> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Secure MySQL and MariaDB (mysql_secure_installation)

> Run sudo mysql_secure_installation or mariadb-secure-installation to remove anonymous users, block remote root and drop the test database, then lock access.

To secure a new MySQL or MariaDB server, run `sudo mysql_secure_installation` (MySQL) or `sudo mariadb-secure-installation` (MariaDB) and answer **Y** to removing anonymous users, disallowing remote root login, removing the test database and reloading privileges. Then keep the server listening on `127.0.0.1`, give each app its own user, and back up your data.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 5 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux / Rocky 9 / 10 | sudo or root access, MySQL or MariaDB installed |

## Before you start

* Install the server first. See [install MariaDB or MySQL](https://help.freakhosting.com/portals/other/how-to-install-mysql-or-mariadb.md).
* Run the commands with `sudo`. If you are logged in as `root`, leave out `sudo`.
* If you will set a root password, have a password manager ready to store it.

## What does mysql\_secure\_installation do?

It is an interactive script that ships with the server. According to the [MariaDB documentation](https://mariadb.com/docs/server/clients-and-utilities/deployment-tools/mariadb-secure-installation), it lets you:

* set a password for root accounts
* remove root accounts that can be reached from outside the server
* remove anonymous (nameless) user accounts
* remove the `test` database, which anonymous users can open by default

On MariaDB the script is called `mariadb-secure-installation`. The old name `mysql_secure_installation` still works through a link.

## How to run the secure installation script

> [tab] MariaDB
>
> **1. Start the script**
>
> ```bash theme={null}
> sudo mariadb-secure-installation
> ```
>
> **2. Current root password**
>
> At `Enter current password for root (enter for none):` press **Enter**. A fresh install has no root password.
>
> **3. Socket authentication**
>
> At `Switch to unix_socket authentication [Y/n]` or `Enable unix_socket authentication? [Y/n]` answer **Y**. Root then logs in only through `sudo mariadb` on the server itself, with no password to guess.
>
> **4. Root password**
>
> At `Change the root password? [Y/n]` answer **n** if you use socket authentication. Answer **Y** only if a tool must log in as root with a password.
>
> **5. Answer the clean-up questions**
>
> Answer **Y** to `Remove anonymous users?`, `Disallow root login remotely?`, `Remove test database and access to it?` and `Reload privilege tables now?`.

> [tab] MySQL
>
> **1. Start the script**
>
> ```bash theme={null}
> sudo mysql_secure_installation
> ```
>
> **2. Password validation**
>
> The script asks whether to set up the **VALIDATE PASSWORD component**. Answer **Y** to reject weak passwords, then choose a strength level.
>
> **3. Root password**
>
> On Ubuntu, root uses `auth_socket`, so the script skips the root password. On AlmaLinux and Rocky, set a strong root password when asked.
>
> **4. Answer the clean-up questions**
>
> Press **y** for `Remove anonymous users?`, `Disallow root login remotely?`, `Remove test database and access to it?` and `Reload privilege tables now?`.

> [!NOTE]
>
> On Ubuntu 24.04 the MariaDB package creates no anonymous users and no `test` database, so those steps report nothing to do. Running the script is still a quick check.

## How to check it worked

List the accounts on the server:

```bash theme={null}
sudo mariadb -e "SELECT user, host FROM mysql.user;"
```

You should see no row with an empty `user`, and `root` only with `localhost`:

```text theme={null}
+-------------+-----------+
| User        | Host      |
+-------------+-----------+
| mariadb.sys | localhost |
| mysql       | localhost |
| root        | localhost |
+-------------+-----------+
```

On MySQL, run `sudo mysql -e "SELECT user, host FROM mysql.user;"`.

## What else should I do to secure MySQL?

| Step | Why | How |
| - | - | - |
| Keep it on localhost | Bots scan port `3306` all day | Leave `bind-address = 127.0.0.1` unless another server needs access |
| One user per app | A hacked app can only reach its own data | [Create a database and user](https://help.freakhosting.com/portals/other/how-to-create-a-mysql-database-and-user.md) |
| Least privilege | Read-only tools do not need write rights | Grant `SELECT` only where that is enough |
| Firewall | Blocks anything you open by mistake | [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) or [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md) |
| Backups | Lets you recover from mistakes and attacks | [Back up MySQL databases](https://help.freakhosting.com/portals/other/how-to-back-up-and-restore-mysql-databases.md) |
| Updates | Security fixes arrive as package updates | [Enable automatic security updates](https://help.freakhosting.com/portals/other/how-to-enable-automatic-security-updates.md) |
| Use SSH for admin tools | Nothing is exposed to the internet | Connect over an [SSH tunnel with HeidiSQL](https://help.freakhosting.com/portals/other/how-to-connect-to-database-using-heidisql.md) |

> [!WARNING]
>
> Do not open port `3306` to everyone in your firewall. If a remote app needs the database, allow only that app's IP address. See [allow remote MySQL connections](https://help.freakhosting.com/portals/other/how-to-allow-remote-mysql-connections.md).

## Frequently asked questions

### Should I set a MySQL root password on Ubuntu?

You do not need to. Socket authentication means only someone who already has `sudo` on the server can log in as database root. Create a separate admin user with a password if a tool such as phpMyAdmin needs one.

### Can I run mysql\_secure\_installation again later?

Yes. It is safe to run again. It only changes what you answer **Y** to.

### What if I get locked out after setting a root password?

See [reset the MySQL root password](https://help.freakhosting.com/portals/other/how-to-reset-the-mysql-root-password.md).

### Does the script make remote connections secure?

No. It only removes root logins from other hosts. Remote access also needs a firewall rule limited to known IPs and, ideally, TLS or an SSH tunnel.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Install MariaDB or MySQL](https://help.freakhosting.com/portals/other/how-to-install-mysql-or-mariadb.md)
>
> Get the server running first.

> [card] [Create a database and user](https://help.freakhosting.com/portals/other/how-to-create-a-mysql-database-and-user.md)
>
> Separate logins for each app.

> [card] [Reset the root password](https://help.freakhosting.com/portals/other/how-to-reset-the-mysql-root-password.md)
>
> Recover a lost root login.

> [card] [Linux server security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

***

> [!NOTE]
>
> **Checked against the official [MariaDB documentation](https://mariadb.com/docs/server/clients-and-utilities/deployment-tools/mariadb-secure-installation)** on 4 November 2026; MariaDB script prompts and the user check tested on Ubuntu 24.04 LTS with MariaDB 10.11. MySQL prompts checked in the Ubuntu 24.04 `mysql-server` 8.0 package. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.