Install MariaDB on Debian

MariaDB is the SQL server shipped by Debian and fits most web applications. Installation is quick; problems usually come from an exposed port, an over-privileged account or a password stored in a world-readable file. This procedure covers installation, basic hardening and creating an application database.

Install the server

sudo apt update
sudo apt install mariadb-server
sudo systemctl status mariadb

The package creates the mariadb service, the /run/mysqld/mysqld.sock socket and a Unix root account. Debian 13 ships a maintained version; no third-party repository is needed for standard use. Check the version with mariadb --version.

Harden the installation

sudo mariadb-secure-installation

mysql_secure_installation remains an alias, but the mariadb-* names are consistent. Answer the prompts: switch root to unix_socket (or set a password if you need one), remove anonymous accounts, disallow remote root login, drop the test database and reload privileges.

MariaDB listens on 127.0.0.1 by default. Confirm it:

sudo ss -ltnp | grep 3306

/etc/mysql/mariadb.conf.d/50-server.cnf contains bind-address = 127.0.0.1. Do not change it to 0.0.0.0 to reach the database from your desktop: use an SSH tunnel instead. An exposed port 3306 is scanned within minutes.

Create a database and a user

sudo mariadb

CREATE DATABASE app CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'app'@'localhost' IDENTIFIED BY 'strong-password';
GRANT ALL PRIVILEGES ON app.* TO 'app'@'localhost';
EXIT;

utf8mb4 covers emojis and characters outside the BMP. The application user only has rights on app; do not reuse root in application code. If the application connects to 127.0.0.1 rather than the socket, the account host must be 'app'@'127.0.0.1' or match name resolution.

Test without putting the password in shell history:

mariadb -u app -p app -e "SELECT 1;"

Verify and troubleshoot

After a configuration change, restart and read the journal:

sudo systemctl restart mariadb
sudo journalctl -u mariadb -n 50 --no-pager

Common errors are Access denied (wrong host or password), Can't connect through socket (service stopped or wrong path) and a full disk. Back up before changing privileges: a misplaced GRANT can open the whole database. For remote access, prefer an SSH tunnel over opening the port.