How to Install and Secure MariaDB on Ubuntu

When deploying a web application on Linux, a robust database is a critical component of the infrastructure stack. While MySQL is highly popular, MariaDB has emerged as the preferred open-source alternative. Forked from MySQL by its original developers, MariaDB is a drop-in replacement that offers enhanced performance, better storage engines, and a stricter commitment to open-source licensing.

Ubuntu includes MariaDB in its default package repositories, making the installation process incredibly straightforward. However, a default database installation is highly insecure and should never be exposed to a production environment without proper configuration.

In this guide, you will learn how to install MariaDB on Ubuntu, secure the initial deployment, and create a dedicated database user for your applications.

Step 1: Update the Package Index

Before installing any new software on Ubuntu, it is best practice to update the local package index to ensure you are downloading the latest available version.

Open your terminal (or connect to your server via SSH) and run:

sudo apt update

Step 2: Install the MariaDB Server

Once the package index is updated, you can install the MariaDB server package. The mariadb-server package includes the database daemon and all necessary dependencies.

sudo apt install mariadb-server -y

The installation process will take a few moments. Once complete, the MariaDB service will start automatically.

You can verify that the database server is running perfectly by checking its status:

sudo systemctl status mariadb

You should see a green active (running) status. Press q to exit the status screen.

Step 3: Secure the MariaDB Installation

A fresh MariaDB installation has several severe security vulnerabilities: the root user has no password, anonymous users can log in, and remote root logins might be permitted.

To fix this, MariaDB provides a built-in security script. Run the following command:

sudo mysql_secure_installation

The script will guide you through a series of prompts. Here is the recommended way to answer them for a secure production environment:

1. Enter current password for root: Since you just installed it, there is no password. Press Enter.
2. Switch to unix_socket authentication [Y/n]: Press n (Ubuntu already uses auth_socket by default, so this is unnecessary).
3. Change the root password? [Y/n]: Press n. (In modern Ubuntu systems, the root database user is authenticated via the system root user, making a separate password redundant and slightly less secure).
4. Remove anonymous users? [Y/n]: Press Y.
5. Disallow root login remotely? [Y/n]: Press Y. (The root user should only ever connect from localhost).
6. Remove test database and access to it? [Y/n]: Press Y.
7. Reload privilege tables now? [Y/n]: Press Y.

Your database is now secure and ready for use.

Step 4: Create a Dedicated Database User

It is terrible security practice to allow web applications (like WordPress or a custom Python script) to connect to the database using the root user. If your application is compromised, the attacker would have full control over every database on the server.

Instead, you must create a dedicated user that only has access to a specific database.

First, log in to the MariaDB shell as the root user:

sudo mariadb

Next, create a new database for your application (replace app_db with your desired name):

CREATE DATABASE app_db;

Now, create a new user and assign them a strong password (replace app_user and StrongPassword123 with your own values):

CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'StrongPassword123';

Grant this new user full privileges, but only on the newly created database:

GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'localhost';

Finally, flush the privileges to ensure MariaDB applies the new permissions immediately, and exit the shell:

FLUSH PRIVILEGES;
EXIT;

Step 5: Verify the New User

To ensure everything is working correctly, attempt to log in to the MariaDB shell using your new dedicated user:

mariadb -u app_user -p

You will be prompted for the password you created in Step 4. Once logged in, run the following command to see which databases this user can access:

SHOW DATABASES;

You should only see app_db and the standard information_schema. You will not see the system databases or other applications’ databases, confirming that the user is properly restricted.

By following these steps, you have successfully installed a highly performant database engine and secured it according to modern Linux administration standards.