Secure your MariaDB installation

A fresh MariaDB install is convenient but not locked down: it can include anonymous accounts and a test database. The mysql_secure_installation script removes those defaults. This guide walks through each prompt and explains what it does.

Before you begin

• MariaDB installed on Ubuntu 24.04 (sudo apt install -y mariadb-server).
• SSH access as a user with sudo rights.
• About five minutes. The script is interactive, so you answer each question.

Step 1: Confirm MariaDB is running

The hardening script needs the database server to be running. Check its status first:

sudo systemctl status mariadb --no-pager

Active: active (running)

Step 2: Run the hardening script

Start the script with sudo. On Ubuntu, the root database account uses the system login rather than a password by default, so sudo is the way to get administrative access.

sudo mysql_secure_installation

The script asks a series of yes/no questions. Here is what each one means and the answer this guide recommends:

Enter current password for root (enter for none):     [press Enter]
Switch to unix_socket authentication [Y/n]            Y
Change the root password? [Y/n]                       n
Remove anonymous users? [Y/n]                         Y
Disallow root login remotely? [Y/n]                   Y
Remove test database and access to it? [Y/n]          Y
Reload privilege tables now? [Y/n]                    Y

• Enter current password for root. There is no password yet, so press Enter.
• Switch to unix_socket authentication. Answer Y. The root account then accepts the system user that runs sudo mariadb instead of a password, which is safer than a password that can be guessed or leaked.
• Change the root password. Answer n because unix_socket authentication replaces it. You can still set one later if you need it.
• Remove anonymous users. Anonymous accounts let anyone connect without a name. Remove them.
• Disallow root login remotely. Root should only be used from the server itself, never from the internet.
• Remove test database. The test database is open to every account and serves no purpose on a real server.
• Reload privilege tables. This applies all the changes immediately.

When the script finishes, it prints "Thanks for using MariaDB!".

Step 3: Check the user accounts

Query the list of accounts. sudo mariadb opens a command-line client as the root database user, and the -e flag runs one statement and exits.

sudo mariadb -e "SELECT User, Host FROM mysql.user;"

+-------------+-----------+
| User        | Host      |
+-------------+-----------+
| mariadb.sys | localhost |
| mysql       | localhost |
| root        | localhost |
+-------------+-----------+

There are no entries with an empty user name and no entry for remote root.

Step 4: Confirm the database only listens locally

By default, MariaDB accepts connections only from the server itself. Verify that with ss, which lists listening sockets:

sudo ss -tlnp | grep 3306

LISTEN 0  80  127.0.0.1:3306  0.0.0.0:*  users:(("mariadbd",pid=...))

The address 127.0.0.1 means local-only. If you saw 0.0.0.0:3306, the server accepts connections from anywhere, and you should set bind-address = 127.0.0.1 in /etc/mysql/mariadb.conf.d/50-server.cnf and restart MariaDB.

Step 5: Confirm the test database is gone

sudo mariadb -e "SHOW DATABASES;"

+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+

Troubleshooting

• ERROR 1698 (28000): Access denied for user 'root'. You ran mariadb without sudo. Use sudo mariadb instead.
• The script says it cannot connect. MariaDB is stopped. Start it with sudo systemctl start mariadb, then run the script again.
• You are asked for a root password you do not know. This happens if an earlier install set one. Check your notes, or see the MariaDB documentation on resetting the root password before continuing.
• Port 3306 is open to the world. Check the bind address (Step 4) and sudo ufw status.

Next steps

With the server locked down, create a separate database and account for each application. Follow Create a database and a dedicated user next.