MariaDB 10.11

Navigate to Marketplace in the Azure Portal, search for MariaDB 10.11 LTS, and select the SecureAnyCloud publisher entry. Click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range. Allow TCP 3306 only from application server subnets or the virtual network CIDR. Do not expose port 3306 to the public internet.

The root password is written in plain text on the VM by design, so you can read it without a second trip. An internet-exposed MariaDB port would make brute-force attacks trivial.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

RG="mariadb-prod" LOCATION="eastus" VM_NAME="mariadb-01" ADMIN_USER="azureuser" GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-sac/providers/Microsoft.Compute/galleries/sacGallery/images/mariadb-10-11-lts-ubuntu-24-04/versions/<version>" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name mariadb-vnet --address-prefix 10.92.0.0/16 \
  --subnet-name mariadb-subnet --subnet-prefix 10.92.1.0/24 az network nsg create --resource-group "$RG" --name mariadb-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name mariadb-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name mariadb-nsg \
  --name allow-mariadb-vnet --priority 110 \
  --source-address-prefixes 10.92.0.0/16 \
  --destination-port-ranges 3306 --access Allow --protocol Tcp az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_D2s_v3 --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name mariadb-vnet --subnet mariadb-subnet --nsg mariadb-nsg \
  --public-ip-address ""

The --public-ip-address "" flag keeps the database off the public internet.

ssh azureuser@<private-ip>

On your first connection, mariadb.service is already running and mariadb-firstboot.service has already run. It generated the per-VM credentials and created the SecureAnyCloud database.

sudo systemctl status mariadb.service --no-pager

The expected status is active (running). Confirm the first-boot sentinel:

sudo test -f /var/lib/sac/data/mariadb-firstboot.done && echo FIRSTBOOT_DONE

Confirm the listener:

sudo ss -tln | grep 3306

sudo cat /stage/scripts/mariadb-credentials.log

The output looks like this:

ROOT_USER=root ROOT_PASSWORD=<ROOT_PASSWORD> SAC_USER=sac SAC_PASSWORD=<SAC_PASSWORD> SAC_DATABASE=sac PORT=3306

Store the passwords in your secret store. The file is mode 0600 (root-only).

Export the root password to a shell variable for the session:

export ROOT_PW="$(sudo awk -F= '/^ROOT_PASSWORD=/{print $2}' /stage/scripts/mariadb-credentials.log)"

Connect:

mariadb -u root -p"${ROOT_PW}"

The MariaDB prompt appears:

Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 7 Server version: 10.10.11-MariaDB-ubu2404 ... MariaDB [(none)]>

Run SELECT VERSION(); to confirm, then \q to exit.

mariadb -u root -p"${ROOT_PW}" -BNe "SELECT VERSION()"

The expected version is 10.10.11-MariaDB-ubu2404 (or similar 10.11).

The SecureAnyCloud user has all privileges on the SecureAnyCloud database:

export CL_PW="$(sudo awk -F= '/^SAC_PASSWORD=/{print $2}' /stage/scripts/mariadb-credentials.log)" mariadb -u sac -p"${CL_PW}" sac -e " CREATE TABLE IF NOT EXISTS probe (id INT, val VARCHAR(64)); INSERT INTO probe VALUES (1, 'sac-ok'); SELECT val FROM probe WHERE id=1; DROP TABLE probe; "

The output is sac-ok.

The shipped image binds MariaDB to 127.0.0.1 only. This is the Ubuntu noble packaging default: the listener is on 127.0.0.1:3306, not 0.0.0.0:3306. To accept connections from other hosts in your virtual network, edit /etc/mysql/mariadb.conf.d/50-server.cnf and change the bind-address line:

sudo sed -i 's/^bind-address.*/bind-address = 0.0.0.0/' /etc/mysql/mariadb.conf.d/50-server.cnf
sudo systemctl restart mariadb.service
sudo ss -tln | grep 3306

Confirm that the listener is now bound on 0.0.0.0:3306 and not on 127.0.0.1:3306.

Then connect from any host inside the same virtual network, on port 3306, with the SecureAnyCloud credentials:

mariadb -h <private-ip> -P 3306 -u sac -p'<SAC_PASSWORD>' sac

The MariaDB Connector libraries also speak the MySQL wire protocol natively, for legacy MySQL clients.

Security note: binding to 0.0.0.0 only matters at the network layer if your NSG allows inbound 3306 from somewhere. Keep bind-address=127.0.0.1 if all consumers are on the same VM (the typical single-server LAMP pattern).

Use 0.0.0.0 only when you have application servers on different VMs in the same VNet. Pair it with an NSG rule that restricts 3306 to those subnets, and never to the public internet.

Component and path:

MariaDB server daemon /usr/sbin/mariadbd

mariadb CLI client /usr/bin/mariadb

mariadb-admin /usr/bin/mariadb-admin

mariadb-dump backup /usr/bin/mariadb-dump

Data directory /var/lib/mysql/

Server config /etc/mysql/mariadb.conf.d/

Error log /var/log/mysql/error.log

Systemd unit /lib/systemd/system/mariadb.service

First-boot script /usr/local/sbin/mariadb-firstboot.sh

First-boot service /etc/systemd/system/mariadb-firstboot.service

Credentials file /stage/scripts/mariadb-credentials.log

First-boot sentinel /var/lib/sac/data/mariadb-firstboot.done

Inspect the installed package version:

dpkg-query -W -f='${Package} ${Version}\n' mariadb-server

Status:

sudo systemctl status mariadb.service --no-pager

Stop:

sudo systemctl stop mariadb.service

Start:

sudo systemctl start mariadb.service

Restart:

sudo systemctl restart mariadb.service

View error log:

sudo tail -n 50 /var/log/mysql/error.log

The default configuration ships with safe defaults that work on small instances. For production VMs, edit /etc/mysql/mariadb.conf.d/50-server.cnf and adjust these settings:

• innodb_buffer_pool_size: set to about 70% of available RAM (the default of 128M is too small for production)
• max_connections: the default is 151; raise it for high-concurrency workloads
• innodb_log_file_size: the default is 96M; raise it to 512M or more for write-heavy workloads

After editing:

sudo systemctl restart mariadb.service

Use mariadb-dump for logical backups:

sudo mariadb-dump -u root -p"${ROOT_PW}" --all-databases --single-transaction --routines --triggers --events > backup-$(date +%F).sql

For point-in-time recovery, enable binary logging. Use mariabackup for hot physical backups.

Cannot connect on port 3306

Confirm service running: sudo systemctl status mariadb.service

Confirm listener bound: sudo ss -tln | grep 3306

Check error log: sudo tail -n 50 /var/log/mysql/error.log

Confirm NSG allows TCP 3306 from your client source IP

Authentication errors

Re-read password: sudo awk -F= '/^ROOT_PASSWORD=/{print $2}' /stage/scripts/mariadb-credentials.log

Confirm shell variable not truncated

Confirm firstboot completed: sudo test -f /var/lib/sac/data/mariadb-firstboot.done && echo OK

Firstboot did not run

Check service: sudo systemctl status mariadb-firstboot.service --no-pager

Review journal: sudo journalctl -u mariadb-firstboot.service --no-pager -n 100

If MariaDB failed to start, check error log: sudo tail -n 50 /var/log/mysql/error.log

Service fails to start

Check journal: sudo journalctl -u mariadb.service --no-pager -n 100

Check filesystem space: df -h /var/lib/mysql

Verify data directory ownership: sudo ls -la /var/lib/mysql | head; should be mysql:mysql

Rotate the root password on a schedule with ALTER USER 'root'@'localhost' IDENTIFIED BY '<new-password>';

Use least-privilege users. Create application-specific users with minimal privileges, and never connect application code as root or as the SecureAnyCloud superuser.

Restrict port 3306 to trusted application server subnets only in your NSG

Enable binary logging for replication and point-in-time recovery: add log_bin = /var/log/mysql/mariadb-bin under [mysqld] in /etc/mysql/mariadb.conf.d/50-server.cnf

Enable TLS for connections by configuring SSL certificates in [mariadb] and requiring REQUIRE SSL on user grants

Back up regularly with mariadb-dump (logical) or mariabackup (physical)

Keep MariaDB updated: sudo apt-get update && sudo apt-get upgrade mariadb-server periodically

Shred the credentials file once the passwords are stored in your secret store: sudo shred -u /stage/scripts/mariadb-credentials.log

MariaDB Server is released under the GNU General Public License version 2. There is no per-core, per-seat, or per-server fee for MariaDB Community. MariaDB is a registered trademark of MariaDB Corporation Ab.

SecureAnyCloud provides commercial support for this image, separately from the upstream project.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch MariaDB 10.11 LTS on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch MariaDB 10.11 LTS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com