Installing, Initializing, and Hardening MySQL / MariaDB on Your Server

Install the database with apt, enable it on boot, then lock it down with `mysql_secure_installation` — root password, no anonymous users, no remote root.

When you run your own database on your server or VPS, MySQL and MariaDB are the two most common choices. MariaDB is a community fork of MySQL, and their commands are nearly identical, so pick whichever suits you. The steps below target Ubuntu / Debian and are meant to be followed as-is.

Install the database

Refresh the package index, then install just one of them (don't install both — they conflict):

sudo apt update
sudo apt install -y mysql-server     # install MySQL
# or:
sudo apt install -y mariadb-server   # install MariaDB

On CentOS / Rocky, use dnf:

sudo dnf install -y mariadb-server

Start the service and enable it on boot

After installing, confirm the service is running and set it to start with the system. The service is named mysql for MySQL and mariadb for MariaDB:

sudo systemctl enable --now mariadb
sudo systemctl status mariadb

Seeing active (running) means it started fine. enable --now both starts the service and enables it at boot in one step.

Harden the installation

A fresh install ships with loose defaults, so always run the official hardening script:

sudo mysql_secure_installation

The script walks through a few prompts in order. Here's how to answer them:

  • Set a root password: choose a strong one. (MySQL 8 may first ask whether to enable the password-validation component — enable it if you like.)
  • Remove anonymous users: answer Y. Anonymous accounts are a common way in.
  • Disallow remote root login: answer Y, so root can only connect from the local machine.
  • Remove the test database: answer Y.
  • Reload privilege tables now: answer Y to apply the changes immediately.

A note on remote access

By default the database listens only on 127.0.0.1, and keeping it that way is usually the right call — run your app on the same host, or reach the database over a private network. If you genuinely need remote access, edit bind-address in the config file, restrict it to trusted IPs, and open port 3306 in your firewall (for example with ufw). Never expose the database directly to the public internet.

Verify with a first login

Log in as root and enter the password you just set:

sudo mysql -u root -p

At the mysql> prompt, run a quick sanity check:

SELECT VERSION();
SHOW DATABASES;

For day-to-day use, create a dedicated database and account per application instead of using root directly:

CREATE DATABASE appdb CHARACTER SET utf8mb4;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;

Type exit; to leave the shell.

Summary

Standing up a database comes down to four steps: install it with apt install, start and enable it with systemctl enable --now, tighten it with mysqlsecureinstallation, then create a dedicated database and user for each app. Keep two rules in mind — use a strong root password and never expose the database to the public internet — and your data layer is off to a solid start.