How to install MariaDB on AlmaLinux and Rocky Linux

MariaDB is the default MySQL-compatible database on AlmaLinux and Rocky Linux, and it runs WordPress and most PHP apps without changes. This guide installs it with dnf, shows how to get a newer release from the official MariaDB repository, secures the install and covers the SELinux settings that trip people up.

Before you start

• A Linux VPS running AlmaLinux or Rocky Linux 8 or 9.
• A user with sudo rights, connected over SSH. The login details are in your VPS provider's control panel.
• No MySQL server already installed. MySQL and MariaDB use the same port and data folder, so install only one.

Update the system first:

sudo dnf update -y

Option 1: install from AppStream

The AppStream repository that ships with the OS includes MariaDB. Check which version it offers:

dnf info mariadb-server

On version 8, MariaDB is split into module streams. List them to see your choices:

sudo dnf module list mariadb

To use a stream other than the default, enable it before installing, for example sudo dnf module enable mariadb:10.11, using a stream from your list. Then install:

sudo dnf install mariadb-server

AppStream versions receive security fixes for the life of the OS release, which makes this the low-maintenance choice.

Option 2: install from the official MariaDB repository

Use this when your app needs a newer release series than AppStream offers. MariaDB provides a setup script that adds its repository.

1. Download the script and look at it before running it:

   curl -LsSO https://r.mariadb.com/downloads/mariadb_repo_setup
   less mariadb_repo_setup

The MariaDB download page publishes a checksum for the script. Compare it with sha256sum mariadb_repo_setup if you want to be sure the file is genuine.

1. Run it with the release series you want. The series below is an example; pick a current long-term support release from mariadb.org:

   chmod +x mariadb_repo_setup
   sudo ./mariadb_repo_setup --mariadb-server-version="mariadb-11.4"

1. On version 8 only, stop the AppStream module from competing with the new repository:

   sudo dnf module disable mariadb

1. Install the server. Packages from this repository use capital letters:

   sudo dnf install MariaDB-server MariaDB-client

Start and enable the service

The service is called mariadb for both options:

sudo systemctl enable --now mariadb
systemctl status mariadb

You should see active (running). enable --now starts it immediately and at every boot.

Secure the install

Run the hardening script that ships with MariaDB:

sudo mariadb-secure-installation

On older releases the script is called mysql_secure_installation. Both do the same job. Answer the prompts:

• Enter current password for root: press Enter, as there is none yet.
• Switch to unix_socket authentication: yes is a safe choice. Root can then only log in from a sudo shell.
• Change the root password: optional if you use unix_socket. If you set one, choose your own long, unique password.
• Remove anonymous users, disallow root login remotely, remove test database, reload privilege tables: yes to each.

With unix_socket, log in as root like this:

sudo mariadb

SELinux notes

AlmaLinux and Rocky Linux run SELinux in enforcing mode by default. With the default paths and port, MariaDB works without changes. Problems start when you move things.

Check the mode:

getenforce

If you move the data folder, for example to /data/mysql, label the new path so MariaDB may use it. Install the tools first:

sudo dnf install policycoreutils-python-utils
sudo semanage fcontext -a -t mysqld_db_t "/data/mysql(/.*)?"
sudo restorecon -Rv /data/mysql

If you change the port from 3306, allow the new port in SELinux too:

sudo semanage port -a -t mysqld_port_t -p tcp 3307

To find SELinux denials after a failed start:

sudo ausearch -m avc -ts recent

Check it works

Run a query as root:

sudo mariadb -e "SELECT VERSION();"

Then confirm what it listens on:

sudo ss -ltnp | grep 3306

MariaDB listens on all addresses by default on this platform. That is fine while firewalld blocks port 3306, which it does unless you opened it. If only local apps use the database, add bind-address=127.0.0.1 under [mysqld] in the server config file and restart the service.

Troubleshooting

• No match for argument: MariaDB-server: the MariaDB repository was not added. Check /etc/yum.repos.d/mariadb.repo exists and rerun the setup script.
• dnf installs the AppStream version instead: on version 8, disable the module with sudo dnf module disable mariadb, then reinstall.
• Service fails after moving the data folder: usually an SELinux label or ownership issue. Run ausearch as above and sudo chown -R mysql:mysql on the new folder.
• ERROR 1698 Access denied for user 'root': root uses unix_socket. Run sudo mariadb instead of a password login.
• Another server cannot connect: firewalld blocks 3306 by default. Allow only that server's IP with a rich rule; see firewalld on AlmaLinux and Rocky Linux.

Next steps

• Not sure MariaDB is the right pick? Read MySQL vs MariaDB.
• Add app users with the right rights: Create a MySQL user and grant privileges.