MariaDB is a community-developed relational database management system and a drop-in replacement for MySQL. MariaDB 11.4 is a Long-Term Support (LTS) release maintained until May 2029, making it the right choice for production database workloads that need stability and extended security patches.
This guide walks through installing MariaDB 11.4 LTS on Debian 13 (Trixie) and Debian 12 (Bookworm) from the official MariaDB repository. We cover repository setup, secure installation, database and user creation, remote access configuration, firewall rules, and basic performance tuning.
Prerequisites
- A server running Debian 13 (Trixie) or Debian 12 (Bookworm)
- Root or sudo access
- At least 1 GB RAM (2 GB+ recommended for production)
- Internet access to download packages from the MariaDB repository
- Port 3306/TCP open if remote clients need to connect
Step 1: Update the System
Start by updating your package index and upgrading installed packages to their latest versions.
sudo apt update && sudo apt upgrade -yStep 2: Add the MariaDB 11.4 Repository on Debian
Debian’s default repositories ship an older MariaDB version. To install MariaDB 11.4 LTS, add the official MariaDB repository using the automated setup script.
Install the required dependencies first.
sudo apt install -y curl apt-transport-httpsDownload and run the MariaDB repository setup script, specifying version 11.4.
curl -LsS https://r.mariadb.com/downloads/mariadb_repo_setup | sudo bash -s -- --mariadb-server-version="mariadb-11.4"The script detects your Debian version automatically, imports the signing key, and creates the repository configuration. You should see confirmation that the repository was set up successfully:
[info] Repository file successfully written to /etc/apt/sources.list.d/mariadb.list
[info] Adding trusted keyUpdate the package index to pull metadata from the new repository.
sudo apt updateStep 3: Install MariaDB 11.4 on Debian 13 / Debian 12
Install the MariaDB server and client packages.
sudo apt install -y mariadb-server mariadb-clientMariaDB starts automatically after installation. Enable and verify the service.
sudo systemctl enable --now mariadbCheck that MariaDB is running.
sudo systemctl status mariadbThe output should show the service as active (running):
● mariadb.service - MariaDB 11.4 database server
Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; preset: enabled)
Active: active (running)
Docs: man:mariadbd(8)
https://mariadb.com/kb/en/library/systemd/Verify the installed version.
mariadb --versionThe version string confirms MariaDB 11.4 is installed:
mariadb Ver 15.1 Distrib 11.4.x-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapperStep 4: Secure MariaDB Installation
Run the security script to set a root password, remove anonymous users, disable remote root login, and drop the test database.
sudo mariadb-secure-installationAnswer the interactive prompts as follows:
Enter current password for root (enter for none): [Press Enter]
Switch to unix_socket authentication [Y/n]: n
Change the root password? [Y/n]: Y
New password: [Enter strong password]
Re-enter new password: [Confirm password]
Remove anonymous users? [Y/n]: Y
Disallow root login remotely? [Y/n]: Y
Remove test database and access to it? [Y/n]: Y
Reload privilege tables now? [Y/n]: YVerify you can log in with the root password you just set.
mariadb -u root -pYou should land at the MariaDB prompt:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 12
Server version: 11.4.x-MariaDB-1 Debian
MariaDB [(none)]>Type exit to leave the MariaDB shell.
Step 5: Create a Database and User in MariaDB
For most applications you need a dedicated database and a non-root user. Connect to MariaDB as root, then create them. If you run web applications with databases, you may also want to install phpMyAdmin on Debian for graphical database management.
mariadb -u root -pCreate a new database.
CREATE DATABASE appdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;Create a user and grant full privileges on the new database. Replace 192.168.1.% with your application server’s IP or subnet. Use localhost if the application runs on the same server.
CREATE USER 'appuser'@'192.168.1.%' IDENTIFIED BY 'StrongPassword123!';
GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'192.168.1.%';
FLUSH PRIVILEGES;Verify the user and grants were created correctly.
SHOW GRANTS FOR 'appuser'@'192.168.1.%';The output confirms the privileges assigned to the user:
+----------------------------------------------------------------------------------------------------------------------+
| Grants for [email protected].% |
+----------------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO `appuser`@`192.168.1.%` IDENTIFIED BY PASSWORD '*...' |
| GRANT ALL PRIVILEGES ON `appdb`.* TO `appuser`@`192.168.1.%` |
+----------------------------------------------------------------------------------------------------------------------+Type exit to leave the MariaDB shell.
Step 6: Configure MariaDB for Remote Access
By default MariaDB listens only on 127.0.0.1. To allow connections from remote hosts, change the bind address. For high-availability setups, consider configuring MariaDB replication on Debian or a MariaDB Galera Cluster with ProxySQL.
Open the MariaDB server configuration file.
sudo vi /etc/mysql/mariadb.conf.d/50-server.cnfFind the [mysqld] section and change the bind-address value. Set it to 0.0.0.0 to listen on all interfaces, or specify the server’s private IP for tighter control.
[mysqld]
bind-address = 0.0.0.0Restart MariaDB to apply the change.
sudo systemctl restart mariadbConfirm MariaDB is now listening on port 3306 on all interfaces.
ss -tlnp | grep 3306The output should show MariaDB listening on 0.0.0.0:3306:
LISTEN 0 80 0.0.0.0:3306 0.0.0.0:* users:(("mariadbd",pid=1234,fd=19))Step 7: Configure Firewall for MariaDB (Port 3306)
If you have a firewall running, open port 3306/TCP so remote clients can reach MariaDB. Restrict access to trusted networks only – never expose the database port to the public internet.
For UFW (default on Debian):
sudo ufw allow from 192.168.1.0/24 to any port 3306 proto tcp
sudo ufw reloadFor nftables (Debian 13 default):
sudo nft add rule inet filter input ip saddr 192.168.1.0/24 tcp dport 3306 acceptFor iptables:
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 3306 -j ACCEPTReplace 192.168.1.0/24 with your actual application server subnet.
Test remote connectivity from a client machine.
mariadb -u appuser -p -h 192.168.1.10 appdbStep 8: Basic MariaDB Performance Tuning
The default MariaDB configuration works for development but needs tuning for production. To keep track of database metrics over time, set up MariaDB monitoring with Prometheus.
Create a custom configuration file for your tuning parameters.
sudo vi /etc/mysql/mariadb.conf.d/99-custom.cnfAdd the following performance settings. Adjust innodb_buffer_pool_size based on your available RAM – set it to about 50-70% of total RAM on a dedicated database server.
[mysqld]
# InnoDB buffer pool - set to 50-70% of total RAM on dedicated DB servers
innodb_buffer_pool_size = 512M
# Log file size - larger values improve write performance
innodb_log_file_size = 256M
# Flush method - O_DIRECT avoids double buffering with the OS page cache
innodb_flush_method = O_DIRECT
# Flush logs once per second instead of every transaction (slight durability trade-off)
innodb_flush_log_at_trx_commit = 2
# Query cache is disabled by default in 11.4 - leave it off
# Use application-level caching (Redis, Memcached) instead
# Connection limits
max_connections = 200
# Temporary table size
tmp_table_size = 64M
max_heap_table_size = 64M
# Slow query log - enable to find unoptimized queries
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 2Restart MariaDB to apply the tuning changes.
sudo systemctl restart mariadbVerify the settings were applied by checking a key variable.
mariadb -u root -p -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size';"The output confirms the buffer pool is set to the configured value:
+-------------------------+-----------+
| Variable_name | Value |
+-------------------------+-----------+
| innodb_buffer_pool_size | 536870912 |
+-------------------------+-----------+Step 9: Manage MariaDB Service with systemctl
Common systemctl commands for managing MariaDB on Debian:
Start the service.
sudo systemctl start mariadbStop the service.
sudo systemctl stop mariadbRestart the service (apply config changes).
sudo systemctl restart mariadbEnable MariaDB to start at boot.
sudo systemctl enable mariadbCheck the service status.
sudo systemctl status mariadbConclusion
MariaDB 11.4 LTS is installed and running on your Debian 13 or Debian 12 server with a secured root account, a dedicated database and user, remote access configured, and firewall rules in place. The performance tuning gives you a solid starting point for production workloads.
For production hardening, enable SSL/TLS encryption for client connections, set up automated backups with mariadb-dump or mariadb-backup, and configure monitoring to track query performance, replication lag, and resource usage.
