hosts

MFA on the databases your team touches.

The DB agent sits on the database host and checks each connection before it reaches the engine — no schema changes, no stored procedures, no driver swaps.

  • 01PostgreSQL

    A push before every PostgreSQL connection opens — psql, pgAdmin, DBeaver or an app driver.

    port 5432

  • 02MySQL

    The same check on MySQL connections, on-prem or on a cloud-hosted VM you run.

    port 3306

  • 03Linux database hosts

    The DB agent runs on the Linux server next to the database. No changes to the engine, no stored-procedure hooks.

    Ubuntu · RHEL · Debian

  • 04Windows database hosts

    Install the DB agent on Windows Server hosts with a PowerShell script.

    Windows Server · PowerShell
How it works

DB agent on the host. Transparent to the engine.

The DB agent intercepts each connection before it reaches the database process, sends the user a push, and passes the connection through once it's approved.

Connection flow

Client (psql / mysql / app)
↓ TCP connection attempt
AuthNull DB agent
↓ push sent to the user
User approves
↓ connection passed through
Database (PostgreSQL / MySQL)
No changes to the database engine or schema.Works with the clients you use — psql, mysql, DBeaver, app drivers.The database never sees the MFA step.

DB agent install

# Linux
$ curl -O run_agent.sh
$ sudo ./run_agent.sh add
# Windows
PS> ./mysql-db-agent-install.ps1
Linux: one shell script, downloaded from your tenant.Windows: a PowerShell script, no domain admin rights needed.The key ties the DB agent to your tenant — outbound HTTPS only.The DB agent must reach AuthNull over HTTPS at connection time.
Verify · Supported methods

Works with your existing Duo or Okta — no rip and replace.

Database logins get a push from AuthNull Authenticator, or from the Duo or Okta Verify app your users already have.

  • AuthNull Authenticatorprimary
  • Duobring your own
  • Okta Verifybring your own
See MFA
Decide · Conditional access

Require MFA exactly where it matters.

Decide allow, push or deny by DB user, group, database, source IP and time of day — so a DBA connecting to production from home gets a push, while in-office read-only users connect as usual.

DB userGroupDatabaseSource IPTime of day
See conditional access
Policy · Privileged DB accessenabled
WHEN db_user in dba_admins
AND source outside corp network
AND database production_*
REQUIRE MFA push
ELSE allow
Control · Access and passwords

No standing DBA access. No shared database passwords.

MFA is the gate. Just-in-time access and the vault mean nobody keeps DBA rights or a database password between sessions.

Just-in-time DBA access

Grant DBA roles for a set window, approved with MFA. When it closes, the role goes.

Just-in-time access

Database passwords in the vault

Database passwords live in the vault and rotate on a schedule or after each use, so no person keeps one.

Credentials vault
Live the same day

Four steps from install to enforced.

About half an hour of hands-on work. Test with one account, then turn enforcement on.

  1. 01~ 10 min

    Install the DB agent

    Run the install script on the database host — a shell script on Linux, PowerShell on Windows.

  2. 02~ 5 min

    Connect your tenant

    The DB agent registers with your AuthNull tenant using a generated key and shows up in the console.

  3. 03~ 15 min

    Set your policy

    Choose which DB users get a push and which databases are in scope.

  4. same day

    Enforce and verify

    Turn enforcement on, connect with a test account and confirm the push in the AuthNull logs.

Helps you evidence
PCI DSS v4.0SOC 2 Type IIHIPAACMMC 2.0
FAQ

Database MFA, answered.

  • AuthNull installs the DB agent on the database host (Windows or Linux). It intercepts incoming connections before they reach the database process, sends the user a push, and passes the connection through once it's approved. The database engine and its schema stay as they are.

  • PostgreSQL (port 5432) and MySQL (port 3306), on Windows and Linux hosts. If you run another engine, ask us on a demo call.

  • A push from AuthNull Wallet, or from the Duo or Okta Verify app your users already have. FIDO2 keys and TOTP codes are for signing in to the AuthNull console.

  • Service accounts are excluded from MFA, so your applications keep connecting without a push. People connecting with their own DB user get the push.

  • Yes. Policy is scoped by DB user, group, database, source IP and time of day — for example, a push for DBA accounts connecting from outside the network, while in-office read-only users connect as usual.

  • On Linux you run a shell script (run_agent.sh) downloaded from your tenant; on Windows a PowerShell script does the install. Both register the DB agent with a key tied to your org, and it talks to AuthNull over outbound HTTPS only.

  • It isn't a secrets manager for application code, and it doesn't do Windows privilege elevation (PEDM), cloud entitlement management (CIEM) or identity threat detection (ITDR).

Book a demo

See it on your own PostgreSQL or MySQL host in a 20-minute walkthrough, and map a rollout with an engineer.

What happens next
  1. You send the formTwo minutes: who you are and what you want to protect.
  2. We reply within a dayAn engineer emails you to pick a time.
  3. A live 20-minute demoShown against your setup, with time for questions.
What do you want to protect?

By submitting you agree to our Terms and Privacy Policy.