Secure a MySQL or MariaDB database on a Linux VPS in layers: remove default accounts, create narrowly scoped users, keep port 3306 off the public internet, encrypt connections that leave the host, confine the database service and its files, log activity, patch regularly, and test backups by restoring them. The exact commands and defaults depend on the installed product and release, so identify the version first and verify each setting after applying it.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start with a version and exposure inventory
MySQL and MariaDB share much of their SQL syntax but do not have identical defaults, plugins, privilege requirements, or configuration behavior. Do not copy a hardening snippet written for one product into the other without checking the installed release.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Record the database and operating-system versions. From an administrative SQL session, run
SELECT VERSION();. Record whether the server is MySQL or MariaDB, its major and minor release, the Linux distribution, and whether the service is managed by systemd. - Map the application path. Decide whether every client runs on this VPS, whether a separate application server connects over a private network, and which administrators need interactive access. A database used only by local applications should not listen on a public interface.
- List current listeners and firewall rules. Confirm which address and port the daemon actually uses, then compare that with the VPS provider’s network firewall and the host firewall. A closed provider firewall does not compensate for an unnecessarily broad database bind, and changing 3306 to another port is not access control.
- Identify data and log locations. Include the data directory, error and query logs, binary logs, TLS private keys, and backup directories in the permissions review. Treat each as sensitive database material.
Keep this inventory with your change records. It gives you a baseline for later reviews and makes it easier to detect a package upgrade that changes a default.
Remove default access with the secure-installation tool
Run the packaged hardening utility immediately after installation and again when you inherit an existing server whose initial setup is uncertain. On MariaDB systems the current command is usually mariadb-secure-installation; installations that retain the older client naming may provide mysql_secure_installation.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Read each prompt rather than accepting every default blindly. The cleanup should produce four outcomes:
- Anonymous accounts are removed.
- The test database and its broadly accessible privileges are removed.
- Remote root login is disallowed.
- Privilege tables are reloaded so the changes take effect.
The utility does not replace a full review. It cannot decide which application permissions are legitimate, whether a firewall rule is too broad, or whether TLS is required for a particular account. After it finishes, log in locally with the administrative account and inspect the remaining users.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →SELECT User, Host, plugin FROM mysql.user ORDER BY User, Host;Do not use the database superuser in application configuration, scripts, cron jobs, or monitoring agents. Create a separate administrative identity for human maintenance and an individual account for each application or service.
Build least-privilege accounts
Create an account for one application
Choose the database and statements the application actually needs, then grant only those privileges. Use a host value that describes the real source rather than a wildcard.
CREATE USER 'app_runtime'@'localhost' IDENTIFIED BY 'use-a-long-random-secret';
GRANT SELECT, INSERT, UPDATE, DELETE
ON app_database.* TO 'app_runtime'@'localhost';
SHOW GRANTS FOR 'app_runtime'@'localhost';If the application server is separate, replace localhost with its specific private address or a narrowly defined private subnet that you control. Avoid '%' unless there is a documented, unavoidable reason and compensating network controls.
Separate read-only, migration, and backup identities
A reporting service may need only SELECT. A schema-migration account may need temporary definition-changing privileges but should not be stored in the running application’s connection string. A backup identity should be used only by the backup process and should have the version-appropriate privileges required by mariadb-backup or the chosen MySQL backup method.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDo not grant ALL PRIVILEGES as a shortcut. Granting a broad set makes an application compromise equivalent to a database takeover and makes later review difficult. Revoke permissions that are no longer justified, then verify the effective result:
REVOKE ALL PRIVILEGES, GRANT OPTION
FROM 'app_runtime'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE
ON app_database.* TO 'app_runtime'@'localhost';
SHOW GRANTS FOR 'app_runtime'@'localhost';Use the revoke example only when you intend to rebuild that account’s permissions; test the application’s required operations first in a staging environment.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Pay special attention to high-impact privileges
| Privilege or capability | Why it needs scrutiny | Safer practice |
|---|---|---|
FILE |
Can allow reads or writes through the database server process, creating a path to files outside normal application tables. | Omit it from runtime accounts; grant only for a narrowly documented administrative task. |
PROCESS |
Exposes information about server processes and activity that ordinary users do not need. | Reserve it for operators and monitoring identities that demonstrably require it. |
SUPER and equivalent administrative or dynamic privileges |
Can change server behavior or bypass restrictions, depending on product and release. | Keep them out of application accounts and review each dynamic privilege separately. |
| Replication, plugin, and account-management privileges | Can expose data, load code, or alter authentication and replication behavior. | Issue only to dedicated operators, with host restrictions and a change record. |
Privilege names and dynamic-privilege behavior differ between MySQL and MariaDB releases. Use SHOW GRANTS and the installed product’s privilege reference instead of assuming that an identically named permission has identical effects.
Keep the database off the public network
Local-only deployment
When the web application and database share one VPS, bind the server to the loopback address 127.0.0.1. Set the bind option in the active MySQL or MariaDB configuration, restart the service during a maintenance window, and confirm that it is listening only where intended. Also ensure that local accounts use local host values rather than a wildcard.
Separate application tier
If an application server must connect remotely, bind the database to the required private interface, not to every interface. Permit TCP 3306 only from the application’s private address or controlled subnet in both layers of filtering available to you:
- The VPS or cloud-provider network firewall.
- The Linux host firewall.
Allow administration from a controlled management network or through an authenticated tunnel rather than opening database access to the internet. Document every source address and remove rules when a server is retired.
Verify the result
- Inspect the listening socket with the Linux socket utility available on your distribution.
- From an untrusted network, confirm that the public address does not accept a database connection.
- From the approved private source, confirm that the application can connect.
- Check the database error log after the restart for bind or permission failures.
A nonstandard port can reduce casual scanning noise, but it does not replace binding, firewalling, authentication, or TLS.
Encrypt connections that cross an untrusted network
TLS protects credentials and query results from interception and man-in-the-middle attacks while clients communicate with the server. It is essential when a connection leaves the VPS or traverses a network you do not fully control. Local loopback traffic has a different threat model, but enforcing TLS consistently can simplify policy and prevent an accidental future exposure.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Configure certificates and keys
Install a server certificate, its private key, and the trusted certificate authority material in a directory readable by the database service and authorized administrators only. Ensure the private key is not readable by ordinary users or application processes that do not need it. Configure the server’s TLS options in the active product configuration, restart if required, and watch the error log for certificate, key, or permission errors.
MariaDB TLS defaults and account requirements have changed across releases. MySQL and MariaDB also use different option names in some versions. Check the exact installed version before applying a configuration example and record the certificate expiry date so renewal does not become an outage.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Require TLS for sensitive accounts
For accounts that connect over a network, add an account-level requirement where the installed release supports it:
ALTER USER 'app_runtime'@'10.20.30.15' REQUIRE SSL;Use the syntax supported by your product and release; if the account already has authentication or resource clauses, preserve them when altering it. A server configured with certificates is not proof that every client uses encryption. Test a real application session and inspect its negotiated state using the client diagnostics or a session-status query supported by your release, such as:
Free tools Windows power users keep installed
One-click scans. No signup required.
SHOW SESSION STATUS LIKE 'Ssl_cipher';An empty result or an unencrypted client connection requires investigation before treating the deployment as protected. Where supported and operationally appropriate, evaluate a server-wide secure-transport requirement so non-TLS remote sessions are refused rather than merely discouraged.
Constrain the Linux service and its files
Use a dedicated Unix service account
Never run mysqld or mariadbd as Unix root. The database daemon should run under its dedicated service account, with only the capabilities needed to read and write its own data and logs. Confirm the effective user in the service definition and in the running process list after installation or an upgrade.
Set ownership and permissions deliberately
- Database files should be owned by the database service account and inaccessible to ordinary users.
- Log files, binary logs, relay logs, and temporary export files may contain sensitive data; restrict them to the service account and authorized administrators.
- TLS private keys must be protected more tightly than public certificates.
- Backup directories must not be web-accessible or writable by the application account.
Do not solve a startup error by making the entire data directory world-readable or world-writable. Find the exact path the service needs and correct its owner, group, or mode.
Use mandatory access controls
Where available, keep SELinux or AppArmor enabled and use the distribution’s MySQL or MariaDB profile. If you move data, logs, sockets, or backup paths, update the profile deliberately and test in a maintenance window. A profile that is silently disabled removes an important defense against a compromised database process.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDisable or review risky features
Turn off local file loading unless required
Disable LOCAL INFILE on the server and clients when the application does not need it. File-loading features can turn an otherwise limited database credential into a path for unintended local-file access or data movement. If a controlled import requires the feature, enable it only for that workflow, restrict the account and source, and disable it afterward where practical.
Review plugins and dynamic privileges
List installed authentication, audit, encryption, and other plugins. Remove unused components and verify that each remaining plugin comes from a trusted package source and is compatible with the installed release. Review dynamic privileges, replication permissions, FILE, PROCESS, and SUPER during every access review. A privilege that was harmless for an old release may have broader effect after an upgrade.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Protect administrative interfaces
Keep administrative sockets, local command-line clients, and maintenance scripts accessible only to authorized operators. Do not place administrative passwords in world-readable configuration files, source repositories, shell history, or tickets. Prefer a secret-management mechanism appropriate to your environment and rotate credentials when staff, applications, or hosts change.
Log, audit, and protect the evidence
Logging supports detection and recovery, but logs can also contain credentials, query parameters, personal data, and schema details. Enable only the logging needed for operations and investigations, then protect the output.
- Error logs: record startup failures, crashes, authentication problems, and storage issues.
- Connection and authentication events: help identify repeated failures, unexpected source addresses, and account misuse.
- Slow-query logs: expose performance regressions and expensive statements without recording every successful query.
- General or query logging: use for a defined diagnostic or investigative period when its volume and data sensitivity are acceptable.
- Audit logging: use a supported audit plugin when you need durable records of account, privilege, or data-access events beyond ordinary logs.
Restrict log files, rotate them before disks fill, and send copies to a protected system when your operational design permits. Protect exported logs from tampering and define retention based on legal, security, and troubleshooting needs. If binary logs are used for recovery or replication, evaluate encryption at rest; MariaDB documents an encrypt_binlog control whose availability and behavior are release-dependent.
After enabling a control, generate a known test event and verify that it appears in the expected log. A setting that is present in a configuration file but inactive in the running server provides no evidence.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Patch the operating system and database
Keep the Linux distribution, database server, client libraries, authentication plugins, and TLS libraries on supported releases. Subscribe to the vendor security-advisory process, track relevant CVEs, and test updates before deploying them to production when your change process allows.
For every update, check:
- Whether authentication defaults or account plugins changed.
- Whether the active configuration file and option names changed.
- Whether a plugin, audit component, or backup utility remains compatible.
- Whether the service still binds only to the intended interface.
- Whether SELinux or AppArmor continues to enforce the profile.
- Whether TLS certificates, key permissions, logs, and backups still work.
Do not treat the MySQL 5.7 Secure Deployment Guide as a statement of current support status. Its least-privilege, host-firewall, and operating-system-confinement principles remain useful, but commands and supported settings must be checked against current product documentation and your installed release.
Create protected backups and prove that recovery works
Use a dedicated backup identity
Do not give the backup scheduler the application’s password or a full administrative account. Create a backup identity with the privileges required by the version-appropriate backup utility. MariaDB’s mariadb-backup privilege requirements vary by release, so confirm them for the exact server version before granting access.
Keep the backup account’s host restriction narrow, store its credential outside application source code, and revoke permissions if the backup job is retired.
Protect backup copies
- Write backups to a directory unavailable to the web server and application runtime.
- Encrypt backups before they leave the VPS or store them in an encrypted destination.
- Use separate credentials and access controls for backup operators and database operators.
- Keep copies separate from the VPS so a host compromise or disk failure does not destroy both database and backup.
- Log backup success, size, duration, and retention actions without exposing secrets.
Run restoration drills
A successful backup command proves only that files were produced. Periodically restore into an isolated server, start the restored database, verify application-critical tables and permissions, and measure how long recovery takes. Include the TLS material, users, grants, configuration, and encryption keys required to make the restored data usable. Correct any failure while the original system is still operating.
Recommended Free Tools
MySQL and MariaDB: what must be checked separately
| Control area | Why the product distinction matters | Verification action |
|---|---|---|
| Secure-installation command | MariaDB commonly uses mariadb-secure-installation; some installations retain mysql_secure_installation. |
Run the command supplied by the installed package and confirm its prompts and resulting accounts. |
| Authentication and root defaults | Root authentication plugins and initial access behavior can differ by product and release. | Inspect the root account’s host, plugin, and login path before changing it. |
| Bind and package configuration | Configuration file locations and active include files vary by distribution and package. | Identify the file actually read by the running service, then verify the listener after restart. |
| TLS defaults and account requirements | MariaDB documents release-dependent changes in TLS behavior; option names and defaults are not universal. | Check the installed version, configure certificates, require TLS where supported, and verify a live session. |
| Encryption and key management | At-rest, binary-log, and key-management features differ in availability and configuration. | Confirm the feature exists in the installed release and test key access during startup and recovery. |
| Audit and logging plugins | Plugin names, event coverage, and packaging differ. | Record the plugin and events enabled, then generate a test event and verify protected log output. |
| Backup utility and privileges | mariadb-backup requirements vary by MariaDB release and are not interchangeable with every MySQL workflow. |
Use the utility’s version-specific privilege guidance and complete a restoration drill. |
| SELinux or AppArmor integration | Profiles and policy paths are distribution-specific. | Keep the supplied profile enforcing and test any moved data, log, or backup path. |
| Support and CVE lifecycle | Vendor release and support schedules are different. | Track advisories for the exact product branch rather than relying on the other vendor’s notices. |
Verify the finished configuration
Use this acceptance checklist after initial hardening, a migration, or a major upgrade:
- The secure-installation utility has removed anonymous users and the test database, remote root login is disabled, and privilege tables have been reloaded.
- Every application has a separate account with a specific host and the smallest tested privilege set;
SHOW GRANTSoutput is recorded. - The daemon listens on loopback or the required private interface only; firewall rules allow 3306 solely from approved sources.
- Remote sessions that need protection negotiate TLS, and sensitive accounts enforce it where the release supports account-level requirements.
- The service runs as its dedicated Unix account, never Unix
root; database, log, key, and backup permissions have been checked. - SELinux or AppArmor remains enforcing and allows only intended paths.
LOCAL INFILE, file access, process inspection, administrative, replication, plugin, and dynamic privileges have documented owners.- Error, connection, slow-query, and required audit events are logged, rotated, access-controlled, and monitored.
- The OS and database are patched on a supported branch, with vendor CVE tracking.
- Backups are encrypted or otherwise protected, stored separately, and have passed a recent restoration test.
Troubleshoot common hardening failures
The application cannot connect after binding to localhost
The application may be on another host, or it may be using an account whose host value no longer matches the connection source. Confirm the application topology, listener address, firewall path, and User/Host row. If the application is remote, use its private address and a narrowly scoped rule rather than reverting to a public wildcard bind.
A TLS connection fails after certificate installation
Check that the daemon can read the private key, the certificate matches the server name expected by the client, the certificate chain is trusted, and the configured option names match the installed product and release. Read the database error log and test with the same client library used by the application.
A backup job reports permission errors
Do not grant broad administrative privileges immediately. Confirm the exact database version, the backup utility version, the backup account’s host and grants, and the filesystem permissions on the destination. Grant only the documented missing capability, then repeat a restore test.
The service will not start after moving data or logs
Check ownership and modes, the active configuration include file, disk space, and SELinux or AppArmor denials. Restore the previous path only as a controlled rollback; do not disable mandatory access controls or make the directory world-writable as a permanent fix.
How often to review the controls
Repeat the account, grant, listener, firewall, TLS, plugin, and filesystem review after every application onboarding, administrator change, database upgrade, network redesign, or incident. At a fixed interval, expire unused accounts, remove obsolete firewall sources, rotate credentials and certificates, inspect logs for unexpected hosts, and perform a backup restoration. Security is maintained by these recurring checks, not by a one-time run of the secure-installation command.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
