Skip to main content
To secure a new MySQL or MariaDB server, run sudo mysql_secure_installation (MySQL) or sudo mariadb-secure-installation (MariaDB) and answer Y to removing anonymous users, disallowing remote root login, removing the test database and reloading privileges. Then keep the server listening on 127.0.0.1, give each app its own user, and back up your data.

​
Before you start

  • Install the server first. See install MariaDB or MySQL.
  • Run the commands with sudo. If you are logged in as root, leave out sudo.
  • If you will set a root password, have a password manager ready to store it.

​
What does mysql_secure_installation do?

It is an interactive script that ships with the server. According to the MariaDB documentation, it lets you:
  • set a password for root accounts
  • remove root accounts that can be reached from outside the server
  • remove anonymous (nameless) user accounts
  • remove the test database, which anonymous users can open by default
On MariaDB the script is called mariadb-secure-installation. The old name mysql_secure_installation still works through a link.

​
How to run the secure installation script

1

Start the script

2

Current root password

At Enter current password for root (enter for none): press Enter. A fresh install has no root password.
3

Socket authentication

At Switch to unix_socket authentication [Y/n] or Enable unix_socket authentication? [Y/n] answer Y. Root then logs in only through sudo mariadb on the server itself, with no password to guess.
4

Root password

At Change the root password? [Y/n] answer n if you use socket authentication. Answer Y only if a tool must log in as root with a password.
5

Answer the clean-up questions

Answer Y to Remove anonymous users?, Disallow root login remotely?, Remove test database and access to it? and Reload privilege tables now?.
On Ubuntu 24.04 the MariaDB package creates no anonymous users and no test database, so those steps report nothing to do. Running the script is still a quick check.

​
How to check it worked

List the accounts on the server:
You should see no row with an empty user, and root only with localhost:
On MySQL, run sudo mysql -e "SELECT user, host FROM mysql.user;".

​
What else should I do to secure MySQL?

Do not open port 3306 to everyone in your firewall. If a remote app needs the database, allow only that app’s IP address. See allow remote MySQL connections.

​
Frequently asked questions

​
Should I set a MySQL root password on Ubuntu?

You do not need to. Socket authentication means only someone who already has sudo on the server can log in as database root. Create a separate admin user with a password if a tool such as phpMyAdmin needs one.

​
Can I run mysql_secure_installation again later?

Yes. It is safe to run again. It only changes what you answer Y to.

​
What if I get locked out after setting a root password?

See reset the MySQL root password.

​
Does the script make remote connections secure?

No. It only removes root logins from other hosts. Remote access also needs a firewall rule limited to known IPs and, ideally, TLS or an SSH tunnel.

VPS and dedicated server guides

Every guide in this section.

Install MariaDB or MySQL

Get the server running first.

Create a database and user

Separate logins for each app.

Reset the root password

Recover a lost root login.

Linux server security checklist

Harden the rest of your server.
Checked against the official MariaDB documentation on 4 November 2026; MariaDB script prompts and the user check tested on Ubuntu 24.04 LTS with MariaDB 10.11. MySQL prompts checked in the Ubuntu 24.04 mysql-server 8.0 package. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026