{"id":16653,"date":"2026-05-17T16:49:01","date_gmt":"2026-05-17T16:49:01","guid":{"rendered":"https:\/\/greenwebpage.com\/community\/?p=16653"},"modified":"2026-05-17T16:49:07","modified_gmt":"2026-05-17T16:49:07","slug":"how-to-install-and-secure-mysql-mariadb-on-almalinux-10","status":"publish","type":"post","link":"https:\/\/greenwebpage.com\/community\/how-to-install-and-secure-mysql-mariadb-on-almalinux-10\/","title":{"rendered":"How to Install and Secure MySQL\/MariaDB on AlmaLinux 10 (Step-by-Step Guide)"},"content":{"rendered":"\n

One of the most vulnerable resources is an unprotected, installed database server. Database attacks continue to be one of the three most recurring causes of enterprise data breaches year after year, and most of the attacks take advantage of misconfigurations that could have been avoided during initial setup in less than 30 minutes, according to Verizon’s Data Breach Investigations Report<\/a>.<\/p>\n\n\n\n

AlmaLinux 10<\/a> is an enterprise Linux distribution based on RHEL with support from Red Hat, and is popular with companies moving away from CentOS. It ships with MariaDB as the default database engine, which is a fully open source, production-proven derivative of MySQL, compatible with MySQL binary-wise, and is maintained by the MariaDB Foundation.<\/p>\n\n\n\n

In this guide, you’ll install MariaDB on AlmaLinux 10, implement all critical security hardening tasks, and configure database users that are properly scoped.<\/p>\n\n\n\n

<\/a>What Is MariaDB and Why Is It the Default on AlmaLinux 10?<\/strong><\/h2>\n\n\n\n

MariaDB<\/a> is a community-developed drop-in replacement for MySQL developed by the original MySQL developers since Oracle bought Sun Microsystems in 2010. It is a fully wired protocol compatible with MySQL, which means that any MySQL client, connector, or application can run on it without requiring any changes.<\/p>\n\n\n\n

With AlmaLinux 10, the default version of the MariaDB database engine is pre-installed in the official AlmaLinux AppStream repository, as it provides better performance in some workloads, a more active open source community, and a development roadmap that focuses on enterprise reliability. All commands, SQL syntax, and configuration file locations (e.g., \/etc\/my.cnf) that are discussed in this guide are applicable to both MySQL<\/a> and MariaDB when using AlmaLinux 10.<\/p>\n\n\n\n

<\/a>Expert Guide: Install and Secure MySQL\/MariaDB on AlmaLinux 10<\/strong><\/h2>\n\n\n\n

A full installation guide for MySQL\/MariaDB, installation of secure authentication, allowing firewall access, and hardening up your AlmaLinux 10 database server. Learn how to properly secure the MySQL\/MariaDB database on AlmaLinux 10 systems, including: how to protect the root password, how to remove anonymous users, how to disable remote root access, and how to configure the database for production use.<\/p>\n\n\n\n

<\/a>Step 1: Update the System and Verify the Environment<\/strong><\/h3>\n\n\n\n

You should keep your AlmaLinux 10 operating system<\/a> up-to-date before installing any new server software. If you install on a fully-updated system, you have no uncertainty as to how the new packages will behave, pending kernel updates and security patches:<\/p>\n\n\n\n

\n

sudo dnf update<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Check your version of AlmaLinux<\/a>, and ensure you are logged on as a user who has sudo privileges:<\/p>\n\n\n\n

\n

cat \/etc\/almalinux-release<\/p>\n

whoami<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"cat<\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/a>Step 2: Install MariaDB on AlmaLinux 10<\/strong><\/h3>\n\n\n\n

MariaDB can be obtained directly from the AlmaLinux 10 AppStream repository. Install both the server and client packages with one dnf command:<\/p>\n\n\n\n

\n

sudo dnf install mariadb-server mariadb<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Check the installed version:<\/p>\n\n\n\n

\n

mariadb –version<\/p>\n

mysql –version<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"mariadb<\/figure>\n\n\n\n

<\/p>\n\n\n\n

On AlmaLinux 10, both mariadb and mysql execute the same binary, and scripts and tools that are dependent on either command name are backwards compatible.<\/p>\n\n\n\n

<\/a>Step 3: Start and Enable the MariaDB Service<\/strong><\/h3>\n\n\n\n

Now we can start and enable the MariaDB Service. Start MariaDB, and configure it to start automatically on boot:<\/p>\n\n\n\n

\n

sudo systemctl enable mariadb –now<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Verify the service is running:<\/p>\n\n\n\n

\n

sudo systemctl status mariadb<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Confirm MariaDB is listening on port 3306:<\/p>\n\n\n\n

\n

ss -tlnp | grep 3306<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"ss<\/figure>\n\n\n\n

<\/p>\n\n\n\n

The binding 127.0.0.1:3306 is a crucial security aspect; it guarantees that MariaDB is only accepting connections from the local machine, not from any external network interface.<\/p>\n\n\n\n

<\/a>Step 4: Run the Security Installation Script<\/strong><\/h3>\n\n\n\n

MariaDB comes with a security script called mysql_secure_installation, which will ask you questions and guide you through the most important initial steps of securing MariaDB interactively. Run it now:<\/p>\n\n\n\n

\n

sudo mysql_secure_installation<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

The following prompts are given in the script. These are the proper answers for a production server: You will be presented with the root password. You will be asked for the current root password.<\/p>\n\n\n\n

If you answer Y to “Remove anonymous users”, any account that allows anyone to log in to MariaDB without a password will be deleted, something that is not acceptable on any server that is connected to a network. If you set the answer to Y for “Disallow root login remotely,” then even if an attacker knows the root password, he cannot log in to the system remotely. If you choose Y for “Remove test database”, you will get rid of a publicly writable database supplied by default, which is a known attack surface for which there are several CVEs.<\/p>\n\n\n\n

<\/a>Step 5: Verify Security Hardening Applied<\/strong><\/h3>\n\n\n\n

Once you have run mysql_secure_installation, check that every security step was executed properly by directly checking the MariaDB system tables:<\/p>\n\n\n\n

\n

mysql -u root -p<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Use the MariaDB shell to run these verification queries. Run the following command to check all users\/password status:<\/p>\n\n\n\n

\n

SELECT User, Host, authentication_string FROM mysql.user;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"select<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Verify: 0 anonymous users<\/p>\n\n\n\n

\n

SELECT COUNT(*) AS anonymous_users FROM mysql.user WHERE User=”;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"select<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Verify: 0 remote root access<\/p>\n\n\n\n

\n

SELECT COUNT(*) AS remote_root FROM mysql.user<\/p>\n

WHERE User=’root’ AND Host NOT IN (‘localhost’,’127.0.0.1′,’::1′);<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"select<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Verify: test database removed<\/p>\n\n\n\n

\n

SELECT COUNT(*) AS test_db FROM information_schema.SCHEMATA<\/p>\n

WHERE SCHEMA_NAME=’test’;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"select<\/figure>\n\n\n\n

<\/p>\n\n\n\n

The three checks return the appropriate results: zero anonymous users, zero remote root access, and zero test databases. You have now hardened your MariaDB installation.<\/p>\n\n\n\n

<\/a>Step 6: Create a Dedicated Application Database and User<\/strong><\/h3>\n\n\n\n

The most common and risky misconfiguration of MariaDB is to allow apps to log in directly to the root account. The root user has complete access to all databases on the server. If an application with root access is compromised, the attacker immediately has all access rights to all databases.<\/p>\n\n\n\n

The proper way is to establish a separate database and assign a dedicated user<\/a> to it with just the necessary level of access for that application:<\/p>\n\n\n\n

Create the application database with UTF-8 encoding.<\/p>\n\n\n\n

\n

CREATE DATABASE appdb<\/p>\n

CHARACTER SET utf8mb4<\/p>\n

COLLATE utf8mb4_unicode_ci;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"create<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Create a dedicated application user.<\/p>\n\n\n\n

\n

CREATE USER ‘appuser’@’localhost’<\/p>\n

IDENTIFIED BY ‘AppUserStr0ngP@ss!’;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"create<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Grant only the privileges this application actually needs.<\/p>\n\n\n\n

\n

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER<\/p>\n

ON appdb.*<\/p>\n

TO ‘appuser’@’localhost’;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"grant<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Apply the privilege changes immediately.<\/p>\n\n\n\n

\n

FLUSH PRIVILEGES;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"flush<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Verify the grants were applied correctly:<\/p>\n\n\n\n

\n

SHOW GRANTS FOR ‘appuser’@’localhost’;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"show<\/figure>\n\n\n\n

<\/p>\n\n\n\n

The first line contains GRANT USAGE ON *.* \u2014 MariaDB does not allow the user to be created without having any privileges whatsoever. All permissions are given only to the appdb database, following the principle of least privilege.<\/p>\n\n\n\n

<\/a>Step 7: Test the Application User’s Database Access<\/strong><\/h3>\n\n\n\n

Check if the appuser can connect to their database and can execute operations:<\/p>\n\n\n\n

\n

mysql -u appuser -p’AppUserStr0ngP@ss!’ appdb<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"mysql<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Create a real application table.<\/p>\n\n\n\n

\n

CREATE TABLE IF NOT EXISTS users (<\/p>\n

id INT AUTO_INCREMENT PRIMARY KEY,<\/p>\n

name VARCHAR(100) NOT NULL,<\/p>\n

email VARCHAR(150) UNIQUE NOT NULL,<\/p>\n

created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP<\/p>\n

);<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"create<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Insert test records<\/p>\n\n\n\n

\n

INSERT INTO users (name, email) VALUES<\/p>\n

(‘Alice Johnson’, ‘alice@example.com’),<\/p>\n

(‘Bob Smith’, ‘bob@example.com’);<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"insert<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Query the data<\/p>\n\n\n\n

\n

SELECT * FROM users;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"select<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Ensure that appuser is unable to access system databases: This will stop privilege escalation in the event of a compromise of the application:<\/p>\n\n\n\n

\n

USE mysql;<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"use<\/figure>\n\n\n\n

<\/p>\n\n\n\n

The access denied error confirms that the privilege scoping is working correctly.<\/p>\n\n\n\n

<\/a>Step 8: Configure the Firewall on AlmaLinux 10<\/strong><\/h3>\n\n\n\n

AlmaLinux 10 uses firewalld as its default firewall manager. Since MariaDB is bound to 127.0.0.1 and should never accept external connections in a standard single-server setup<\/a>, verify that port 3306 is not publicly exposed:<\/p>\n\n\n\n

\n

sudo firewall-cmd –list-all<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

If port 3306 appears in the output, remove it immediately:<\/p>\n\n\n\n

\n

sudo firewall-cmd –permanent –remove-service=mysql<\/p>\n

sudo firewall-cmd –permanent –remove-port=3306\/tcp<\/p>\n

sudo firewall-cmd –reload<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

If your architecture requires a remote database connection \u2014 for example, a web server on a private network connecting<\/a> to a dedicated database server \u2014 open port 3306 only to the specific trusted IP address, never to the entire internet:<\/p>\n\n\n\n

\n

sudo firewall-cmd –permanent \\<\/p>\n

–add-rich-rule=’rule family=”ipv4″ source address=”10.0.0.5\/32″ port port=”3306″ protocol=”tcp” accept’<\/p>\n

sudo firewall-cmd –reload<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Verify the rule was applied:<\/p>\n\n\n\n

\n

sudo firewall-cmd –list-rich-rules<\/p>\n<\/th><\/tr><\/thead><\/table><\/figure>\n\n\n\n

\"sudo<\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/a>Troubleshooting Common Issues on AlmaLinux 10<\/strong><\/h2>\n\n\n\n

Using AlmaLinux 10, this guide covers common problems and how to fix them.<\/p>\n\n\n\n