How to Install MariaDB on Debian 13, 12 and 11

Debian’s default APT sources already give you a production-friendly MariaDB branch, which is usually the cleanest way to stand up a MySQL-compatible database for WordPress, application backends, or local development. You can install MariaDB on Debian 13 (Trixie), Debian 12 (Bookworm), and Debian 11 (Bullseye) without adding a third-party repository.

The default repository path is the practical choice when you want Debian-managed updates and common web-stack compatibility. Debian 13 ships MariaDB 11.8.x, Debian 12 ships 10.11.x, and Debian 11 stays on 10.5.x from the default package sources; newer upstream branches need a separate MariaDB repository workflow.

Install MariaDB on Debian

Debian keeps MariaDB in its own repositories, so the install path is the same across supported releases even though the packaged branch changes by release.

Debian Release	Default MariaDB	Package Source	Best Fit
Debian 13 (Trixie)	MariaDB 11.8.x	trixie/main	New deployments that want the newest Debian-packaged MariaDB branch
Debian 12 (Bookworm)	MariaDB 10.11.x	bookworm/main	Stable production stacks that want the current Debian 12 baseline
Debian 11 (Bullseye)	MariaDB 10.5.x	bullseye-security	Older Debian 11 systems that still need the distro-supported branch

Debian 11 is the outlier because the current MariaDB 10.5 candidate comes from bullseye-security, not just bullseye/main. That matters when you compare apt-cache policy output across Debian releases and wonder why Bullseye shows two package lines for the same branch.

If you need to confirm the current package branch before a maintenance window, check Debian’s mariadb-server package listing against your release codename.

On Debian 13, 12, and 11, the default-mysql-server metapackage resolves to MariaDB rather than Oracle MySQL. Debian 13 routes that dependency through mariadb-server-compat, Debian 12 depends on mariadb-server, and Debian 11 depends on the versioned 10.5 server package. If you specifically need Oracle’s server packages, follow install MySQL 8.0 on Debian instead of assuming the generic MySQL metapackage changes vendors.

Keep Debian’s repository packages and MariaDB’s upstream repositories separate. MariaDB publishes upstream package repositories, but use that path only when you deliberately need a branch that Debian does not provide.

Update Debian package lists before installing MariaDB

Refresh the package index first so APT sees the current MariaDB packages from your configured Debian mirrors.

sudo apt update

These commands use sudo for tasks that need root privileges. If your account does not have sudo access yet, add the user to sudoers on Debian before continuing.

If APT reports pending security updates, review and apply them before moving a new database into production. Reboot first when a kernel or core library update needs a planned restart.

Install MariaDB server and client on Debian

Install both packages from Debian’s default repositories so you get the database daemon and the command-line client in one step.

sudo apt install mariadb-server mariadb-client

The mariadb-server package provides the database service, while mariadb-client gives you the mariadb shell for local administration, remote logins, dumps, and version checks. Because this workflow stays inside Debian’s own repositories, you do not need a separate MariaDB repo or GPG key just to complete the default install.

Verify the installed MariaDB version on Debian

The client version check confirms which MariaDB branch your Debian release installed.

mariadb --version

mariadb from 11.8.6-MariaDB, client 15.2 for debian-linux-gnu (x86_64) using  EditLine wrapper

That example comes from Debian 13. Debian 12 reports the 10.11.14 branch, and Debian 11 reports the 10.5.29 branch, which matches the default-version table.

Check the MariaDB service state on Debian

Verify that systemd enabled the database service at boot and that the server is already running.

systemctl is-enabled mariadb && systemctl is-active mariadb

enabled
active

If the second line comes back as inactive or failed, start the service now and enable it for the next boot.

sudo systemctl enable mariadb --now

Install only the MariaDB client on Debian

If you only need the SQL client for a remote database server, skip the local daemon and install just the client package.

sudo apt install mariadb-client

This installs the mariadb CLI without creating a local MariaDB service or data directory, which is the cleaner choice for application servers, jump boxes, and administration hosts that only connect outward.

Secure MariaDB on Debian

Debian 13 ships mariadb-secure-installation as the main hardening command, while Debian 12 and Debian 11 also keep the older mysql_secure_installation name. Use the MariaDB-native command here so the same instruction works across all supported Debian releases.

Run the MariaDB hardening command on Debian

Start the interactive hardening pass once to remove the unsafe defaults that ship with a fresh MariaDB install.

sudo mariadb-secure-installation

Switch to unix_socket authentication [Y/n]
Change the root password? [Y/n]
Remove anonymous users? [Y/n]
Disallow root login remotely? [Y/n]
Remove test database and access to it? [Y/n]
Reload privilege tables now? [Y/n]

The exact wording can vary a little by branch, but these are the prompt groups you should expect on Debian’s packaged MariaDB releases.

On Debian 12 and Debian 11, the same Switch to unix_socket authentication [Y/n] prompt appears whether you start mariadb-secure-installation or the older mysql_secure_installation wrapper. Accepting it keeps local root administration tied to sudo mariadb; declining it means root database logins need the password-based mariadb -u root -p path.

What the MariaDB security prompts change on Debian

• unix_socket authentication: Lets the Linux root account administer MariaDB locally without a separate database password.
• Root password: Adds a password-based fallback for tools or workflows that do not use socket authentication.
• Anonymous users: Removes empty test accounts that should never stay on a real server.
• Remote root logins: Keeps the root database account restricted to local administration.
• Test database: Deletes the default test database and the broad permissions tied to it.
• Privilege reload: Applies each change immediately without waiting for a restart.

For most servers, answering Y to each cleanup prompt is the safer baseline. If you know you need a different root authentication model for a specific application or management tool, make that decision deliberately instead of leaving the defaults in place by accident.

Basic MariaDB Administration on Debian

Once the service is running and hardened, a few quick checks make day-to-day administration easier.

Open the MariaDB shell on Debian

If you accepted unix_socket authentication during hardening, the Linux root account can open the MariaDB shell directly.

sudo mariadb

If you switched to password-based root authentication instead, use mariadb -u root -p and enter the database password when prompted.

Confirm a local MariaDB query on Debian

Service state proves systemd started the unit, but a local SQL query proves the server and socket authentication are working together.

sudo mariadb -NBe "SELECT VERSION();"

11.8.6-MariaDB-0+deb13u1 from Debian

Debian 12 and Debian 11 return their packaged branches instead, such as 10.11.14-MariaDB-0+deb12u2 or 10.5.29-MariaDB-0+deb11u1.

Check MariaDB localhost binding on Debian

Debian’s default MariaDB configuration binds the server to localhost, which is the safer choice when the web application and the database run on the same machine.

sudo grep -E '^bind-address' /etc/mysql/mariadb.conf.d/50-server.cnf

bind-address            = 127.0.0.1

Leave that setting alone unless a separate application server genuinely needs to connect over the network. If you do open MariaDB beyond localhost, lock port 3306 down to trusted source addresses and review install UFW on Debian before you expose the service.

Use MariaDB with a Debian web stack

MariaDB usually sits inside a wider web stack rather than on its own. If you are building that next layer now, pair it with install LEMP on Debian, build a CMS workflow with install WordPress with Nginx on Debian, add a browser-based database UI with install phpMyAdmin with Nginx on Debian, or keep the stack component-by-component with install Nginx on Debian and install PHP on Debian.

Update MariaDB on Debian

Debian updates MariaDB through the same APT sources that installed it. Refresh package metadata, then upgrade the server and client packages during a maintenance window.

Take a database backup before distribution upgrades, upstream repository switches, or major MariaDB branch changes. Routine Debian security updates usually stay within the same packaged branch, but production databases still deserve a rollback point.

sudo apt update
sudo apt install --only-upgrade mariadb-server mariadb-client

For a client-only host, upgrade only mariadb-client. A normal full-system upgrade is still fine during planned maintenance, but the targeted command keeps this task focused on the packages installed here.

Troubleshoot MariaDB on Debian

Most first-run MariaDB problems on Debian come from service startup failures, root authentication expectations, or remote applications trying to connect to a local-only server.

Inspect MariaDB service logs on Debian

If MariaDB is inactive or failed, inspect the systemd unit and recent journal entries before reinstalling packages. Debian’s package-owned unit is mariadb.service; some compatibility commands may resolve from mysql, but mariadb is the clearer target for checks and fixes.

systemctl status mariadb --no-pager
sudo journalctl -u mariadb --no-pager -n 40

After fixing the logged error, start the service again and verify that systemctl is-active mariadb returns active.

Fix MariaDB root login errors on Debian

If root login fails with an access-denied message, match the command to the authentication choice you made during hardening. Socket-based root administration uses sudo mariadb.

sudo mariadb

Password-based root administration uses mariadb -u root -p instead.

mariadb -u root -p

An error that includes using password: YES usually means the password path was attempted and MariaDB rejected that credential. Return to the authentication model you selected instead of repeatedly changing service files or reinstalling the package.

Resolve remote MariaDB connection failures on Debian

Debian’s default bind-address keeps MariaDB on 127.0.0.1. Same-host web applications should connect locally, while a separate application host needs an intentional listener change, a firewall rule limited to trusted source addresses, and database grants that match that host. Avoid opening the root database account for remote administration.

Remove MariaDB from Debian

If you no longer need the local database service, remove the packages first, then decide separately whether package configuration and database files should stay for backup or be deleted as well.

For a client-only install, skip the service stop and remove only mariadb-client.

sudo apt remove mariadb-client

Stop and remove MariaDB packages on Debian

Disable the service so it does not try to start during package removal.

sudo systemctl disable --now mariadb

On Debian 13 and Debian 12, remove the server and client packages installed by this workflow. This package-removal step keeps configuration and database files available for backup or later inspection.

sudo apt remove mariadb-server mariadb-client

On Debian 11, the real server and client packages are versioned. Remove those packages instead so the service-owning package is removed, not only the generic metapackage.

sudo apt remove mariadb-server-10.5 mariadb-client-10.5

If you installed default-mysql-server or default-mysql-client separately, remove those metapackages only after confirming they are installed. Do not use purge as the default removal path on a database host. Debian’s MariaDB packages can ask whether to remove all databases during purge, so reserve purge for deliberate package-configuration cleanup after you have backups.

Use apt autoremove to clear dependency packages such as MariaDB core binaries, compression-provider plugins, and Galera when nothing else needs them. Review the dependency cleanup list before you confirm it because reused systems can also have older autoremovable packages you may want to keep.

sudo apt autoremove

Purge MariaDB package configuration on Debian

Purging MariaDB packages can trigger a database-removal prompt on Debian-family systems. Read that prompt carefully and keep database files unless you already have a verified backup.

Use purge only when you want APT to clean residual package configuration for the MariaDB packages. The shared /etc/mysql directory can also belong to MySQL-family common packages, so avoid manual directory deletion unless you are retiring every compatible server and client on the host.

sudo apt purge mariadb-server mariadb-client

On Debian 11, use the matching versioned package names when purging residual MariaDB configuration.

sudo apt purge mariadb-server-10.5 mariadb-client-10.5

Delete the MariaDB data directory on Debian

Deleting /var/lib/mysql permanently removes local databases stored on this server. Confirm your backup and restore path before running the deletion command.

Print the data directory first. If the command prints nothing, there is no local MariaDB data directory at that path.

sudo find /var/lib/mysql -maxdepth 0 -type d -print 2>/dev/null

Remove the directory only when you are sure no local database from this host needs to be kept.

sudo rm -rf /var/lib/mysql

Verify MariaDB removal on Debian

Check the installed package state after removal. No line with the ii status should remain for the MariaDB server or client packages.

dpkg-query -W -f='${binary:Package}\t${db:Status-Abbrev}\n' 'mariadb-server*' 'mariadb-client*' 2>/dev/null | grep -E '^[^[:space:]]+[[:space:]]+ii' || printf 'No MariaDB server/client packages are installed.\n'

No MariaDB server/client packages are installed.

A status of rc means the package is removed but residual configuration remains. That state is normal when you skip purge or keep /etc/mysql for review.

Conclusion

MariaDB is installed from Debian’s package stream with the service, local SQL query, and localhost binding verified. Keep the server on loopback unless a trusted application host needs TCP access, and take a backup before package upgrades, branch changes, or data-directory cleanup.