A secure MySQL or MariaDB deployment on a Linux VPS needs controls at three layers: database accounts and privileges, network exposure, and the operating system that stores the data. Start by removing default accounts and test objects, create narrowly scoped application users, bind the server only to required interfaces, encrypt any traffic crossing an untrusted network, harden the service account and files, then verify logging, backups, patching and recovery. The exact commands and configuration paths vary by product, distribution and release, so identify the installed version before changing settings.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
1. Identify the product, version and exposure
MySQL and MariaDB share much of their SQL syntax but are not interchangeable security products. TLS defaults, authentication behavior, configuration-file locations, dynamic privileges, audit options and backup requirements can change between releases. Record the exact server and operating-system versions before applying a guide written for another release.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →mysql --version
mariadb --version
sudo systemctl status mysql
sudo systemctl status mariadb
sudo ss -lntp | grep 3306Use the service name that exists on the VPS. Check whether port 3306 is listening on 127.0.0.1, a private address, or every interface. Also list the VPS’s public and private addresses, application hosts, firewall rules, enabled plugins and database directories. This inventory defines what must remain reachable and what can be removed.
2. Complete the initial account cleanup
Run the vendor-provided hardening script as soon as the installation is reachable locally. On current MariaDB packages the command is usually:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
sudo mariadb-secure-installationSome MySQL and older MariaDB packages use:
sudo mysql_secure_installationRead each prompt rather than accepting a script blindly. The intended baseline is:
- Remove anonymous accounts.
- Remove the test database and its associated access.
- Disallow remote login for the administrative root account.
- Reload privilege tables when prompted.
Afterward, inspect the account list instead of assuming the script covered every account variant:
sudo mariadb -e "SELECT User,Host,plugin FROM mysql.user;"Do not use the database root account from an application, web process or routine script. Create named administrative accounts for people and separate service identities for applications, migrations, monitoring and backups. Named accounts make ownership, revocation and audit records understandable.
3. Apply least privilege to every account
Grant only the statements and objects a process needs. An application that reads and updates two tables should not receive server-wide ALL PRIVILEGES, administrative rights or access to every database. MySQL’s security guidance describes this as allowing users and processes to access only the information and resources required for their legitimate purpose.
Create an application account with a narrow scope
CREATE USER 'app_rw'@'localhost' IDENTIFIED BY 'use-a-long-unique-secret';
GRANT SELECT, INSERT, UPDATE, DELETE
ON shop.* TO 'app_rw'@'localhost';
SHOW GRANTS FOR 'app_rw'@'localhost';Generate the password with a secret manager and keep it out of source control, shell history and world-readable configuration files. If the application runs on another private host, replace localhost with that host’s fixed private address or a tightly controlled subnet. Avoid a wildcard host such as 'app_rw'@'%'; it permits authentication from any reachable address.
Separate duties
- Use a read-only identity for reporting or replicas that do not write.
- Use a migration identity only during deployment, then disable or remove it.
- Use a monitoring identity with the few status privileges its collector actually needs.
- Use a dedicated backup identity rather than handing an application account backup or administrative rights.
Review dangerous privileges
Pay special attention to FILE, PROCESS, SUPER, replication privileges, plugin-management privileges and newer dynamic privileges. FILE can let the server process read or write files subject to operating-system permissions; PROCESS can reveal other sessions and sensitive statements; broad administrative privileges can expose credentials or permit configuration changes. Revoke anything not justified by a documented task.
Free tools Windows power users keep installed
One-click scans. No signup required.
SHOW GRANTS FOR 'app_rw'@'localhost';
REVOKE ALL PRIVILEGES, GRANT OPTION
FROM 'old_user'@'localhost';
DROP USER 'old_user'@'localhost';Run the review for every account and every host entry. Two accounts with the same name but different host values are separate principals.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
4. Close the network by default
Keep a single-VPS application local
If the application and database share the VPS, bind the database to loopback. In a MySQL installation this is often in /etc/mysql/mysql.conf.d/mysqld.cnf; MariaDB packages commonly use a file under /etc/mysql/mariadb.conf.d/ or /etc/my.cnf.d/. Confirm the active file for your distribution rather than editing a similarly named unused file.
[mysqld]
bind-address = 127.0.0.1Restart the matching service and verify the listener:
sudo systemctl restart mysql # use mariadb when that is the service name
sudo ss -lntp | grep 3306A listener on 127.0.0.1:3306 is not reachable from the public internet. A changed port is not a security control: scanners find nonstandard ports, while an unrestricted listener remains exposed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Permit only a private application network
For a separate application tier, bind to the required private interface, not to every interface. Then enforce the same source restriction at the VPS firewall and, where available, the provider's network firewall. For example, a UFW rule can allow only a documented private subnet:
sudo ufw allow from 10.20.0.0/24 to any port 3306 proto tcp
sudo ufw status verboseReplace the example subnet with the actual application addresses. Do not open 3306 to 0.0.0.0/0. If a firewall change could disconnect your current session, stage and test it from a second administrative connection.
5. Encrypt connections that leave the trusted host
Loopback traffic usually does not cross a hostile network, but connections between VPSs, administrators and managed networks should use TLS. TLS protects credentials and query results from man-in-the-middle interception. MariaDB's TLS defaults and required settings differ between releases, so check the installed version's server and client documentation.
Configure certificates and keys
Obtain a server certificate whose name matches the connection endpoint, a private key readable only by the database service, and a trusted CA chain. Configure the server's TLS variables in its active configuration file, using the names supported by that release:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
[mysqld]
ssl-ca = /etc/mysql/tls/ca.pem
ssl-cert = /etc/mysql/tls/server-cert.pem
ssl-key = /etc/mysql/tls/server-key.pem
Set ownership and permissions so the service can read the key while ordinary users cannot:
sudo chown -R mysql:mysql /etc/mysql/tls
sudo chmod 750 /etc/mysql/tls
sudo chmod 640 /etc/mysql/tls/server-key.pemThe exact service account, directory and certificate-variable names may differ. Restart the server, inspect the error log for certificate failures, and test a client connection with certificate verification enabled.
Require encrypted sessions for sensitive accounts
CREATE USER 'remote_app'@'10.20.0.15'
IDENTIFIED BY 'use-a-long-unique-secret'
REQUIRE SSL;On releases that support it, require_secure_transport can reject non-TLS transport globally. Treat that as a controlled change: first verify that every client supports TLS, then enable it in the appropriate configuration and test application startup, health checks and administrative access. A session can be checked after login with the product's status variables; for MySQL, inspect SHOW SESSION STATUS LIKE 'Ssl_cipher';. An empty cipher indicates that the session is not using TLS.
6. Harden the Linux service and database files
Never run mysqld or mariadbd as Unix root. The database daemon should run under its dedicated service account, normally named mysql. Verify the effective user through the service definition and process list, and investigate any override that starts it with elevated privileges.
ps -eo user,group, pid,cmd | grep -E '[m]ysqld|[m]ariadbd'
systemctl cat mysql
systemctl cat mariadbRestrict the data directory, relay logs, binary logs, error logs, slow-query logs, TLS keys and configuration files to the service account and authorized administrators. Do not make database directories world-readable merely to simplify troubleshooting. Check permissions after package upgrades and backup restores, because copied files can inherit unsafe ownership.
Enable the mandatory-access-control framework available on the distribution. SELinux policies and AppArmor profiles can limit which files and capabilities the daemon may use even if a database vulnerability is exploited. Keep the distribution's database profile enabled, review denials after legitimate configuration changes, and do not disable enforcement as a permanent fix.
7. Reduce risky features and interfaces
Disable local file loading unless required
LOCAL INFILE can cause a client to send local files to a server or accept files from it, depending on client and server behavior. If no workload needs it, disable it in the server configuration and client settings:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
[mysqld]
local_infile = 0
Test imports and application startup after the change; a data pipeline that genuinely depends on it needs a narrower, documented exception rather than an unnoticed failure.
Review plugins and dynamic privileges
List installed authentication, audit, encryption and miscellaneous plugins. Remove unused components, keep plugin files owned by trusted administrators, and restrict who can install or configure plugins. Recheck replication, tablespace, routine-definition and administrative privileges after upgrades because privilege names and defaults can change between MySQL and MariaDB releases.
8. Log, protect and review security events
At minimum, retain an error log and connection failures. Add query or audit logging when the workload and privacy policy justify it. General query logging can be expensive and may capture passwords or personal data, so enable it for a defined diagnostic period or under a documented retention policy. Slow-query logging is useful for performance and can reveal unexpected statements without recording every successful query.
- Send logs to a root-owned or service-controlled directory.
- Rotate logs before disks fill and verify that rotation preserves restrictive permissions.
- Limit access to administrators and the approved monitoring system.
- Protect log archives and binary logs because they can contain sensitive data.
- Consider encryption for binary logs and backups when the release and key-management design support it.
Review failed logins, new accounts, privilege changes, unexpected source addresses, plugin changes and unusual administrative statements. Database audit plugins differ between products and editions; select one supported by the installed release and configure events deliberately rather than enabling every event without a retention plan.
Recommended Free Tools
9. Build backups that can actually restore
A backup protects availability only if it is complete, protected from the database host and regularly restored in a test environment. Store copies separately from the VPS, restrict access, encrypt them, and keep credentials outside the backup archive.
For MariaDB, use the release-appropriate mariadb-backup utility and a dedicated account. Its minimum privileges vary by MariaDB version and backup mode, so create the identity from the utility's documentation for the installed release rather than copying a MySQL grant or an older MariaDB example. Grant only the listed backup privileges, test a full backup, and remove unused backup accounts.
mariadb-backup --backup
--target-dir=/srv/backups/mariadb/full-YYYYMMDD
--user=backup_user --passwordThe placeholder directory represents a real dated path you create with restrictive permissions; do not put a password directly in a process-list-visible command. Encrypt the resulting files, transfer them to separate storage, and document key recovery. Schedule restoration drills that verify table contents, users, grants, configuration, binary-log continuity and application startup.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
10. Patch and review on a defined schedule
Keep the Linux distribution and database server on supported releases. Track vendor security advisories and CVEs, apply updates in a maintenance window, and test application compatibility before production rollout. The MySQL 5.7 secure-deployment material remains useful for principles such as least privilege, host firewalls and operating-system confinement, but it is an older product guide; current release documentation controls command and setting details.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAt each review, compare the desired state with the live server:
- Database and operating-system versions, enabled repositories and pending security updates.
- Users, host patterns, authentication plugins, expired credentials and
SHOW GRANTSoutput. - Bind address, listening sockets, VPS firewall and provider firewall rules.
- TLS certificates, key permissions, certificate expiry and whether clients negotiate TLS.
- Plugins,
LOCAL INFILE, replication and dynamic administrative privileges. - Data, configuration, log and backup ownership and modes.
- Backup completion, off-host copies and the date of the last successful restore test.
Record who approved exceptions, why they exist, their source addresses and an expiry or review date. Temporary broad access should never become an undocumented permanent rule.
MySQL and MariaDB: what must be checked separately
| Security area | Why product and version matter | Safe practice |
|---|---|---|
| Initial hardening command | Package names differ; older installations may expose the legacy command. | Use mariadb-secure-installation or mysql_secure_installation as supplied by the installed package. |
| Root authentication | Authentication plugins and root-account defaults differ by release and distribution. | Inspect the account and plugin; use named administrators and keep root local. |
| Configuration path | Debian, Ubuntu, Red Hat-family and vendor packages include different files. | Find the active server configuration before changing bind-address, TLS or logging. |
| TLS defaults | MariaDB documents release-dependent changes, and MySQL settings also vary by version. | Configure certificates explicitly, require TLS where appropriate and verify the negotiated session. |
| Backup privileges | mariadb-backup requirements vary by version and mode; MySQL backup tools use different privilege models. |
Follow the utility documentation for the exact installed release and test a restore. |
| Audit and confinement | Available audit plugins, SELinux policies and AppArmor profiles depend on product packages and distribution. | Use the supported plugin and mandatory-access-control profile, then test after upgrades. |
Verification and troubleshooting
The application cannot connect after binding changes
Confirm the application is using the intended hostname and port, then check the listener with ss. If the application is on another host, verify that the server is bound to the correct private address, the firewall permits only that source, and the account's host value matches the client's source address. Do not solve the problem by opening the port globally.
TLS clients fail after enforcement
Check the server error log, certificate chain, key permissions, hostname validation and client library support. Test one client with explicit CA verification before enforcing TLS globally. Remove or renew an expired certificate, then confirm the session status shows a negotiated cipher.
A privilege review finds unexpected access
Export SHOW GRANTS for every account, including accounts whose host component is an IP address, hostname or wildcard. Revoke unused grants, remove abandoned users and repeat the review after migrations, plugin installation or vendor upgrades.
Backups complete but restoration fails
Check that the backup includes all required databases, users, grants and binary-log position, that encryption keys are recoverable, and that the restore host runs a compatible release. Run restoration drills before an outage rather than discovering an incompatibility during one.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
