Kunnskapsbase

This guide covers installing and securing MariaDB (the default database in RHEL-family repositories) on AlmaLinux or Rocky Linux, with notes on installing MySQL directly if preferred.

Prerequisites

• AlmaLinux 9 or Rocky Linux 9 VPS
• Root or sudo access

Installing MariaDB (Default, Recommended)

Step 1 — Install

sudo dnf install mariadb-server -y

Step 2 — Enable and Start

sudo systemctl enable --now mariadb

Step 3 — Secure the Installation

sudo mysql_secure_installation

Set a strong root password, remove anonymous users, disable remote root login, remove the test database, and reload privileges.

Step 4 — Log In and Create a Database

sudo mysql -u root -p

CREATE DATABASE myapp;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'CHANGE_ME_STRONG_PASSWORD';
GRANT ALL PRIVILEGES ON myapp.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Installing MySQL Instead of MariaDB

If you specifically need Oracle MySQL rather than MariaDB:

sudo dnf install https://dev.mysql.com/get/mysql80-community-release-el9-1.noarch.rpm -y
sudo dnf install mysql-community-server -y
sudo systemctl enable --now mysqld

MySQL's initial root password is generated automatically:

sudo grep 'temporary password' /var/log/mysqld.log

mysql -u root -p

ALTER USER 'root'@'localhost' IDENTIFIED BY 'CHANGE_ME_NEW_STRONG_PASSWORD';

Allowing Remote Connections (If Needed)

sudo firewall-cmd --permanent --add-service=mysql
sudo firewall-cmd --reload

Only do this if remote access is genuinely required, and restrict by source IP if possible:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="YOUR_APP_SERVER_IP" service name="mysql" accept'
sudo firewall-cmd --reload

SELinux Considerations

If storing database files in a non-default location:

sudo semanage fcontext -a -t mysqld_db_t "/custom/mysql/path(/.*)?"
sudo restorecon -Rv /custom/mysql/path

Verifying the Installation

mysql --version
sudo systemctl status mariadb

Common Errors

MariaDB won't start:

sudo journalctl -u mariadb -n 50

"Access denied" despite correct credentials — verify mysql_secure_installation completed successfully and FLUSH PRIVILEGES was run after any manual grant.

Remote connection blocked despite firewall rule — confirm MariaDB's bind-address setting in /etc/my.cnf.d/mariadb-server.cnf isn't restricted to 127.0.0.1 only.

Best Practices

• Never use the root database account for application connections
• Restrict remote database access to specific trusted IPs via firewalld rich rules
• Follow the same backup practices covered in How to Back Up and Restore MySQL/MariaDB Databases

Continue Reading

• How to Configure firewalld on AlmaLinux/Rocky Linux
• How to Back Up and Restore MySQL/MariaDB Databases
• Database Security Checklist: Protecting MySQL, PostgreSQL & MongoDB

Browse more articles in AlmaLinux & Rocky Linux.