Latest Debian 12 update opens MariaDB server to the internet

#1

Post by babuskov » Sun, Jul 12, 2026, 2:33 PM UTC

I have a couple servers with Debian 12, running MariaDB. The servers were configured with bind-address 127.0.0.1:3306 so that any database connections are local.

I upgraded to Debian 12.15 today, rebooted and checked open ports just to see if all services are running.

To my surprise, MariaDB is no longer listening on 127.0.0.1:3306, but we have "init" listening on :::3306.

It looks like default config has changed to use Systemd sockets. Which I guess is fine, but silently making your database server accessible to the whole Internet doesn't sound like a good idea.

So, just PSA, if you rely on bind-address only, make sure you reconfigure the mariadb.socket settings.

Re: Latest Debian 12 update opens MariaDB server to the internet

#2

Post by debpalash » Sun, Jul 12, 2026, 5:18 PM UTC

Yikes, on debain seems highly alarming, remeber times when used to turn to debain for stability and security of servers.

Re: Latest Debian 12 update opens MariaDB server to the internet

#3

Post by gib444 » Sun, Jul 12, 2026, 8:23 PM UTC

Can you repro on a fresh install?

Re: Latest Debian 12 update opens MariaDB server to the internet

#4

Post by atmosx » Sun, Jul 12, 2026, 8:43 PM UTC

The Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying…

Re: Latest Debian 12 update opens MariaDB server to the internet

#5

Post by khurs » Mon, Jul 13, 2026, 9:47 AM UTC

Have you reported it to Debian as a bug?

Re: Latest Debian 12 update opens MariaDB server to the internet

#6

Post by gib444 » Mon, Jul 13, 2026, 8:17 PM UTC

Bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141976

Re: Latest Debian 12 update opens MariaDB server to the internet

#7

Post by babuskov » Tue, Jul 14, 2026, 12:37 PM UTC

atmosx wrote: post #4

The Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying…

Yeah, I have firewall set up to disallow everything except whitelisted ports, so my system was never in jeopardy. Maybe I should have mentioned that in my original post.