How to Install MariaDB on Debian 13, 12 and 11

Debian’s default APT sources already give you a production-friendly MariaDB branch, which is usually the cleanest way to stand up a MySQL-compatible database for WordPress, application backends, or local development. You can install MariaDB on Debian 13 (trixie), Debian 12 (bookworm), and Debian 11 (bullseye) without adding a third-party repository.

That Debian repository path stays the focus here. Debian 13 ships MariaDB 11.8.x, Debian 12 ships 10.11.x, and Debian 11 stays on 10.5.x from the default package sources. The rest of the workflow covers service checks, initial hardening, client-only installs, removal, and the version questions readers keep searching for.

Install MariaDB on Debian

Debian keeps MariaDB in its own repositories, so the install path is the same across supported releases even though the packaged branch changes by release.

Debian Release	Default MariaDB	Package Source	Best Fit
Debian 13 (trixie)	MariaDB 11.8.x	trixie/main	New deployments that want the newest Debian-packaged MariaDB branch
Debian 12 (bookworm)	MariaDB 10.11.x	bookworm/main	Stable production stacks that want the current Debian 12 baseline
Debian 11 (bullseye)	MariaDB 10.5.x	bullseye-security	Older Debian 11 systems that still need the distro-supported branch

Debian 11 is the outlier here because the current MariaDB 10.5 candidate comes from bullseye-security, not just bullseye/main. That matters when you compare apt-cache policy output across Debian releases and wonder why Bullseye shows two package lines for the same branch.

On Debian 13, 12, and 11, the default-mysql-server metapackage resolves to MariaDB rather than Oracle MySQL. If you specifically need Oracle’s server packages, follow install MySQL 8.0 on Debian instead of assuming the generic MySQL metapackage changes vendors.

The workflow here stays with Debian’s repository packages only. If you need a newer upstream MariaDB branch than your Debian release provides, treat that as a separate repository workflow instead of mixing it into the default APT path.

Update Debian package lists before installing MariaDB

Refresh the package index first so APT sees the current MariaDB packages and any pending security updates from your configured Debian mirrors.

sudo apt update && sudo apt upgrade -y

These commands use sudo for tasks that need root privileges. If your account does not have sudo access yet, follow the guide on how to add a user to sudoers on Debian.

Reboot before continuing if the upgrade pulled in a new kernel or other core system libraries that you want fully loaded before the database service starts.

Install MariaDB server and client on Debian

Install both packages from Debian’s default repositories so you get the database daemon and the command-line client in one step.

sudo apt install mariadb-server mariadb-client -y

The mariadb-server package provides the database service, while mariadb-client gives you the mariadb shell for local administration, remote logins, dumps, and version checks. Because this workflow stays inside Debian’s own repositories, you do not need a separate MariaDB repo or GPG key just to complete the default install.

Verify the installed MariaDB version on Debian

Run the client version check to confirm which MariaDB branch your Debian release installed.

mariadb --version

mariadb from 11.8.6-MariaDB, client 15.2 for debian-linux-gnu (x86_64) using EditLine wrapper

That example comes from Debian 13. Debian 12 reports the 10.11.14 branch, and Debian 11 reports the 10.5.29 branch, which lines up with the release table above.

Check the MariaDB service state on Debian

Verify that systemd enabled the database service at boot and that the server is already running.

systemctl is-enabled mariadb && systemctl is-active mariadb

enabled
active

If the second line comes back as inactive or failed, start the service now and enable it for the next boot.

sudo systemctl enable mariadb --now

Install only the MariaDB client on Debian

If you only need the SQL client for a remote database server, skip the local daemon and install just the client package.

sudo apt install mariadb-client -y

This installs the mariadb CLI without creating a local MariaDB service or data directory, which is the cleaner choice for application servers, jump boxes, and administration hosts that only connect outward.

Secure MariaDB on Debian

Debian 13 ships mariadb-secure-installation as the main hardening command, while Debian 12 and Debian 11 also keep the older mysql_secure_installation name. Use the MariaDB-native command here so the same instruction works across all supported Debian releases.

Run the MariaDB hardening command on Debian

Run the interactive hardening pass once to remove the unsafe defaults that ship with a fresh MariaDB install.

sudo mariadb-secure-installation

Switch to unix_socket authentication [Y/n]
Change the root password? [Y/n]
Remove anonymous users? [Y/n]
Disallow root login remotely? [Y/n]
Remove test database and access to it? [Y/n]
Reload privilege tables now? [Y/n]

The exact wording can vary a little by branch, but these are the prompt groups you should expect on Debian’s packaged MariaDB releases.

What the MariaDB security prompts change on Debian

• unix_socket authentication: Lets the Linux root account administer MariaDB locally without a separate database password.
• Root password: Adds a password-based fallback for tools or workflows that do not use socket authentication.
• Anonymous users: Removes empty test accounts that should never stay on a real server.
• Remote root logins: Keeps the root database account restricted to local administration.
• Test database: Deletes the default test database and the broad permissions tied to it.
• Privilege reload: Applies each change immediately without waiting for a restart.

For most servers, answering Y to each cleanup prompt is the safer baseline. If you know you need a different root authentication model for a specific application or management tool, make that decision deliberately instead of leaving the defaults in place by accident.

Basic MariaDB Administration on Debian

Once the service is running and hardened, a few quick checks make day-to-day administration easier.

Open the MariaDB shell on Debian

If you accepted unix_socket authentication during hardening, the Linux root account can open the MariaDB shell directly.

sudo mariadb

If you switched to password-based root authentication instead, use mariadb -u root -p and enter the database password when prompted.

Check MariaDB localhost binding on Debian

Debian’s default MariaDB configuration binds the server to localhost, which is the safer choice when the web application and the database run on the same machine.

sudo grep -E '^bind-address' /etc/mysql/mariadb.conf.d/50-server.cnf

bind-address = 127.0.0.1

Leave that setting alone unless a separate application server genuinely needs to connect over the network. If you do open MariaDB beyond localhost, lock port 3306 down to trusted source addresses and review install UFW on Debian before you expose the service.

Use MariaDB with a Debian web stack

MariaDB usually sits inside a wider web stack rather than on its own. If you are building that next layer now, pair it with install LEMP on Debian, add a browser-based database UI with install phpMyAdmin with Nginx on Debian, or keep the stack component-by-component with install Nginx on Debian and install PHP on Debian.

Remove MariaDB from Debian

If you no longer need the local database service, remove the packages first, then decide whether the data directory should stay for backups or be deleted as well.

Stop and remove MariaDB packages on Debian

Disable the service so it does not try to start during package removal.

sudo systemctl disable --now mariadb

Remove the server, client, and the generic MySQL metapackages if they are installed on the host.

sudo apt remove --purge mariadb-server mariadb-client default-mysql-server default-mysql-client -y

Review the dependency cleanup list before you confirm it. On reused systems, apt autoremove can also offer to remove packages you may want to keep.

sudo apt autoremove

Delete MariaDB data directories on Debian

Only remove the MariaDB data directory after you have confirmed your backups. Deleting /var/lib/mysql permanently removes the local databases stored on this server.

sudo rm -rf /var/lib/mysql /etc/mysql

Verify MariaDB removal on Debian

Check the package state after removal. On Debian 13, the installed line should be empty while the candidate still reflects the repository version available for reinstall.

apt-cache policy mariadb-server

mariadb-server:
  Installed: (none)
  Candidate: 1:11.8.6-0+deb13u1

Debian 12 and Debian 11 show their own repository candidate instead, but the key check stays the same: Installed: (none) confirms the package is gone.

MariaDB on Debian FAQ

Conclusion

MariaDB is now installed on Debian through the distro’s own package stream, the service state is easy to verify through systemd, and the initial hardening pass closes the default security gaps before you start creating real databases. If this host is headed toward a web stack, continue with install Nginx on Debian, install PHP on Debian, or install phpMyAdmin with Nginx on Debian.