Databases hold your application's most sensitive data, making them a high-value target. This checklist covers the essential security measures across MySQL/MariaDB, PostgreSQL, and MongoDB.
1. Never Expose Database Ports to the Public Internet
sudo ufw deny 3306/tcp
sudo ufw deny 5432/tcp
sudo ufw deny 27017/tcpIf remote access is genuinely needed, restrict it to specific trusted IPs only:
sudo ufw allow from YOUR_TRUSTED_IP to any port 33062. Never Use Default/Root Accounts for Applications
Create a dedicated user per application with only the privileges it actually needs — see the install guides for MySQL, PostgreSQL, and MongoDB for exact commands.
3. Use Strong, Unique Passwords
Never reuse the same password across the database and other services; use a password manager to generate and store strong, unique credentials per environment.
4. Enable Authentication Everywhere
MongoDB in particular defaults to no authentication — enable it immediately after installation (see How to Install MongoDB on Ubuntu & Debian).
5. Run mysql_secure_installation / mariadb-secure-installation
Removes anonymous users, disables remote root login, and removes the test database.
6. Grant Minimal Privileges
GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'appuser'@'localhost';Avoid GRANT ALL PRIVILEGES unless the account genuinely requires full administrative control.
7. Keep Database Software Updated
Security patches for database engines are released regularly — see How to Update and Upgrade Your Ubuntu or Debian VPS.
8. Enable Encrypted Connections (TLS) for Remote Access
If your application connects to a database over a network (not localhost), enable TLS/SSL for that connection rather than sending credentials and data in plaintext.
9. Encrypt Backups Containing Sensitive Data
gpg -c myapp-backup.sql.gzEspecially important before transferring backups off-site.
10. Monitor for Unusual Activity
Enable and periodically review the general/slow query log for unexpected queries, and combine with auth log monitoring at the OS level (see How to Monitor Auth Logs and Detect Intrusion Attempts).
11. Disable Unused Features
For MongoDB, ensure the server binds only to 127.0.0.1 unless remote access is explicitly required. For Redis, disable dangerous commands like FLUSHALL in production if not needed.
12. Automate and Test Backups
See How to Back Up and Restore MySQL/MariaDB Databases and How to Back Up and Restore PostgreSQL Databases — a compromised or corrupted database without a tested backup is a worst-case scenario.
Quick Reference Checklist
- Database ports not publicly exposed
- No application connects using the root/admin account
- Authentication enabled on every database engine, including MongoDB and Redis
- Passwords are strong and unique per environment
- Database software receives regular updates
- Automated, tested backups exist and are stored off-server
FAQ
Is localhost-only access enough security on its own?
It significantly reduces exposure, but should still be combined with strong authentication, minimal privileges, and regular updates — defense in depth, not a single control.
Related Articles
- VPS Security Checklist for Beginners
- How to Configure UFW Firewall on a Linux VPS
- How to Set Up Automated VPS Backups (rsync, cron & Off-Site Storage)
