MariaDB is a community-developed, MySQL-compatible database server. It’s the default “MySQL” on Debian and is used by WordPress, Nextcloud and countless web apps. This guide installs it on the most common server distributions and sets it up securely.

1. Install

Ubuntu and Debian

apt update
apt install -y mariadb-server
systemctl enable --now mariadb

AlmaLinux and Rocky Linux

dnf install -y mariadb-server
systemctl enable --now mariadb

Check that it’s running:

systemctl status mariadb
mariadb --version

Distribution packages are well tested and receive security updates automatically. If you need a newer major version, MariaDB provides official repositories for each distribution — use their repository setup script, then install the same way.

2. Secure the installation

mariadb-secure-installation

Recommended answers: keep unix_socket authentication for root (root logs in only from the system’s root account), remove anonymous users, disallow remote root login, remove the test database, and reload privileges.

Now sudo mariadb opens the client as the database root user — no password needed, but only for the system root.

3. Create a database and user

Never let applications use the root account:

CREATE DATABASE appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'use-a-long-random-password';
GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;

utf8mb4 supports all Unicode characters, including emoji. Test the login: mariadb -u appuser -p appdb.

4. Remote access (only if you need it)

By default MariaDB listens only on 127.0.0.1. If an application on another server must connect:

  1. Bind to the private or public interface in /etc/mysql/mariadb.conf.d/50-server.cnf (Debian/Ubuntu) or /etc/my.cnf.d/mariadb-server.cnf (RHEL family):

    bind-address = 0.0.0.0

  2. Create a user limited to the app server’s IP:

    CREATE USER 'appuser'@'198.51.100.10' IDENTIFIED BY '…';
GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'198.51.100.10';

  3. Allow port 3306 only from that IP in the firewall:

    ufw allow from 198.51.100.10 to any port 3306 proto tcp

Never open 3306 to the whole internet. For connections over untrusted networks, use TLS or an SSH/WireGuard tunnel — see encrypting VPS traffic.

5. Basic tuning

Create /etc/mysql/mariadb.conf.d/60-tuning.cnf (or /etc/my.cnf.d/tuning.cnf):

[mysqld]
innodb_buffer_pool_size = 1G      # ~25–50% of RAM on a shared web+db server
max_connections = 150
slow_query_log = 1
long_query_time = 1

Restart: systemctl restart mariadb. The buffer pool is the most important setting — it keeps tables and indexes in memory.

6. Back up

mariadb-dump --single-transaction --routines --events appdb | gzip > appdb-$(date +%F).sql.gz

Restore:

gunzip < appdb-2026-11-04.sql.gz | mariadb appdb

Automate dumps and copy them off the server — see Debian backup and disaster recovery.

Troubleshooting

  • Access denied for user 'root'@'localhost' — use sudo mariadb; root uses socket authentication.
  • Can’t connect remotely — check bind-address, the user’s host part, and the firewall.
  • Service won’t start — journalctl -u mariadb -n 50; often a typo in a config file or a full disk.

Next: install the rest of a web stack with our LAMP guide or PHP and MySQL guide. Prefer PostgreSQL? See deploying PostgreSQL on a VPS.

  • MariaDB
  • Database
  • Linux