MonetDB 11.55.9

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select MonetDB 11.55.9 on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2. Choose m5.large (or a larger, memory-rich type for analytical work), your key pair and a security group as described above. The AMI includes two volumes: the root volume and a 20 GiB data volume (/dev/sdf) for /var/monetdb5. Size the data volume for your data at launch.

Alternatively, launch with the AWS CLI. Replace the values in angle brackets. This example grows the data volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=monetdb}]'

If you make the data volume larger at launch, grow the file system once after first boot with sudo resize2fs "$(findmnt -no SOURCE /var/monetdb5)". First boot takes under a minute after the instance is running.

Connect over SSH as the ubuntu user, the default user for MonetDB 11.55.9 on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

The first-boot service and the MonetDB daemon should be active. The TLS endpoint is installed but switched off. systemctl is-enabled exits non-zero for a disabled unit, which is why the command ends with || true:

systemctl is-active monetdb-firstboot.service monetdbd.service
systemctl is-enabled monetdb-tls.service || true

active active disabled

MonetDB listens on the loopback address only. From the network, only SSH is reachable:

sudo ss -Htln

LISTEN 0 4096 127.0.0.1:50000 0.0.0.0:* LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* LISTEN 0 4096 [::1]:50000 [::]:* LISTEN 0 4096 [::]:22 [::]:*

Port 50000 is MonetDB's SQL port (the MAPI protocol). The port 53 lines are Ubuntu's local DNS resolver, which is also loopback only. List the database that the daemon manages:

sudo -u monetdb monetdb status

name state health remarks demo R 2m 100% 1s mapi:monetdb://ip-172-31-89-73:50000/demo

Your connection details are stored in /root/monetdb-credentials.txt. View the file:

sudo grep -E '^MONETDB_(USER|DATABASE|HOST|PORT|TLS_PORT|TLS_CERTHASH)=' /root/monetdb-credentials.txt

MONETDB_USER=monetdb MONETDB_DATABASE=demo MONETDB_HOST=127.0.0.1 MONETDB_PORT=50000 MONETDB_TLS_PORT=50443 MONETDB_TLS_CERTHASH=sha256:cf43b20cc0b6a0025ccbd71d673388b1b9e8f220b28045b117ab3642d11a6ba7

Show the password itself when you need it, for example for a client on your own computer:

sudo grep '^MONETDB_PASSWORD=' /root/monetdb-credentials.txt

The user monetdb is the administrator of the database demo. MONETDB_TLS_CERTHASH is the fingerprint of this instance's TLS certificate, which clients use to trust the TLS endpoint (Step 9).

mclient has no password option, so it reads the password from a small file. monetdb-mclient runs mclient against demo on 127.0.0.1:50000 with the password from the credentials file. It passes the password in a temporary root-only file that it removes afterwards:

sudo monetdb-mclient -s "SELECT value FROM sys.env() WHERE name IN ('monet_version', 'monet_release');"

+-------------+ | value | +=============+ | 11.55.9 | | Dec2025-SP4 | +-------------+ 2 tuples

Run sudo monetdb-mclient with no options for an interactive session. Enter \q to quit, or \? to list the commands.

Create a table, bulk-load rows with COPY INTO, and run an aggregation with a window function. This example loads from standard input, and MonetDB also loads CSV files (see the MonetDB documentation):

sudo monetdb-mclient -s "CREATE TABLE sales (region VARCHAR(8), product VARCHAR(20), amount DECIMAL(10,2)); COPY 6 RECORDS INTO sales FROM STDIN USING DELIMITERS ',',E'\n'; EMEA,keyboards,250.25 EMEA,monitors,447.80 APAC,keyboards,120.00 APAC,mice,80.50 AMER,monitors,999.99 AMER,mice,0.01 SELECT region, SUM(amount) AS revenue, RANK() OVER (ORDER BY SUM(amount) DESC) AS rank FROM sales GROUP BY region ORDER BY rank;"

operation successful 6 affected rows +--------+---------------+------+ | region | revenue | rank | +========+===============+======+ | AMER | 1000.00 | 1 | | EMEA | 698.05 | 2 | | APAC | 200.50 | 3 | +--------+---------------+------+ 3 tuples

MonetDB stores each column separately, which sys.storage() shows:

sudo monetdb-mclient -s "SELECT \"column\", type, count FROM sys.storage() WHERE \"table\" = 'sales';"

+---------+---------+-------+ | column | type | count | +=========+=========+=======+ | region | varchar | 6 | | product | varchar | 6 | | amount | decimal | 6 | +---------+---------+-------+ 3 tuples

For applications, create a dedicated user instead of using monetdb, for example CREATE USER "app" WITH PASSWORD '<password>' NAME 'Application' SCHEMA "sys"; followed by the GRANT statements that your application needs. Remove the example table with sudo monetdb-mclient -s "DROP TABLE sales;".

The daemon manages every database in /var/monetdb5/dbfarm. To add a database with its own administrator password, choose a password and use the same method that first boot uses, which never puts the password on a command line. Replace analytics with your database name:

sudo -u monetdb monetdb create analytics read -rs NEWPW; printf '%s\n' "$NEWPW" | sudo -u monetdb mserver5 --set monet_vault_key=/var/monetdb5/dbfarm/analytics/.vaultkey --dbpath=/var/monetdb5/dbfarm/analytics --read-password-initialize-and-exit; unset NEWPW
sudo -u monetdb monetdb release analytics

Never create a database with monetdb create alone and then release it without setting a password. Its administrator would be monetdb with the password monetdb. Connect to the new database with mclient -h 127.0.0.1 -p 50000 -u monetdb -d analytics, which prompts for its password. (monetdb-mclient uses the password of demo.)

MonetDB listens on 127.0.0.1:50000 only. Forward the port over SSH from your computer, then point mclient, pymonetdb, JDBC or ODBC at the local end of the tunnel:

ssh -i <your-key.pem> -N -L 50000:127.0.0.1:50000 ubuntu@<public-ip> mclient -h 127.0.0.1 -p 50000 -u monetdb -d demo

Enter the password from Step 4 when prompted. For applications inside your VPC, the same tunnel (or an SSH-based bastion) keeps the database port closed to the network.

If clients must connect without SSH, switch on the TLS endpoint. It serves TLS on port 50443 with this instance's own certificate and forwards to the local database. Plaintext connections to it are refused.

sudo systemctl enable --now monetdb-tls.service
sudo ss -Htln sport = :50443

Created symlink /etc/systemd/system/multi-user.target.wants/monetdb-tls.service → /etc/systemd/system/monetdb-tls.service. LISTEN 0 4096 *:50443 *:*

Check the endpoint on the instance. MonetDB's clients (mclient and libmapi since Dec2023, pymonetdb 1.8, JDBC 12) connect with a monetdbs:// URL and trust this self-signed certificate through its fingerprint, the certhash:

CH="$(sudo sed -n 's/^MONETDB_TLS_CERTHASH=//p' /root/monetdb-credentials.txt)"
sudo monetdb-mclient -d "monetdbs://localhost:50443/demo?certhash=${CH}" -s "SELECT 'connected over TLS' AS result;"

+--------------------+ | result | +====================+ | connected over TLS | +--------------------+ 1 tuple

Then allow TCP 50443 in the instance's security group from your own network only (never 0.0.0.0/0):

aws ec2 authorize-security-group-ingress --group-id <your-security-group> \
  --protocol tcp --port 50443 --cidr <your-cidr>

Then connect from your computer with the fingerprint from Step 4:

mclient -u monetdb -d "monetdbs://<public-ip>:50443/demo?certhash=<MONETDB_TLS_CERTHASH>"

At first boot, the certificate names the instance's addresses (localhost, the private IP, the public IP and the public DNS name). The certhash pin works whatever name you connect to. A public IP that is not an Elastic IP changes when the instance is stopped and started.

To use a certificate from your own CA instead, replace /etc/monetdb/tls/server.crt and server.key (owner root, group stunnel4, key mode 0640) and restart the TLS endpoint. To switch the endpoint off again, run sudo systemctl disable --now monetdb-tls.service and remove the security group rule.

MonetDB, its first-boot service and the TLS endpoint cannot reach the instance metadata service:

systemctl show -p IPAddressDeny monetdbd.service monetdb-firstboot.service monetdb-tls.service

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

The daemon listens on localhost, remote control and discovery are off, and the control passphrase is stored only as a hash. Verify these settings:

sudo -u monetdb monetdbd get listenaddr,port,control,discovery /var/monetdb5/dbfarm
sudo grep -c '^passphrase={SHA512}' /var/monetdb5/dbfarm/.merovingian_properties

property value listenaddr localhost port 50000 control no discovery no 1

Confirm that MonetDB runs unprivileged:

ps -o user:10=,comm= -u monetdb
sudo grep -E '^(CapEff|NoNewPrivs)' /proc/$(systemctl show -p MainPID --value monetdbd.service)/status

monetdb monetdbd monetdb mserver5-11.55. CapEff: 0000000000000000 NoNewPrivs: 1

Run the image's own round-trip check. It confirms that the per-instance password works and that an analytic query returns exact results, while monetdb/monetdb and blank, common and random passwords are refused. It also checks that port 50000 is loopback only. When the TLS endpoint is on, it checks that the fingerprint is accepted while plaintext and an unpinned certificate are refused:

sudo /usr/local/sbin/monetdb-roundtrip.sh | tail -1

OK-monetdb-roundtrip

Sign in and set a new password. Then update the credentials file so that monetdb-mclient keeps working:

sudo monetdb-mclient sql> ALTER USER SET PASSWORD '<new-password>' USING OLD PASSWORD '<current-password>'; sql> \q
sudo sed -i 's/^MONETDB_PASSWORD=.*/MONETDB_PASSWORD=<new-password>/' /root/monetdb-credentials.txt

• Backups. Snapshot the data volume, or copy /var/monetdb5 with the daemon stopped (sudo systemctl stop monetdbd). For a logical SQL dump, msqldump reads the password from a dotfile in the same way as mclient. Keep dumps in a location that only root can read.
• Memory. MonetDB uses the instance's memory for its working set and the operating system's file cache for the rest. Use a memory-rich instance type for large analytical tables.
• Logs. Run sudo journalctl -u monetdbd.service -n 50, or read /var/log/monetdb/merovingian.log.
• Configuration. The daemon's properties live in /var/monetdb5/dbfarm/.merovingian_properties. Change them with sudo -u monetdb monetdbd set <property>=<value> /var/monetdb5/dbfarm and restart the daemon. Keep listenaddr=localhost unless you deliberately expose the port, and leave control=no unless you need remote administration.
• Updates. Ubuntu security updates install automatically. MonetDB comes from MonetDB's own repository, which is configured on the instance. Upgrade it deliberately with sudo apt-get update && sudo apt-get install monetdb-server monetdb-sql monetdb-client, after you snapshot the data volume and read the MonetDB release notes.