How to Install and Secure MariaDB Database Server on Ubuntu

MariaDB is an open-source, high-performance relational database management system (RDBMS) created as a fully compatible, drop-in replacement for MySQL. It powers databases for web applications (WordPress, Laravel), game server plugins (LuckPerms MySQL sync), and multiplayer frameworks (FiveM QBCore/ESX).

This step-by-step guide covers installing MariaDB on Cubes Hosting Ubuntu VPS, hardening security settings with mysql_secure_installation, creating dedicated non-root users, and managing database access safely.

Step 1: Install MariaDB Server

1. Connect to your VPS via SSH as root or a user with sudo privileges.
2. Update your APT package index and install MariaDB Server and Client:

   sudo apt update && sudo apt install -y mariadb-server mariadb-client
   

3. Check that the MariaDB background service is running:

   sudo systemctl status mariadb
   

   (The output should report Active: active (running) in green).

Step 2: Harden Security (mysql_secure_installation)

Fresh database installations require security hardening to disable default test accounts, restrict remote root access, and remove test databases.

Execute the interactive security script:

sudo mysql_secure_installation

Respond to the security prompts as follows:

1. Enter current password for root (enter for none): Press Enter (default is blank).
2. Switch to unix_socket authentication Y/n: Type Y and press Enter.
3. Change the root password? Y/n: Type Y, enter a strong root password, and confirm it.
4. Remove anonymous users? Y/n: Type Y (blocks unauthenticated guest logins).
5. Disallow root login remotely? Y/n: Type Y (forces root logins to occur locally on the server).
6. Remove test database and access to it? Y/n: Type Y (deletes sample databases).
7. Reload privilege tables now? Y/n: Type Y (applies changes immediately).

Step 3: Create Dedicated Databases and Non-Root Users

SECURITY BEST PRACTICE: Never connect web applications, Minecraft plugins, or game servers using the database root account! Always create a dedicated database and non-root user for each application.

1. Log in to the MariaDB terminal as root:

   sudo mysql -u root -p
   

   
   (Enter your root password set in Step 2).
2. Create a new database:

   CREATE DATABASE app_db;
   

3. Create a dedicated user with a strong password:

   CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'YourStrongPassword123!';
   

4. Grant permissions for app_user on app_db only:

   GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'localhost';
   

5. Apply privileges and exit:

   FLUSH PRIVILEGES;
   EXIT;
   

Step 4: Configuring Remote Access (Optional & Secure)

By default, MariaDB listens strictly on 127.0.0.1 (localhost), blocking external connections from the internet.

If you need a remote application (e.g., a Minecraft server on VPS A connecting to MariaDB on VPS B) to access the database:

1. Edit the MariaDB Server Configuration:

sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf

Find the bind-address line:

# Change bind-address from 127.0.0.1 to 0.0.0.0 (or server IP)
bind-address = 0.0.0.0

(Save and exit: CTRL + O, Enter, CTRL + X).

Restart MariaDB:

sudo systemctl restart mariadb

2. Grant Remote User Access for Specific IP:

Never open remote user access to '%' (any IP). Always restrict remote users to your specific remote server's IP address:

GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'203.0.113.50' IDENTIFIED BY 'YourStrongPassword123!';
FLUSH PRIVILEGES;

(Replace 203.0.113.50 with your remote game server IP).

3. Restrict Port 3306 in UFW Firewall:

Allow incoming MySQL connections on port 3306 only from your trusted remote IP address:

sudo ufw allow from 203.0.113.50 to any port 3306 proto tcp

Useful MariaDB CLI Commands Cheat Sheet

Conclusion

MariaDB is now fully installed and hardened on your Cubes Hosting Ubuntu VPS! Run your web apps and game server databases securely with dedicated non-root users, restricted bind addresses, and UFW firewall protection!