How to Install MariaDB and MySQL on a Linux Server

Installing MariaDB on Ubuntu and Debian

After connecting to your server over SSH:

sudo apt update
sudo apt install mariadb-server
systemctl status mariadb

If the service shows active (running), the installation is done.

On AlmaLinux and Rocky Linux:

sudo dnf install mariadb-server
sudo systemctl enable --now mariadb

Secure first settings

Right after installation, run the security script:

sudo mariadb-secure-installation

The script asks you a few questions. The recommended answers:

• Remove anonymous users: Yes.
• Disallow root login remotely: Yes.
• Remove the test database: Yes.
• Reload privilege tables: Yes.

On current installations on Ubuntu and Debian, the root user is authenticated with unix_socket instead of a password: if you have sudo rights on the server, you connect without a password, and nobody can connect as root from outside at all. This is a secure default; there's no need to change it. To open the MariaDB console:

sudo mariadb

Creating a database and user

Create a separate database for each application and a separate user with rights only on that database. That way a security hole in one application doesn't affect your other databases. In the MariaDB console:

CREATE DATABASE app CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'app'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT ALL PRIVILEGES ON app.* TO 'app'@'localhost';
FLUSH PRIVILEGES;
EXIT;

• utf8mb4: Stores every Unicode character correctly, including accented letters and emoji. Always use it instead of the old utf8.
• 'app'@'localhost': Specifies that the user can only connect from the server itself. If your application is on the same server, this is the right choice.
• GRANT ALL PRIVILEGES ON app.*: Gives the user rights only on its own database.

In your application's connection settings, enter localhost as the host, 3306 as the port and the username, password and database name you created. We showed how to set this up for FiveM servers in our How to make a FiveM server guide.

Secure remote connections

You may want to manage your database with desktop tools such as HeidiSQL, DBeaver or MySQL Workbench. There are two ways to do it.

Recommended: SSH tunnel

MariaDB keeps listening only on 127.0.0.1, and port 3306 is never exposed to the internet. The connection runs inside the encrypted SSH connection:

ssh -L 3307:127.0.0.1:3306 user@203.0.113.10

While this command is running, connecting to 127.0.0.1:3307 on your own computer actually connects you to the database on the server. Tools like HeidiSQL and DBeaver also have a built-in SSH tunnel option in their connection settings; you only need to enter the server's SSH details.

Direct connection

If an application on another server needs to connect to the database directly:

1. In the /etc/mysql/mariadb.conf.d/50-server.cnf file, change the bind-address = 127.0.0.1 line to bind-address = 0.0.0.0 and restart the service with sudo systemctl restart mariadb.
2. Create a user that only allows the IP address that will connect:

   CREATE USER 'app'@'198.51.100.7' IDENTIFIED BY 'a-strong-password';
   GRANT ALL PRIVILEGES ON app.* TO 'app'@'198.51.100.7';
   

3. In the firewall, open port 3306 only to that IP address:

   sudo ufw allow from 198.51.100.7 to any port 3306 proto tcp
   

Opening the database port to everyone means your server will face automated password-guessing attacks within minutes. Avoid users that can connect from anywhere, such as 'user'@'%'. We covered port and firewall settings in detail in our What is a port? post.

Backup and restore

The database is the most valuable data on your server. You can take a consistent backup with mariadb-dump (mysqldump on MySQL):

sudo mariadb-dump --single-transaction --routines app | gzip > app-$(date +%F).sql.gz

--single-transaction backs up InnoDB tables at a single consistent point in time without locking the database. To restore the backup:

gunzip < app-2026-10-14.sql.gz | sudo mariadb app

To automate backups, first create a folder with sudo mkdir -p /root/backups, then add a job that runs every night with sudo crontab -e:

0 4 * * * mariadb-dump --single-transaction --routines app | gzip > /root/backups/app-$(date +\%F).sql.gz

Inside crontab you need to put a \ in front of the % character. Don't keep backups only on the same server; always send a copy somewhere else. We explained how to do that in our Server backups guide.

Basic performance settings

MariaDB runs without issues on small projects with the default settings. As your data grows, the following settings make a difference; all of them go in the [mysqld] section of the /etc/mysql/mariadb.conf.d/50-server.cnf file:

[mysqld]
innodb_buffer_pool_size = 2G
max_connections = 200
slow_query_log = 1
long_query_time = 1

• innodb_buffer_pool_size: The area where data and indexes are kept in memory. This is the setting that affects performance the most. On a server that only runs the database, pick a little more than half of the RAM; on a server shared with the application, pick a reasonable value that covers your total data size.
• max_connections: The maximum number of connections that can be open at the same time.
• slow_query_log: Logs queries that take longer than the set time (long_query_time, in seconds). It's the easiest way to find the source of slowness; most of the time it points to a missing index.

On AlmaLinux and Rocky Linux, the configuration file is at /etc/my.cnf.d/mariadb-server.cnf. After making changes, restart the service with sudo systemctl restart mariadb.

Nodesty servers for your database

Database performance depends largely on disk speed and memory. Nodesty AMD EPYC 7763 VPS plans, with their large amounts of RAM, suit databases that need a big buffer pool, while AMD Ryzen 9 9950X VPS plans, with their high single-core speed, suit applications and game servers that need to respond quickly. Both plans include NVMe storage, nShield DDoS protection and free daily backups kept for 7 days.