MariaDB is a widely used open source relational database. This guide explains how to install MariaDB 10.11 or 11.8 on AlmaLinux 10, secure the initial configuration, create an application database and user, and enable remote access only when it is required.
MariaDB Versions Available on AlmaLinux 10
AlmaLinux 10 provides MariaDB 10.11 in the standard repositories. AlmaLinux 10.2 and later also provide MariaDB 11.8 as a separate package stream. MariaDB 11.8 is the current long term release; MariaDB 10.11 remains a supported choice when an application requires that major version. Install only one database server family on the host to avoid package and service conflicts.
Install and Secure MariaDB on AlmaLinux 10
The steps below install the server from AlmaLinux repositories, start the service, run the security script, and create a database account for an application. Commands assume an account with sudo access.
Use a dedicated database user for each application. Do not connect applications with the MariaDB root account.
Prerequisites
- An AlmaLinux 10 server with current package metadata
- A user account with sudo privileges
- Enough memory and storage for the expected workload
- Network access to TCP port 3306 only if remote clients are required
Step 1: Review Available Updates
Refresh repository metadata and review pending updates. Apply operating system updates during an appropriate maintenance window because some packages may require a reboot.
sudo dnf upgrade --refresh
Step 2: Choose and Install a MariaDB Version
Choose the version required by your application. Both options below use AlmaLinux packages and receive updates through DNF.
Option A: Install MariaDB 10.11
MariaDB 10.11 is the default version in AlmaLinux 10 and is suitable for applications that require the 10.11 release series.
sudo dnf install -y mariadb-server
This command installs the server and client tools from the standard AlmaLinux repositories.
Option B: Install MariaDB 11.8
On AlmaLinux 10.2 and later, MariaDB 11.8 is available as a distribution package. It is the current long term release and does not require a third party repository.
sudo dnf install -y mariadb11.8-server
Install only one option. If the host already contains MySQL or another MariaDB major version, review the migration and backup requirements before replacing packages.
Step 3: Start and Enable MariaDB
Start MariaDB now and configure it to start automatically after a reboot.
sudo systemctl enable --now mariadb.service
Confirm that the service reports active running before continuing.
sudo systemctl status mariadb.service
Step 4: Verify the Installed Version
Check the client version and confirm that it matches the package you selected.
mariadb --version
Step 5: Run the Security Script
Run the current MariaDB security utility. The prompts vary by package version and existing configuration.
sudo mariadb-secure-installation
For a new server, use these answers as a guide:
Current root password: press Enter if the account has no password and the prompt appears.
Unix socket authentication: keep it enabled for the local operating system root account.
Change the root password: usually choose No when unix socket authentication is enabled. Set one only if your operating model requires password authentication.
Remove anonymous users: choose Yes.
Disallow remote root login: choose Yes.
Remove the test database: choose Yes.
Reload privilege tables: choose Yes.
Step 6: Verify the Listener
Check whether MariaDB is listening on TCP port 3306 and review its bind address. A local only listener is appropriate when applications run on the same host.
sudo ss -lntp | grep 3306 sudo mariadb -e "SHOW VARIABLES LIKE 'bind_address';"
Step 7: Create an Application Database and User
Open the MariaDB shell through local unix socket authentication.
sudo mariadb
Create a database and a user limited to localhost. Replace the example names and use a unique password from a secrets manager. CREATE USER and GRANT take effect immediately, so FLUSH PRIVILEGES is not required.
CREATE DATABASE appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'replace-with-a-strong-password'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'localhost'; EXIT;
Test the new account before configuring the application.
mariadb -u appuser -p appdb
Step 8: Enable Remote Access Safely
Skip this step unless a remote client must connect. Restrict the listener, database account, and firewall rule to the required network path. MariaDB does not encrypt client traffic by default, so configure TLS before sending credentials or data across an untrusted network.
Edit the server configuration file used by the installed package.
sudo vi /etc/my.cnf.d/mariadb-server.cnf
Set the bind address to the server’s private database interface. Do not use 0.0.0.0 unless the network design and firewall rules require listening on every interface.
bind-address = 192.0.2.20
Create a separate account for the remote application host. Replace 203.0.113.10 with the client’s fixed IP address.
CREATE USER 'appuser'@'203.0.113.10' IDENTIFIED BY 'replace-with-a-strong-password'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'203.0.113.10';
Restart MariaDB, then confirm that the service started successfully.
sudo systemctl restart mariadb.service sudo systemctl --no-pager --full status mariadb.service
Step 9: Restrict the Firewall Rule
If firewalld is active, allow TCP port 3306 only from the application host or trusted subnet.
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10/32" port port="3306" protocol="tcp" accept' sudo firewall-cmd --reload
Verify the resulting rich rule. Do not enable the broad mysql service rule unless every source allowed by the zone should reach MariaDB.
sudo firewall-cmd --list-rich-rules
Review Configuration Before Production
Inspect the current values before changing server settings. Capacity depends on available memory, query patterns, connection count, and whether the host runs other services.
sudo mariadb -e "SHOW VARIABLES WHERE Variable_name IN ('innodb_buffer_pool_size','max_connections');"
For a dedicated database host, the InnoDB buffer pool is often the largest memory allocation. Increase it only after measuring workload and total memory use. Set connection limits from observed concurrency rather than a generic preset.
After any configuration change, restart MariaDB and review the service log for rejected directives or startup errors.
sudo systemctl restart mariadb.service sudo journalctl -u mariadb.service -n 50 --no-pager
Conclusion
MariaDB is now installed, running, and configured with a dedicated application account. Keep remote access closed unless it is required, use TLS for remote clients, install security updates, and maintain tested backups before putting the database into production.
FAQ
Which MariaDB versions are available on AlmaLinux 10
AlmaLinux 10 provides MariaDB 10.11. AlmaLinux 10.2 and later also provide MariaDB 11.8 as a separate package. Choose the version supported by your application and test upgrades before production deployment.
Should the MariaDB root account have a password
On current MariaDB releases, the local root account commonly uses unix socket authentication. In that setup, administrators connect with sudo mariadb and do not need a database password for root. Keep remote root login disabled.
How do I confirm that MariaDB is running
Run sudo systemctl status mariadb.service. Use sudo ss -lntp | grep 3306 to check the TCP listener when network connections are expected.
How do I allow a remote application to connect
Bind MariaDB to the server’s private database interface, create a user restricted to the application host, and add a source restricted firewall rule. Configure TLS when traffic leaves a trusted private network.
