How to Install MariaDB on Fedora Linux

Fedora 43 ships two MariaDB branches in its own repositories, so you can install MariaDB on Fedora and move straight into hardening and your first database login without adding a third-party repo. MariaDB 10.11 is the longstanding LTS default, while MariaDB 11.8 is the newer LTS with features like VECTOR column types, improved optimizer hints, and better JSON table handling.

Both packages pull in the matching client and the mysql-selinux policy automatically. From there you enable mariadb.service, create a dedicated application account, keep the server local-only when you can, and remove the packages cleanly if the host changes roles.

Install MariaDB on Fedora

Fedora 43 keeps two MariaDB server branches in its standard DNF repositories. Both are mutually exclusive; DNF will not let both coexist because they share the same data directory, service unit, and port.

Package	Version	MariaDB Release	Community LTS End
mariadb-server	10.11.x	LTS (since Feb 2023)	Feb 2028
mariadb11.8-server	11.8.x	LTS (since Jun 2025)	Jun 2028

MariaDB 10.11 is the safe choice when an application has not been tested against 11.x changes such as the removal of certain deprecated syntax. MariaDB 11.8 is the better starting point for new projects that benefit from the newer optimizer, expanded JSON support, and a longer remaining support window. Pick one version, then follow the matching install commands below.

Update Fedora before installing MariaDB

Refresh package metadata first so DNF sees the current MariaDB build and any pending Fedora security updates.

sudo dnf upgrade --refresh -y

These commands use sudo for tasks that need root privileges. If your account is not in the sudoers file yet, follow the guide to add a user to sudoers on Fedora first.

Reboot before continuing if the upgrade pulled in a new kernel and you want the database service to start against the fully updated system.

Install MariaDB 10.11 (default LTS) on Fedora

Install the default server package from Fedora’s repositories. This is the only package you need on a host that will both run MariaDB and administer it locally.

sudo dnf install -y mariadb-server

The mariadb-server package also pulls in the mariadb client and Fedora’s mysql-selinux policy package, so you do not need a separate client install on the same host.

rpm -q mariadb-server mariadb mysql-selinux

mariadb-server-10.11.16-2.fc43.x86_64
mariadb-10.11.16-2.fc43.x86_64
mysql-selinux-1.0.14-2.fc43.noarch

Install MariaDB 11.8 (newer LTS) on Fedora

Fedora 43 also carries MariaDB 11.8 under explicitly versioned package names. Use these if you want the newer LTS branch instead of the 10.11 default.

sudo dnf install -y mariadb11.8-server

The mariadb11.8-server package pulls in its own matching mariadb11.8 client and the same mysql-selinux policy. The service unit, data directory, and port are identical to the 10.11 path.

rpm -q mariadb11.8-server mariadb11.8 mysql-selinux

mariadb11.8-server-11.8.6-2.fc43.x86_64
mariadb11.8-11.8.6-2.fc43.x86_64
mysql-selinux-1.0.14-2.fc43.noarch

Enable and start MariaDB on Fedora

Fedora installs MariaDB without starting it, so enable the service explicitly on the first run.

sudo systemctl enable --now mariadb

The service unit initializes the data directory during the first startup, so the normal DNF workflow does not need a separate mariadb-install-db step.

systemctl is-enabled mariadb && systemctl is-active mariadb

enabled
active

Check the MariaDB version on Fedora

Confirm which MariaDB branch Fedora installed before you start creating databases or comparing package behavior with other distributions.

mariadb --version

MariaDB 11.8 reports:

mariadb from 11.8.6-MariaDB, client 15.2 for Linux (x86_64) using  EditLine wrapper

MariaDB 10.11 reports:

mariadb  Ver 15.1 Distrib 10.11.16-MariaDB, for Linux (x86_64) using  EditLine wrapper

Get Started with MariaDB on Fedora

Once the service is running, switch from the root account to a dedicated database login as quickly as possible. That keeps web applications and scripts off the MariaDB administrative account.

Open the MariaDB shell on Fedora

Use the MariaDB-native client name for the first administrative login. Fedora also installs the legacy mysql alias, but mariadb makes the server family clearer in scripts and matches the normal sudo mariadb admin workflow.

sudo mariadb

Leave the shell with exit or \q when you are done.

Create a database and application user on Fedora

Create a dedicated database and login for the application that will use MariaDB. Replace myappdb, myappuser, and the sample password with values that fit your workload.

CREATE DATABASE myappdb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'myappuser'@'localhost' IDENTIFIED BY 'ChangeMe123!';
GRANT ALL PRIVILEGES ON myappdb.* TO 'myappuser'@'localhost';
FLUSH PRIVILEGES;

The temporary MYSQL_PWD variable below lets you test the new login once without writing the password into a config file. Replace the sample password before you run it.

MYSQL_PWD="ChangeMe123!" mariadb -h 127.0.0.1 -u myappuser -D myappdb -e "SELECT DATABASE(), CURRENT_USER();"

DATABASE()      CURRENT_USER()
myappdb         myappuser@localhost

If this Fedora host is heading toward a full web stack, continue with install Nginx on Fedora and install PHP on Fedora, then configure Nginx for PHP-FPM on Fedora once the database login is working.

Secure MariaDB on Fedora

Fedora’s MariaDB package already skips some of the classic insecure defaults, but it still needs an explicit hardening pass. On Fedora 43, anonymous users and the test database were already absent, yet MariaDB listened on all interfaces until a bind address was set.

If the database and the application share the same Fedora host, keep MariaDB on localhost and skip remote access entirely. Opening port 3306 to other machines should be the exception, not the baseline.

Run the MariaDB hardening command on Fedora

Run MariaDB’s interactive hardening script once after the service starts. On a fresh install, press Enter when it asks for the current root password.

sudo mariadb-secure-installation

Relevant prompts include:

Enter current password for root (enter for none):
Switch to unix_socket authentication [Y/n]
Change the root password? [Y/n]
Remove anonymous users? [Y/n]
Disallow root login remotely? [Y/n]
Remove test database and access to it? [Y/n]
Reload privilege tables now? [Y/n]

Choose explicit MariaDB hardening answers on Fedora

• Current root password: Press Enter on a fresh Fedora install.
• Switch to unix_socket authentication: Answer Y for most single-host servers so local administration stays tied to sudo mariadb instead of a shared root password.
• Change the root password: Answer Y only if you deliberately need a password-based root login in addition to local socket access.
• Remove anonymous users: Answer Y. Fedora 43 already omits anonymous users, but the cleanup is still safe to confirm.
• Disallow root login remotely: Answer Y.
• Remove the test database: Answer Y. Fedora 43 already omits it, but the prompt is still worth clearing.
• Reload privilege tables now: Answer Y so every change takes effect immediately.

The unix_socket prompt can look a little contradictory on Fedora because MariaDB already treats the root account as protected before you finish the script. In practice, a plain mariadb -u root login still fails for unprivileged users, while sudo mariadb remains the clean local admin path. This applies equally to both the 10.11 and 11.8 branches.

The official mariadb-secure-installation documentation covers the full prompt set, but these answers are the safest baseline for a normal Fedora application host.

Keep MariaDB local-only on Fedora

If MariaDB only serves applications on the same Fedora machine, add a small drop-in that binds the server to 127.0.0.1 instead of editing Fedora’s packaged config file in place.

printf '%s\n' '[mysqld]' 'bind-address=127.0.0.1' | sudo tee /etc/my.cnf.d/99-mariadb-local-only.cnf > /dev/null

The tee command writes the new drop-in as root because plain shell redirection does not inherit sudo. Keeping the setting in /etc/my.cnf.d/ also makes it easier to undo later.

sudo systemctl restart mariadb
ss -ltn | grep 3306

LISTEN 0      80         127.0.0.1:3306      0.0.0.0:*

The second command filters the socket list with grep command in Linux with examples, so you only see MariaDB’s 3306 listener.

If another host truly needs MariaDB, replace 127.0.0.1 with the server’s LAN address or 0.0.0.0, then allow only the narrow firewall rule you actually need. Fedora ships a mysql firewalld service definition, so start with the guide to install firewalld on Fedora before you expose port 3306.

Troubleshoot MariaDB on Fedora

These are the Fedora-specific problems most likely to cause confusion on a fresh MariaDB install.

MariaDB root login fails without sudo on Fedora

Fedora’s default root account definition is meant for local administrative access, not for an unprivileged shell using mariadb -u root directly.

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

Use the system root account for the first admin session, then keep day-to-day application access on dedicated database users instead of the MariaDB root account.

sudo mariadb -e "SELECT 1;"

1
1

A web app still cannot reach MariaDB over TCP on Fedora

If an Apache or Nginx application connects to MariaDB over TCP instead of the local socket, Fedora’s SELinux policy can block the request even when the credentials and bind address are correct.

getsebool httpd_can_network_connect_db
sudo setsebool -P httpd_can_network_connect_db 1
getsebool httpd_can_network_connect_db

httpd_can_network_connect_db --> off
httpd_can_network_connect_db --> on

If the web app and MariaDB share the same Fedora host, using the local MariaDB socket instead of TCP can avoid this SELinux toggle and keeps database traffic off the network stack.

Remove MariaDB from Fedora

Remove the packages first, then decide whether the database files and any local hardening drop-ins should stay for backup or troubleshooting.

Stop the service and remove MariaDB packages on Fedora

Disable the service before removal so it does not try to start again during future boots. Use the remove command that matches whichever branch you installed.

sudo systemctl disable --now mariadb

For MariaDB 10.11 (default):

sudo dnf remove -y mariadb-server mariadb

For MariaDB 11.8:

sudo dnf remove -y mariadb11.8-server mariadb11.8

DNF also removes the weak dependencies that came in with the server package, including mysql-selinux, so you do not need a separate dependency cleanup step.

Delete MariaDB data, logs, and local drop-ins on Fedora

Only do this when you are certain the host should not keep any local MariaDB state for backup, rollback, or future reuse.

Only remove the MariaDB data directory after you have confirmed your backups. Deleting /var/lib/mysql permanently removes the local databases stored on this Fedora host.

Fedora removes the packaged /etc/my.cnf.d/mariadb-server.cnf file with the package itself, but it leaves your data directory, log directory, and any local drop-ins you created. Remove them manually only if you are truly retiring MariaDB from this machine.

sudo rm -rf /var/lib/mysql /var/log/mariadb /etc/my.cnf.d/99-mariadb-local-only.cnf

Verify MariaDB removal on Fedora

Check that the server, client, and SELinux package are all gone before you treat the removal as complete. Run the check that matches the branch you installed.

rpm -q mariadb-server mariadb mariadb11.8-server mariadb11.8 mysql-selinux

package mariadb-server is not installed
package mariadb is not installed
package mariadb11.8-server is not installed
package mariadb11.8 is not installed
package mysql-selinux is not installed

MariaDB on Fedora FAQ

Conclusion

MariaDB is running on Fedora with either the 10.11 or 11.8 LTS branch, a dedicated application login, and a local-only hardening option you can keep by default. If this host is turning into a full stack, continue with install Nginx on Fedora, install PHP on Fedora, and install firewalld on Fedora before you expose the database beyond localhost.