Supported Databases
DBBat ships with four independent listeners — one per wire protocol family. Enable only the engines you need by setting the matching DBBLISTEN* variable; an empty value disables that proxy.
Access Control
DBBat provides fine-grained access control through grants. A grant gives a user permission to access a specific database for a limited time, optionally with one or more controls and quotas.
Grant Requests & Auto-Approval
Grants can be created directly by an admin, but that puts an admin in the loop for every access. The request workflow lets users ask for access themselves, against templates an admin has pre-approved — and, when the shape of access is routine enough, skip the approval step entirely.
Query Logging
DBBat logs every query or command executed through the proxy — across all supported engines (PostgreSQL, Oracle, MySQL, MariaDB, MongoDB) — providing complete visibility into database activity.
User Management
DBBat maintains its own user database, separate from target database users. This separation provides:
Session Packet Dumps
DBBat can write per-session binary dumps of every proxied connection. The dump captures the post-auth byte stream between client and upstream, which is invaluable for protocol-level debugging, replay testing, and forensic analysis.
SSH Tunnels
Not every database is reachable from wherever DBBat runs. Production databases commonly sit in a private subnet with no route from outside the VPC, fronted by a bastion host.