MariaDB 11

In the Azure Portal, open Marketplace, search for MariaDB 11 LTS, and select the SecureAnyCloud publisher entry. Click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range, and TCP 3306 only from application server subnets or the virtual network CIDR. Do not expose port 3306 to the public internet. The root password is written in plain text on the VM by design, so that you can read it without a second trip. An internet-exposed MariaDB port would make brute-force attacks trivial.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

RG="mariadb-prod" LOCATION="eastus" VM_NAME="mariadb-01" ADMIN_USER="azureuser" GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-sac/providers/Microsoft.Compute/galleries/sacGallery/images/mariadb-11-ubuntu-24-04/versions/<version>" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name mariadb-vnet --address-prefix 10.92.0.0/16 \
  --subnet-name mariadb-subnet --subnet-prefix 10.92.1.0/24 az network nsg create --resource-group "$RG" --name mariadb-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name mariadb-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name mariadb-nsg \
  --name allow-mariadb-vnet --priority 110 \
  --source-address-prefixes 10.92.0.0/16 \
  --destination-port-ranges 3306 --access Allow --protocol Tcp az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_D2s_v3 --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name mariadb-vnet --subnet mariadb-subnet --nsg mariadb-nsg \
  --public-ip-address ""

The --public-ip-address "" flag keeps the database off the public internet.

ssh azureuser@<private-ip>

By the time you connect, mariadb.service is running and mariadb-firstboot.service has already run, generating the per-VM credentials and creating the SecureAnyCloud database.

sudo systemctl status mariadb.service --no-pager

The expected state is active (running). Confirm the first-boot sentinel:

sudo test -f /var/lib/sac/data/mariadb-firstboot.done && echo FIRSTBOOT_DONE

Confirm the listener:

sudo ss -tln | grep 3306

sudo cat /stage/scripts/mariadb-credentials.log

The file contains:

ROOT_USER=root ROOT_PASSWORD=<ROOT_PASSWORD> SAC_USER=sac SAC_PASSWORD=<SAC_PASSWORD> SAC_DATABASE=sac PORT=3306

Store the passwords in your secret store. The file is mode 0600, readable by root only.

Export the root password to a shell variable for the session:

export ROOT_PW="$(sudo awk -F= '/^ROOT_PASSWORD=/{print $2}' /stage/scripts/mariadb-credentials.log)"

Connect to the server:

mariadb -u root -p"${ROOT_PW}"

The MariaDB prompt appears:

Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 7 Server version: 11.4.x-MariaDB-ubu2404 ... MariaDB [(none)]>

Run SELECT VERSION(); to confirm the version, then \q to exit.

mariadb -u root -p"${ROOT_PW}" -BNe "SELECT VERSION()"

The expected output is 11.4.x-MariaDB-ubu2404 (or a similar 11.x version).

The SecureAnyCloud user has all privileges on the SecureAnyCloud database:

export CL_PW="$(sudo awk -F= '/^SAC_PASSWORD=/{print $2}' /stage/scripts/mariadb-credentials.log)" mariadb -u sac -p"${CL_PW}" sac -e " CREATE TABLE IF NOT EXISTS probe (id INT, val VARCHAR(64)); INSERT INTO probe VALUES (1, 'sac-ok'); SELECT val FROM probe WHERE id=1; DROP TABLE probe; "

The output includes sac-ok.

The shipped image binds MariaDB to 127.0.0.1 only (the Ubuntu noble packaging default: the listener is on 127.0.0.1:3306, not 0.0.0.0:3306). To accept connections from other hosts in your virtual network, edit /etc/mysql/mariadb.conf.d/50-server.cnf and change the bind-address line:

sudo sed -i 's/^bind-address.*/bind-address = 0.0.0.0/' /etc/mysql/mariadb.conf.d/50-server.cnf
sudo systemctl restart mariadb.service
sudo ss -tln | grep 3306

Confirm that the listener is now bound to 0.0.0.0:3306 rather than 127.0.0.1:3306.

Then, from any host inside the same virtual network, connect on port 3306 with the SecureAnyCloud credentials:

mariadb -h <private-ip> -P 3306 -u sac -p'<SAC_PASSWORD>' sac

The MariaDB Connector libraries also speak the MySQL wire protocol natively, so legacy MySQL clients work too.

Security note: binding to 0.0.0.0 only matters at the network layer if your NSG allows inbound 3306 from somewhere. Keep bind-address=127.0.0.1 if all consumers are on the same VM (the typical LAMP single-server pattern). Use 0.0.0.0 only when application servers on other VMs in the same virtual network need access, and pair it with an NSG rule that restricts 3306 to those subnets. Never open it to the public internet.

• MariaDB server daemon: /usr/sbin/mariadbd
• mariadb CLI client: /usr/bin/mariadb
• mariadb-admin: /usr/bin/mariadb-admin
• mariadb-dump backup: /usr/bin/mariadb-dump
• Data directory: /var/lib/mysql/
• Server config: /etc/mysql/mariadb.conf.d/
• Error log: /var/log/mysql/error.log
• Systemd unit: /lib/systemd/system/mariadb.service
• First-boot script: /usr/local/sbin/mariadb-firstboot.sh
• First-boot service: /etc/systemd/system/mariadb-firstboot.service
• Credentials file: /stage/scripts/mariadb-credentials.log
• First-boot sentinel: /var/lib/sac/data/mariadb-firstboot.done

Inspect the installed package version:

dpkg-query -W -f='${Package} ${Version}\n' mariadb-server

Status:

sudo systemctl status mariadb.service --no-pager

Stop:

sudo systemctl stop mariadb.service

Start:

sudo systemctl start mariadb.service

Restart:

sudo systemctl restart mariadb.service

View error log:

sudo tail -n 50 /var/log/mysql/error.log

The default configuration is safe and works on small instances. For production VMs, edit /etc/mysql/mariadb.conf.d/50-server.cnf:

• innodb_buffer_pool_size: set to about 70% of available RAM (the 128M default is too small for production)
• max_connections: the default is 151; raise it for high-concurrency workloads
• innodb_log_file_size: the default is 96M; raise it to 512M or more for write-heavy workloads

After editing:

sudo systemctl restart mariadb.service

Use mariadb-dump for logical backups:

sudo mariadb-dump -u root -p"${ROOT_PW}" --all-databases --single-transaction --routines --triggers --events > backup-$(date +%F).sql

For point-in-time recovery, enable binary logging. For hot physical backups, use mariabackup.

Cannot connect on port 3306

• Confirm the service is running: sudo systemctl status mariadb.service
• Confirm the listener is bound: sudo ss -tln | grep 3306
• Check the error log: sudo tail -n 50 /var/log/mysql/error.log
• Confirm the NSG allows TCP 3306 from your client source IP

Authentication errors

• Re-read the password: sudo awk -F= '/^ROOT_PASSWORD=/{print $2}' /stage/scripts/mariadb-credentials.log
• Confirm the shell variable was not truncated
• Confirm first boot completed: sudo test -f /var/lib/sac/data/mariadb-firstboot.done && echo OK

First boot did not run

• Check the service: sudo systemctl status mariadb-firstboot.service --no-pager
• Review the journal: sudo journalctl -u mariadb-firstboot.service --no-pager -n 100
• If MariaDB failed to start, check the error log: sudo tail -n 50 /var/log/mysql/error.log

Service fails to start

• Check the journal: sudo journalctl -u mariadb.service --no-pager -n 100
• Check filesystem space: df -h /var/lib/mysql
• Verify data directory ownership: sudo ls -la /var/lib/mysql | head. It should be mysql:mysql

• Rotate the root password on a schedule using ALTER USER 'root'@'localhost' IDENTIFIED BY '<new-password>';
• Create application-specific users with minimal privileges. Never connect application code as root or as the SecureAnyCloud superuser.
• Restrict port 3306 to trusted application server subnets only in your NSG
• Enable binary logging for replication and point-in-time recovery: add log_bin = /var/log/mysql/mariadb-bin under [mysqld] in /etc/mysql/mariadb.conf.d/50-server.cnf
• Enable TLS for connections by configuring SSL certificates in [mariadb] and requiring REQUIRE SSL on user grants
• Back up regularly with mariadb-dump (logical) or mariabackup (physical)
• Keep MariaDB updated periodically: sudo apt-get update && sudo apt-get upgrade mariadb-server
• Shred the credentials file once the passwords are stored in your secret store: sudo shred -u /stage/scripts/mariadb-credentials.log

MariaDB Server is released under the GNU General Public License version 2. There is no per-core, per-seat or per-server fee for MariaDB Community. MariaDB is a registered trademark of MariaDB Corporation Ab.

SecureAnyCloud provides commercial support for this image separately from the upstream project.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7 with a guaranteed 24-hour response SLA

Deploy on Azure

Launch MariaDB 11 LTS on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch MariaDB 11 LTS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com