Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Secure a MySQL or MariaDB database on a Linux VPS in layers: remove default accounts, create narrowly scoped users, bind the server to trusted interfaces, enforce encrypted connections, confine the service and its files, log activity, patch continuously, and test recovery from protected backups. The exact commands and defaults depend on the installed MySQL or MariaDB release, so identify the version before changing authentication, TLS, plugins, or backup privileges.
1. Identify the database, release, and exposure
Start by recording the product and exact major and minor version. MySQL and MariaDB are related but not interchangeable: secure-installation utilities, root-account authentication, TLS defaults, package configuration locations, audit plugins, dynamic privileges, and backup requirements can differ by release.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →mysql --version
mariadb --version
sudo systemctl status mysql
sudo systemctl status mariadbUse the service that exists on your VPS; do not assume both are installed. Also document whether applications run on the same machine, on another private network host, or across an untrusted network. That decision determines the bind address, firewall policy, and TLS requirement.
- Same VPS: keep the listener on the loopback interface unless a separate private interface is genuinely required.
- Private application tier: listen only on the required private address and allow port 3306 from the application subnet, not from the public internet.
- Untrusted network: use TLS and a firewall allow-list together. A nonstandard port does not replace authentication, encryption, or source filtering.
2. Complete the initial account cleanup
Run the vendor-provided hardening wizard immediately after installation and after major migrations. On MariaDB, the current utility is usually mariadb-secure-installation; older packages may expose the legacy mysql_secure_installation name. MySQL packages commonly provide mysql_secure_installation. Verify the executable supplied by your package rather than copying a command from another product.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
sudo mariadb-secure-installation
# or, where supplied by the package:
sudo mysql_secure_installationAnswer the wizard’s prompts to perform these four cleanup actions:
- Remove anonymous accounts. They allow connections without a named identity and complicate auditing.
- Disallow remote login for the database root account. Administrative access should be local, controlled by the operating system, and separately protected.
- Remove the default test database and any permissions associated with it. A test schema is not an appropriate shared workspace on a production VPS.
- Reload privilege tables so the removals take effect immediately.
Afterward, enumerate accounts and hosts and confirm that no unexpected anonymous or wildcard-host administrative account remains. Keep a separate emergency procedure for local administration; do not turn the database root account into an application credential.
3. Create dedicated accounts and apply least privilege
Every application, migration job, reporting process, and backup process should have its own identity. The account receives only the statements and schemas it needs, from only the hosts it actually uses. Oracle’s MySQL Secure Deployment Guide describes this as the principle of least privilege: users and processes should access only information and resources required for their legitimate purpose.
Create an application identity
Use a host-specific account when the application is local. Replace the example database name, username, and secret with values held in your deployment secret manager; never commit a password to source control or a world-readable configuration file.
CREATE DATABASE appdb;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'use-a-random-secret-from-your-secret-store';
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'appuser'@'localhost';If the application runs on a separate private host, replace localhost with that host’s fixed private address or a narrowly defined private network pattern. Do not use '%' merely because it is convenient. A wildcard-host account expands the attack surface to every interface that can reach the listener.
Separate administrative and operational work
- Use a migration identity only when schema changes are required; do not leave schema-altering privileges on the normal runtime account.
- Give reporting users read-only access to the required views or tables, rather than
ALL PRIVILEGESon the whole server. - Use a dedicated backup identity with the exact, version-appropriate privileges required by
mariadb-backupor the MySQL backup utility. - Keep replication, plugin-management, and dynamic privileges away from ordinary application accounts.
Review dangerous privileges
Inspect every grant, including inherited or forgotten accounts:
Free tools Windows power users keep installed
One-click scans. No signup required.
SHOW GRANTS FOR 'appuser'@'localhost';Pay particular attention to FILE, PROCESS, and SUPER. MySQL documents that FILE can write through the server process, while PROCESS and SUPER can expose sensitive process information or enable high-impact administration. Remove them unless a documented task requires them. Review replication, plugin, and dynamic-privilege grants with the same skepticism.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
When privileges change, record who approved the change, why it is needed, its permitted host, and its expiry or review date. Re-run SHOW GRANTS after deployments and retire accounts when an application or contractor is removed.
4. Close the network by default
Bind only to required interfaces
If the application and database share the VPS, configure MySQL or MariaDB to listen on 127.0.0.1. For a remote application tier, bind to the specific private interface required for that traffic. Package configuration paths and option-file names differ, so locate the active server configuration using the files installed by your distribution and verify the effective setting from the running server.
After changing the bind setting, restart the appropriate service and verify that the listener is on the intended address. A listener on 0.0.0.0 or a public address should be treated as an explicit exception requiring a documented firewall policy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Allow-list port 3306 at every boundary
Permit TCP port 3306 only from trusted source addresses or private subnets. Apply the rule in the VPS firewall and, where applicable, in the hosting provider’s network firewall. Keep the default inbound policy restrictive and remove old rules when an application moves.
- Allow the application server’s private address or subnet.
- Deny public internet sources unless there is a documented, exceptional architecture.
- Keep administrative access on a separate, controlled path instead of exposing database administration globally.
Changing 3306 to another port can reduce background scanning noise, but it is not access control. Attackers can discover a changed port; identity, source filtering, and encryption remain necessary.
5. Encrypt client-server traffic with TLS
Traffic that crosses an untrusted network must be encrypted. MariaDB documentation notes that TLS protects credentials and query results from man-in-the-middle attacks during client-server communication. Install certificates and private keys according to the exact release and distribution package, protect the key files from non-administrative users, and configure both server and clients to use the certificate authority they trust.
Require encryption for sensitive accounts
Where supported by the installed release, add REQUIRE SSL to accounts that must never connect in cleartext. Apply the requirement to the account definition, not just to an application convention, so an accidental client setting cannot silently downgrade the connection.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
ALTER USER 'appuser'@'localhost' REQUIRE SSL;MariaDB TLS behavior and defaults changed across releases. Check the installed version’s documentation before selecting certificate options, cipher settings, or account clauses. Do not assume a MySQL configuration can be copied unchanged to MariaDB, or vice versa.
Verify the negotiated session
Test from the same client library and network path used by the application. Confirm that the session reports a negotiated TLS cipher rather than relying on the presence of certificate files alone.
SHOW SESSION STATUS LIKE 'Ssl_cipher';Run the test for local and remote connection paths separately. A local test can pass while a remote connection uses different client defaults. If the value is empty, fix the client’s CA, certificate, hostname, or TLS requirement before putting credentials on that path.
6. Constrain the Linux service and its files
Never run the daemon as Unix root
Oracle’s MySQL security guidance is explicit: never run the server as the Unix root user. Use the dedicated service account created by the package. Check the running process and service definition after upgrades or custom deployments; a manually edited unit file must not quietly reintroduce root execution.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ps -eo user,pid,comm,args | grep -E '[m]ysqld|[m]ariadbd'
systemctl cat mysql
systemctl cat mariadbProtect data, sockets, keys, and logs
Database directories, Unix sockets, TLS private keys, error logs, binary logs, and temporary files can contain credentials or sensitive records. Set ownership to the dedicated database service account and grant read or write access only to that account and authorized administrators. Avoid broad group or world permissions, and check permissions after package upgrades, restores, and manual log rotation.
Use SELinux or AppArmor where your distribution provides a profile. Keep the profile enforcing after validating required data, socket, backup, and log paths. If you must add an exception, document the exact path and operation rather than disabling confinement globally.
7. Disable or restrict risky features
Turn off local file loading unless required
Disable LOCAL INFILE unless a documented import workflow needs it. Local file loading can turn an otherwise ordinary database connection into a path for reading files from a client host. If an import is necessary, enable it only for the controlled job, constrain the account, and disable it again when the task ends.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Audit high-impact capabilities
Review FILE, SUPER, PROCESS, replication privileges, plugin installation or administration, and dynamic privileges. Treat each as an exception with an owner and a business reason. Remove privileges granted “temporarily” during installation; temporary access that is never revoked becomes the production baseline.
8. Log, audit, and protect the evidence
Enable the logs that match your operational and compliance needs: error logging for failures and startup events, connection logging for authentication activity, query or general logging for carefully bounded investigations, slow-query logging for performance and abuse analysis, and an audit facility when you need structured records of sensitive actions.
Logging can expose query parameters, credentials accidentally included in statements, and personal data. Restrict log-file permissions, rotate files before disks fill, and define retention periods. Protect remote log destinations and consider encryption for logs and binary logs when they leave the host or are stored on shared infrastructure. MariaDB documents require_secure_transport, encrypt_binlog, filesystem permissions, and audit events as relevant controls; availability and exact syntax depend on the installed release and enabled plugins.
Monitor for repeated failed logins, new accounts, grant changes, unexpected remote sources, disabled TLS, plugin changes, and service restarts. An alert is useful only if someone owns the response, so include escalation and evidence-preservation steps in the runbook.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match9. Patch the operating system and database
Keep the Linux distribution and database on supported current releases. Track vendor security advisories and CVEs, and test updates against an application staging environment before production rollout. The older MySQL 5.7 Secure Deployment Guide remains useful for principles such as least privilege, host firewalls, and operating-system confinement, but its product-specific commands and support assumptions should not be treated as current instructions.
Before an upgrade, verify:
- the target release’s authentication and TLS defaults;
- the service account and file-ownership behavior of the package;
- plugin and audit compatibility;
- backup and restore utility compatibility;
- the vendor support lifecycle and available security fixes.
After an upgrade, repeat account, grant, listener, firewall, TLS, plugin, and filesystem-permission checks. Configuration drift frequently appears during package replacement or a migration between MySQL and MariaDB.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.10. Build recoverable, protected backups
Security includes recovery from ransomware, accidental deletion, and destructive SQL. Use a dedicated backup identity and grant only the privileges required by the version-appropriate backup tool. MariaDB’s mariadb-backup privilege requirements vary by release, so follow the documentation for the exact server version instead of reusing an older grant set.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Store backup files outside the database data directory and restrict access to the backup process and authorized recovery administrators.
- Encrypt backups before placing them on separate storage or sending them over a network.
- Keep at least one copy separated from the VPS so a host compromise cannot erase every copy.
- Protect encryption keys separately from the backup data.
- Perform restoration drills and record the time, commands, dependencies, and validation checks needed to bring the application back.
A backup that has never been restored is an assumption, not a recovery plan. Test both a complete restore and a point-in-time procedure when your binary-log retention and operational requirements call for it.
11. MySQL and MariaDB: what must be checked separately
The security goals are the same, but implementation details are release-specific. Use this comparison as a decision checklist, not as permission to copy settings blindly.
| Security area | MySQL | MariaDB | What to verify |
|---|---|---|---|
| Initial cleanup utility | mysql_secure_installation is commonly supplied |
mariadb-secure-installation; older packages may retain mysql_secure_installation |
Run the executable installed by the package |
| Root and authentication defaults | Depend on release and package | Depend on release and package | Inspect local accounts, authentication plugins, and remote-root policy |
| Bind and package configuration | Option-file locations vary by distribution and release | Option-file locations vary by distribution and release | Confirm the active listener and effective server options |
| TLS defaults and account requirements | Verify supported certificate options and REQUIRE SSL behavior |
TLS behavior and defaults changed in newer releases | Test a real client session and confirm negotiated TLS |
| Logging and audit | Available logs and plugins depend on edition and release | Audit events, plugins, and transport settings depend on release | Enable only the facilities you can protect, rotate, and monitor |
| Backup utility | Use the utility supported by the installed MySQL release | mariadb-backup privileges vary by release |
Use a dedicated identity and perform a restore test |
| Host confinement | Use the package service account and available SELinux or AppArmor profile | Use the package service account and available SELinux or AppArmor profile | Check process identity and file labels or profiles after changes |
| Support and CVEs | Follow the current Oracle support lifecycle | Follow the current MariaDB support lifecycle | Patch within the supported release track |
12. A practical verification sequence
Run this sequence after installation, after a major configuration change, and on a scheduled review cycle:
- Confirm the exact database product and release.
- Run the appropriate secure-installation utility and remove anonymous users, the test database, and remote root access.
- List accounts and hosts; remove wildcard or abandoned identities.
- Inspect
SHOW GRANTSfor application, reporting, migration, replication, and backup accounts. - Confirm the daemon runs as its dedicated Unix service account.
- Verify the bind address and list active firewall rules for port 3306.
- Connect through every supported network path and confirm TLS is negotiated where required.
- Check that
LOCAL INFILEand high-impact privileges are disabled or justified. - Confirm error, connection, slow-query, and audit logging are protected and rotated.
- Review OS and database patches, certificates, plugins, and support status.
- Run a restore drill from an encrypted backup and record the result.
Repeat the review whenever an application is added, an address changes, a certificate is renewed, a plugin is installed, or the database crosses a major version boundary. That cadence catches the configuration drift that one-time installation hardening cannot.
Frequently Asked Questions
Is changing MySQL or MariaDB from port 3306 enough to secure it?
No. A changed port is not an access-control mechanism. Bind the server to the required interface, firewall trusted source addresses, use dedicated accounts with least privilege, and encrypt traffic that crosses an untrusted network.
Recommended Free Tools
Should an application connect as database root?
No. Create a dedicated account for each application and grant only the statements and schemas it needs. Keep root for controlled local administration and never permit remote root login.
Do MySQL and MariaDB use identical hardening commands?
No. The secure-installation utility name, authentication defaults, TLS behavior, plugins, and backup privileges vary by product and release. Check the installed version and use its package documentation.
How can I prove that a connection is encrypted?
Connect using the same client path as the application and inspect the session’s negotiated TLS state, for example with SHOW SESSION STATUS LIKE 'Ssl_cipher';. An empty value indicates that the session is not using a TLS cipher.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
