How to Install MariaDB on an Ubuntu Linux VPS

Two decisions determine how a MariaDB install turns out on a fresh Ubuntu VPS: which repository the packages come from, and whether the post-install hardening script actually gets run. Skip either one and you end up with a database that's either years out of date or wide open by default. This guide covers both paths — installing from Ubuntu's own archive versus adding MariaDB's official repository — and walks through mariadb-secure-installation end to end.

Which MariaDB You'll Actually Get

MariaDB's release model runs three tracks at once: a long-term-stable series maintained for three years, a rolling release that gets new features on a shorter cycle, and a development preview series. As of this writing, MariaDB's community server release notes name MariaDB 12.3 as the current long-term-stable series, with MariaDB 13.0 as the current rolling release and MariaDB 13.1 in development preview. The latest stable point release in the LTS series is 12.3.2, published 2026-05-29 according to the Foundation's all-releases listing.

None of that is what apt install mariadb-server gives you on a stock Ubuntu VPS, though. Ubuntu packages MariaDB on its own release cadence, not MariaDB's — Ubuntu 24.04 LTS ("Noble Numbat") currently ships MariaDB 10.11.13, and Ubuntu 22.04 LTS ("Jammy Jellyfish") ships MariaDB 10.6.22 — both several major versions behind the current 12.3 LTS line. MariaDB's own download page states this plainly: the Foundation only provides packages for MariaDB versions newer than whatever version your distribution already ships. That's the choice at the center of this guide.

If you don't have a specific reason to run the newer release — an application that requires a feature only in the 12.x line, say — Ubuntu's bundled version is a perfectly reasonable, well-tested choice with security patches flowing through your normal apt upgrade cycle. If you want the current LTS release and a fresh three-year support runway starting today, add MariaDB's own repository instead.

Option A: Installing from Ubuntu's Own Repository

This is the fastest path, and it's the right one if the distro-bundled version is good enough for what you're running. Update your package index and install the server and client together:

1sudo apt update
2sudo apt install mariadb-server mariadb-client

Apt pulls in mariadb-common and the relevant client libraries as dependencies automatically. Once it finishes, confirm the service is active and set it to survive a reboot:

1sudo systemctl status mariadb
2sudo systemctl enable mariadb

Check the version you actually got with:

1mariadb --version

That's the whole install. Skip ahead to the securing section below — you don't need Option B unless you specifically want the newer release.

Option B: Installing MariaDB's Current Release from the Official Repository

To get the current 12.3 LTS line instead of whatever Ubuntu bundled, add MariaDB's own apt repository first. MariaDB's package repository documentation describes two ways to do this: a hosted mariadb_repo_setup shell script, or the Foundation's web-based repository configuration tool, which asks for your distribution and desired version and hands back the exact commands to run. The script is the more direct route from a terminal.

First, install the two prerequisites the script needs:

1sudo apt update
2sudo apt install curl apt-transport-https

Download the script and make it executable:

1curl -LsSO https://r.mariadb.com/downloads/mariadb_repo_setup
2chmod +x mariadb_repo_setup

Then run it as root:

1sudo ./mariadb_repo_setup

By default, the script configures the repository for the latest stable MariaDB release, writes the repository configuration file under /etc/apt/sources.list.d/, imports the GPG signing key used to verify MariaDB's packages, and refreshes the package cache — all in one pass. If you'd rather pin a specific release series instead of taking whatever's current, pass --mariadb-server-version="mariadb-<series>" — for example --mariadb-server-version="mariadb-11.8" targets the 11.8 series specifically. With the repository in place, install the server:

1sudo apt update
2sudo apt install mariadb-server mariadb-client mariadb-backup

Apt now resolves mariadb-server against MariaDB's own repository rather than Ubuntu's, because the setup script also writes a package-preference file that gives MariaDB's repository priority over the OS archive. Confirm the version landed correctly:

1mariadb --version
2sudo systemctl status mariadb
3sudo systemctl enable mariadb

Securing the Installation with mariadb-secure-installation

Regardless of which path you took, run the hardening script before anything else touches this database. It ships with the server package under both its current name and its long-standing alias:

1sudo mariadb-secure-installation

(mysql_secure_installation still works too — it's kept as a symlink to the same script.) One thing worth knowing before you run it: as of MariaDB 10.4, new installs authenticate the root account through the unix_socket plugin by default, meaning root login is tied to your OS login rather than a stored password — so on a fresh install there's usually no root password to set in the first place, and the script's password prompt exists mainly for older or already-configured installs.

The script walks through five prompts in order:

1. Current root password. On a fresh install, press Enter for none.
2. Set a root password? Optional given the unix_socket default above, but not harmful to set — answer per your own policy.
3. Remove anonymous users? Answer yes. The anonymous account exists purely to smooth over first-time testing and has no place on a production VPS.
4. Disallow root login remotely? Answer yes, so root can only connect from the local machine rather than being guessable over the network.
5. Remove the test database? Answer yes — it's readable by anonymous users by default and serves no purpose once you're past evaluating the install.

The script finishes by reloading the privilege tables so every change takes effect immediately, with no service restart required. Run it once, right after install, and you've closed off the handful of defaults that shouldn't survive into production.

A Quick Sanity Check

With the hardening done, connect and confirm the server behaves the way you expect. Because of the unix_socket default covered above, connecting as your Linux root user from the VPS itself needs no password:

1sudo mariadb

From that prompt, create a dedicated database and a scoped user for whatever application will actually use this server, rather than handing out root access to anything that connects:

1CREATE DATABASE appdata;
2CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'a-strong-password-here';
3GRANT ALL PRIVILEGES ON appdata.* TO 'appuser'@'localhost';
4FLUSH PRIVILEGES;

Restricting the user to localhost — rather than % for any host — keeps the database reachable only from processes running on the same VPS unless you deliberately open it up later, which is the right default for most single-server setups.

Two Paths, One Secure Install

Ubuntu's bundled MariaDB and MariaDB's own repository both get you a working server; the difference is entirely about which version lands on disk and how current it stays going forward. Take the distro package for simplicity and let apt upgrade handle it, or add the official repository when you specifically want the current 12.3 LTS line and a fresh support window. Whichever route you take, mariadb-secure-installation is the step that turns "a database is running" into "a database is running safely" — run it before anything else touches the server.

References

• MariaDB Package Repository Setup and Usage
• mariadb-secure-installation documentation
• MariaDB Server — All Releases
• Ubuntu package details: mariadb-server (24.04 "Noble")