LFCE 128 🐧 Grafana — Installation - KandZ

⏱️ Estimated read: 11 min | |

Grafana is a visualization and dashboarding platform that queries data sources and renders the results as graphs, tables, and alerts. It does not collect or store metrics itself. It connects to Prometheus, Loki, or any other supported data source and provides the interface for exploring and sharing what those systems contain. Installing Grafana means installing the web server, the configuration file that controls its behavior, and the systemd unit that keeps it running.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

This chapter covers the installation of Grafana OSS on Linux: the package and binary installation methods for Debian/Ubuntu and RHEL/Fedora, the configuration file at /etc/grafana/grafana.ini, the systemd service that starts the server, and the first login that changes the default credentials. It also covers the firewall rule that restricts access to the web interface and the data source connection that connects Grafana to Prometheus.

Key point: Grafana’s default login is admin/admin and its default port is 3000. The first login prompts for a password change. Leaving the default credentials in place on a reachable interface is an immediate compromise.

Why installation has these steps

The repository problem. The package managers’ default repositories do not contain Grafana. The installation must either download the .deb or .rpm directly from Grafana’s release page, or add Grafana’s package repository to the system’s package manager configuration . The direct download is simpler for a single host. The repository is better for a fleet, because updates can be applied with the normal package manager workflow.

The configuration problem. Grafana reads /etc/grafana/grafana.ini at startup. The file contains the HTTP port, the database backend (SQLite by default, MySQL or PostgreSQL for larger deployments), the admin credentials, and the authentication providers . Most installations can run with the defaults, but the HTTP port and the database backend are the two settings that change as the deployment grows.

The service problem. The package installation creates a grafana-server systemd unit. The service must be enabled at boot and started. A binary installation does not create the unit, so it must be written manually or the binary run under a process supervisor .

a. Installing on Debian and Ubuntu

The package installation is a single dpkg command after downloading the .deb. The dependencies are adduser, libfontconfig1, and musl .

# Install dependencies and the package
sudo apt-get install -y adduser libfontconfig1 musl
wget https://dl.grafana.com/grafana/release/13.2.1/grafana_13.2.1_33191028959_linux_amd64.deb
sudo dpkg -i grafana_13.2.1_33191028959_linux_amd64.deb

The version numbers in the URL change with each release. The release page at grafana.com/grafana/download lists the current stable version and provides the exact URL and checksum for each platform . The checksum should be verified before installation.

The package creates the grafana system user, the configuration directory, the data directory, and the systemd unit. It does not start the service automatically on all distributions.

# Reload systemd, enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable --now grafana-server
systemctl status grafana-server --no-pager

The service listens on port 3000 by default. The status output confirms that the server started and that the HTTP listener is active.

b. Installing on RHEL and Fedora

The RHEL-family installation uses yum or dnf with the .rpm URL. The package name is grafana for the OSS edition and grafana-enterprise for the enterprise edition .

# Install the OSS package directly from the URL
sudo yum install -y https://dl.grafana.com/grafana/release/13.2.1/grafana_13.2.1_33191028959_linux_amd64.rpm

The package creates the same directory structure and systemd unit as the Debian package. The service is managed with systemctl in the same way.

sudo systemctl daemon-reload
sudo systemctl enable --now grafana-server

For a fleet, the Grafana YUM repository is the better choice. The repository configuration is added to /etc/yum.repos.d/grafana.repo, and dnf install grafana installs and updates from it .

c. The configuration file

The main configuration file is /etc/grafana/grafana.ini. The file is heavily commented, with every setting documented inline. The default HTTP port is 3000, the default database is SQLite at /var/lib/grafana/grafana.db, and the default admin user is admin with password admin .

# /etc/grafana/grafana.ini
[server]
http_port = 3000
domain = grafana.example.com

[database]
type = sqlite3
path = /var/lib/grafana/grafana.db

[security]
admin_user = admin
admin_password = admin

The admin_password setting in the file is only used on the first startup, when the database is initialized. After the first login, the password is stored in the database, and the grafana.ini value is ignored. Changing the password through the web interface is the correct way to update it.

For a production deployment, the SQLite backend is the first thing to replace. SQLite serializes writes and is not suitable for multiple Grafana instances or high query concurrency. MySQL or PostgreSQL is configured in the [database] section.

d. First login and password change

The web interface is reachable at http://<host>:3000. The first login uses admin/admin. Grafana immediately prompts for a new password. The new password must be set before the interface is usable.

# Verify the HTTP listener
ss -tlnp | grep 3000

# The web interface is at http://<host>:3000

The password change is mandatory. A Grafana instance with the default credentials and a reachable port is a dashboard that anyone on the network can edit.

e. Firewall and data source

The Grafana web interface should be restricted to the networks that need it. On a host with ufw, the rule allows the admin subnet and denies everything else.

# Allow the admin network, deny the rest
sudo ufw allow from 10.0.1.0/24 to any port 3000 proto tcp
sudo ufw deny 3000/tcp

Once logged in, the data source is added through the side menu: Connections → Data sources → Add data source. For a Prometheus server, the URL is the Prometheus HTTP endpoint, typically http://prometheus.example.com:9090. The “Save & test” button verifies that Grafana can reach the data source and that the Prometheus API responds.

Complete Example Session

# ============================================
# PART 1: INSTALL DEPENDENCIES (DEBIAN/UBUNTU)
# ============================================
sudo apt-get install -y adduser libfontconfig1 musl

# ============================================
# PART 2: DOWNLOAD AND INSTALL THE PACKAGE
# ============================================
wget https://dl.grafana.com/grafana/release/13.2.1/grafana_13.2.1_33191028959_linux_amd64.deb
sudo dpkg -i grafana_13.2.1_33191028959_linux_amd64.deb

# ============================================
# PART 3: ENABLE AND START THE SERVICE
# ============================================
sudo systemctl daemon-reload
sudo systemctl enable --now grafana-server
systemctl status grafana-server --no-pager

# ============================================
# PART 4: VERIFY THE LISTENER
# ============================================
ss -tlnp | grep 3000
# Expected: LISTEN 0 4096 *:3000 *:*

# ============================================
# PART 5: CONFIGURE THE HTTP PORT
# ============================================
# Edit /etc/grafana/grafana.ini
# [server]
# http_port = 3000

sudo systemctl restart grafana-server

# ============================================
# PART 6: CONFIGURE THE DATABASE
# ============================================
# For production, replace SQLite with PostgreSQL
# [database]
# type = postgres
# host = 127.0.0.1:5432
# name = grafana
# user = grafana
# password = <password>

sudo systemctl restart grafana-server

# ============================================
# PART 7: FIREWALL RULE
# ============================================
sudo ufw allow from 10.0.1.0/24 to any port 3000 proto tcp
sudo ufw deny 3000/tcp
sudo ufw status

# ============================================
# PART 8: FIRST LOGIN
# ============================================
# Open http://<host>:3000
# Login: admin / admin
# Set a new password when prompted

# ============================================
# PART 9: ADD PROMETHEUS DATA SOURCE
# ============================================
# Connections → Data sources → Add data source → Prometheus
# URL: http://prometheus.example.com:9090
# Save & test

# ============================================
# PART 10: VERIFY THE DATA SOURCE
# ============================================
# Explore → select the Prometheus data source
# Query: up
# The result shows the scrape targets

The ten parts covered dependencies, package installation, service enablement, listener verification, HTTP port configuration, database configuration, firewall rules, first login, data source addition, and data source verification.

Quick Reference

Installation methods

Platform	Command
Debian/Ubuntu	`dpkg -i grafana_<ver>_linux_amd64.deb`
RHEL/Fedora	`yum install -y <grafana.rpm URL>`
Binary	`tar -zxvf grafana_<ver>_linux_amd64.tar.gz`
Repository	Add Grafana repo, then `apt install grafana` or `dnf install grafana`

Key paths

Path	Purpose
`/etc/grafana/grafana.ini`	Main configuration
`/var/lib/grafana/grafana.db`	SQLite database (default)
`/var/log/grafana/`	Log directory
`/usr/share/grafana/`	Static assets and public files

Default settings

Setting	Value
HTTP port	3000
Admin user	`admin`
Admin password	`admin`
Database	SQLite

Service management

Command	Effect
`systemctl enable --now grafana-server`	Enable and start
`systemctl status grafana-server`	Check status
`systemctl restart grafana-server`	Apply configuration changes

Best Practices

✅ Do This:

# Change the admin password immediately after first login
# (prompted automatically)                                # ✅

# Restrict the web interface to the admin network
ufw allow from 10.0.1.0/24 to any port 3000              # ✅

# Use PostgreSQL for production deployments
[database]
type = postgres                                          # ✅

# Verify the package checksum before installation
sha256sum grafana_*.deb                                  # ✅

❌ Don’t Do This:

# Leave admin/admin on a reachable interface
# Anyone can edit dashboards and data sources             # ❌

# Expose port 3000 to the public internet
ufw allow 3000/tcp                                       # ❌

# Run multiple Grafana instances on SQLite
# SQLite serializes writes and corrupts under concurrency  # ❌

# Edit grafana.ini for the admin password after first login
# The database value wins; use the UI or CLI               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Service fails to start	Port 3000 already in use	Check `ss -tlnp \| grep 3000` and change `http_port`
Login fails after password change	`grafana.ini` password overrides database	Remove `admin_password` from the config
Data source test fails	Prometheus unreachable or wrong URL	Verify the URL and network path
Database locked errors	SQLite concurrency	Switch to PostgreSQL or MySQL
Dashboards lost after upgrade	SQLite file not backed up	Back up `/var/lib/grafana/grafana.db`

Real-World Examples

1. Install on Debian

sudo apt-get install -y adduser libfontconfig1 musl && wget https://dl.grafana.com/grafana/release/13.2.1/grafana_13.2.1_33191028959_linux_amd64.deb && sudo dpkg -i grafana_13.2.1_33191028959_linux_amd64.deb

2. Install on RHEL

sudo yum install -y https://dl.grafana.com/grafana/release/13.2.1/grafana_13.2.1_33191028959_linux_amd64.rpm

3. Enable and start

sudo systemctl enable --now grafana-server

4. Check status

systemctl status grafana-server --no-pager

5. Verify listener

ss -tlnp | grep 3000

6. Change HTTP port

[server]
http_port = 3000

7. PostgreSQL backend

[database]
type = postgres
host = 127.0.0.1:5432

8. Firewall rule

sudo ufw allow from 10.0.1.0/24 to any port 3000 proto tcp

9. First login

http://<host>:3000  →  admin / admin  →  change password

10. Add Prometheus data source

Connections → Data sources → Prometheus → URL → Save & test

Visual

The installation flow

┌─────────────────────────────────────────────────────────────┐
│  GRAFANA INSTALLATION FLOW                                   │
│                                                              │
│  Download .deb/.rpm or add repository                        │
│       │                                                      │
│       ▼                                                      │
│  Install package                                             │
│       │                                                      │
│       ▼                                                      │
│  systemctl enable --now grafana-server                       │
│       │                                                      │
│       ▼                                                      │
│  Verify port 3000                                            │
│       │                                                      │
│       ▼                                                      │
│  First login: admin/admin → change password                  │
│       │                                                      │
│       ▼                                                      │
│  Add data source (Prometheus, Loki, etc.)                   │
│       │                                                      │
│       ▼                                                      │
│  Create dashboards                                           │
└─────────────────────────────────────────────────────────────┘

Directory structure

┌─────────────────────────────────────────────────────────────┐
│  GRAFANA PATHS                                               │
│                                                              │
│  /etc/grafana/grafana.ini      main configuration            │
│  /var/lib/grafana/grafana.db   SQLite database               │
│  /var/lib/grafana/plugins/     installed plugins             │
│  /var/log/grafana/             logs                          │
│  /usr/share/grafana/           static assets                 │
│                                                              │
│  The systemd unit: /usr/lib/systemd/system/grafana-server.service│
└─────────────────────────────────────────────────────────────┘

Default vs production

┌─────────────────────────────────────────────────────────────┐
│  DEFAULT                        PRODUCTION                   │
│                                                              │
│  Port 3000                      Custom port or reverse proxy│
│  admin/admin                    Changed password             │
│  SQLite                         PostgreSQL/MySQL             │
│  No firewall                    Restricted to admin network │
│  No TLS                         TLS via reverse proxy        │
└─────────────────────────────────────────────────────────────┘

Data source connection

┌─────────────────────────────────────────────────────────────┐
│  GRAFANA → PROMETHEUS                                        │
│                                                              │
│  Grafana (port 3000)                                         │
│       │                                                      │
│       │ HTTP query                                           │
│       ▼                                                      │
│  Prometheus (port 9090)                                      │
│       │                                                      │
│       ▼                                                      │
│  Time series database                                        │
│                                                              │
│  Grafana does not store metrics.                             │
│  It queries the data source on every dashboard render.       │
└─────────────────────────────────────────────────────────────┘

Summary

Item	Value
Package (Debian)	`grafana_<ver>_linux_amd64.deb`
Package (RHEL)	`grafana-<ver>_linux_amd64.rpm`
Configuration	`/etc/grafana/grafana.ini`
Default port	3000
Default login	`admin` / `admin`
Default database	SQLite (`/var/lib/grafana/grafana.db`)
Service	`grafana-server`
First step after login	Change the admin password
Data source	Prometheus at `http://prometheus:9090`

Key takeaways:

Grafana is installed from a direct package download or the Grafana repository. The direct .deb or .rpm is the simplest for a single host; the repository is better for a fleet because updates use the normal package manager workflow .
The default credentials are admin/admin. The first login prompts for a password change, and that change is mandatory. A Grafana instance with the default credentials and a reachable port is an open dashboard.
The configuration file is /etc/grafana/grafana.ini. The HTTP port, database backend, and authentication providers are set there. The admin password in the file is only used on first startup; after that, the database value wins .
SQLite is the default and the wrong choice for production. It serializes writes and does not handle multiple Grafana instances. The [database] section should point to PostgreSQL or MySQL before the deployment grows.
The data source is what makes Grafana useful. Grafana does not collect or store metrics. It queries Prometheus (or another data source) on every dashboard render, and the “Save & test” button verifies the connection.
The firewall rule restricts port 3000 to the admin network. The web interface is unauthenticated until the first login, and the default credentials are known. The firewall is the first line of defense.

Remember: Grafana installation is a package, a service, and a configuration file. Install the package, enable the service, verify the listener, and change the default password before doing anything else. The configuration file controls the port and the database; the default SQLite backend is fine for a test instance and wrong for a production one. The data source connection is the point of the installation: Grafana without a data source is an empty dashboard. Connect Prometheus, verify the “Save & test” result, and then the dashboards become useful.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!