Install MySQL on Linux (Debian, Ubuntu, Rocky, RHEL)

Linux distributions often ship MariaDB instead of MySQL, or a MySQL version frozen for the whole life of the distribution. If you want MySQL 8.4 LTS, the Long Term Support release with 8 years of security fixes, Oracle's official repository is the path to prefer.

This guide takes you from A to Z: adding the repository, installing the packages, checking the service, initial hardening (including restricting the network listening) and the first connection. In a few minutes you will have a working MySQL instance, ready for the other guides in this section.

Version used

This guide relies on MySQL 8.4 LTS and covers Oracle's official repository (.deb and .rpm packages). The command outputs were captured on Debian 12 (bookworm); the associated lab runs on Debian 13 (trixie), which this repository also serves. The procedure is the same for Ubuntu 22.04+. The Rocky Linux / RHEL 9 instructions are given alongside. Differences are flagged in the callouts. Installable version checked on 2026-10-20: 8.4.11. Version 8.4.12, published on 2026-08-18, was not yet served by Oracle's APT and EL9 repositories on that date.

What you will learn

• Add Oracle's official APT or YUM repository and install MySQL 8.4 LTS
• Understand the difference between the Debian installation (password set during installation) and the RHEL one (temporary password generated)
• Check that the service is active with systemctl and connect with the mysql client
• Secure the installation with mysql_secure_installation (remove the anonymous user, disable remote root access)
• Restrict the network listening of mysqld, which listens on all interfaces after installation
• Identify the configuration files and where they live depending on the distribution

In what context?

This guide is your entry point if you are in one of these situations:

• You are setting up a server for development or testing and want MySQL (not MariaDB)
• You need to standardise the MySQL version across several machines (Debian + RHEL in the same estate)
• You are preparing a lab to follow the configuration, backup or replication guides of this section
• Your distribution ships MariaDB by default and you want to install Oracle's official MySQL
• You are deploying MySQL for the first time and want to understand what the installation creates on the system

What this guide does not cover

Installation lays the foundations; the rest has its own guides. To understand the architecture (instance, InnoDB, buffer pool) and the vocabulary before administering, read Discover MySQL. To tune memory, connections and logging, go to the configuration guide. For dedicated accounts, TLS, roles and least privilege, see security. And to use the mysql client day to day (exploration, queries, import and export), read Getting started with the mysql client.

Prerequisites

• A Debian 12 or 13, Ubuntu 22.04+, Rocky Linux 9 or RHEL 9 server with root or sudo access
• An Internet connection (to download the packages from Oracle's repositories)
• No MariaDB version installed, because the packages conflict. If MariaDB is present, uninstall it first (see the Troubleshooting section)

MySQL vs MariaDB: clarification

Many Linux distributions (Debian, Rocky Linux, Fedora) ship MariaDB instead of MySQL in their default repositories. MariaDB is a fork of MySQL launched in 2009 by Michael Widenius, MySQL's original founder, while Oracle's acquisition of Sun Microsystems was under way: Sun owned MySQL, the merger agreement dates from 19 April 2009 and Oracle completed the deal on 26 January 2010, according to the Form 8-K Oracle filed with the SEC.

	MySQL (Oracle)	MariaDB
Publisher	Oracle Corporation	MariaDB Foundation / MariaDB plc
Current LTS version	8.4 (8-year support)	12.3, the latest (11.8, 11.4 and 10.11 remain LTS), as of 2026-10-20
Default engine	InnoDB	InnoDB, with Aria for system tables
Replication	GTID, Group Replication, InnoDB Cluster	GTID (different format), Galera Cluster
Default auth plugin	caching_sha2_password	mysql_native_password
Performance Schema	Complete	Partial (differences)

Swipe to see more

A word about Aria, which you meet quickly on the MariaDB side: it is the engine written to replace MyISAM while surviving crashes, and it holds MariaDB's system tables. It does not derive from InnoDB, which remains the engine for application tables on both sides.

The two systems share the network protocol and much of the SQL syntax, but they are not interchangeable in production. The specific extensions (Group Replication vs Galera, advanced Performance Schema, MySQL Shell) are not compatible.

This guide is about Oracle's official MySQL. If you want MariaDB, the installation commands are different.

Do not mix MySQL and MariaDB

Do not install MySQL and MariaDB on the same machine. The packages conflict (same file names, same port 3306, same socket). If MariaDB is installed, uninstall it completely before installing MySQL (see the Troubleshooting section).

Install from Oracle's official repositories

Debian / Ubuntu

1. Download Oracle's repository configuration package

   The mysql-apt-config package adds Oracle's APT sources and GPG keys. Download the current version from the official APT page:

   cd /tmp
   wget https://dev.mysql.com/get/mysql-apt-config_0.8.36-1_all.deb

   Package name

   The package version number (here 0.8.36-1) changes regularly. Check the APT download page for the up-to-date link.

2. Install the configuration package

   For a non-interactive installation that directly selects MySQL 8.4 LTS:

   sudo DEBIAN_FRONTEND=noninteractive dpkg -i mysql-apt-config_0.8.36-1_all.deb

   This package creates the file /etc/apt/sources.list.d/mysql.list with the right URL and Oracle's GPG key.

   Interactive version choice

   If you run sudo dpkg -i mysql-apt-config_*.deb without DEBIAN_FRONTEND=noninteractive, an interactive dialog screen appears to choose between MySQL 8.4 LTS and the Innovation versions. MySQL 8.4 LTS is already selected by default: select OK to confirm.

3. Update the sources and install MySQL

   sudo apt update
   sudo apt install -y mysql-server

   The installation automatically pulls in the dependencies: mysql-client, mysql-common, mysql-community-server, mysql-community-client.

   Root password at installation

   On Debian/Ubuntu, the installer offers to set the root password. You can also leave this field empty: local access then uses Unix socket authentication (auth_socket: the server trusts the name of the system user, with no password), and the password can be set afterwards with mysql_secure_installation. If you automate the installation, use debconf-set-selections to preconfigure it:

   echo "mysql-community-server mysql-community-server/root-pass password YourPassword" | sudo debconf-set-selections
   echo "mysql-community-server mysql-community-server/re-root-pass password YourPassword" | sudo debconf-set-selections

4. Check that the service is active

   sudo systemctl status mysql

   ● mysql.service - MySQL Community Server
        Loaded: loaded (/lib/systemd/system/mysql.service; enabled; preset: enabled)
        Active: active (running) since Mon 2026-04-13 08:49:23 UTC; 1min ago
          Docs: man:mysqld(8)
                http://dev.mysql.com/doc/refman/en/using-systemd.html
       Process: 4498 ExecStartPre=/usr/share/mysql/mysql-systemd-start pre (code=exited, status=0/SUCCESS)
      Main PID: 4521 (/usr/sbin/mysqld)
        Status: "Server is operational"
         Tasks: 39 (limit: 2314)
        Memory: 364.2M
           CPU: 3.241s
        CGroup: /system.slice/mysql.service
                └─4521 /usr/sbin/mysqld

Rocky Linux / RHEL

1. Install the official MySQL YUM repository

   sudo dnf install -y https://dev.mysql.com/get/mysql84-community-release-el9-3.noarch.rpm

   This RPM adds the repo file /etc/yum.repos.d/mysql-community.repo and Oracle's GPG keys.

   RPM name

   The RPM version number (here el9-3) changes regularly. Check the YUM download page for the up-to-date link.

2. Install MySQL

   sudo dnf install -y mysql-community-server

   EL8 systems

   On RHEL 8 / Rocky Linux 8, first disable the distribution's MySQL module with sudo dnf -qy module disable mysql. This step is not needed on EL9.

3. Start and enable the service

   Unlike Debian, the installation on RHEL does not start the service automatically:

   sudo systemctl enable --now mysqld

4. Retrieve the temporary root password

   On RHEL/Rocky, MySQL generates a temporary root password at first startup, written to the error log:

   sudo grep 'temporary password' /var/log/mysqld.log

   2026-04-13T08:49:28.123456Z 6 [Note] [MY-010454] [Server] A temporary password is generated for root@localhost: Xk8#fPz!2qLm

   Write this password down, you will need it for the first connection.

5. Change the root password

   Connect with the temporary password and change it immediately:

   mysql -u root -p

   ALTER USER 'root'@'localhost' IDENTIFIED BY 'YourPassword!2026';

   The sample password carries a digit and a special character, and that is not decoration. On RPM installations, the validate_password component is already active with the MEDIUM policy by default, which requires at least eight characters, a lowercase letter, an uppercase letter, a digit and a non-alphanumeric character. A simple password is rejected with ERROR 1819 (HY000): Your password does not satisfy the current policy requirements.

Key difference: Debian vs RHEL

On Debian/Ubuntu, the installer offers to set the root password (you can also leave the field empty to use Unix socket authentication). On RHEL/Rocky, MySQL generates a random temporary password that you have to retrieve from /var/log/mysqld.log and then change at first connection. This is a frequent source of "why can't I connect".

Check the installation

The systemd service

The MySQL service is called mysql on Debian/Ubuntu and mysqld on RHEL/Rocky:

Debian / Ubuntu

# Service state
sudo systemctl status mysql

# Stop / start / restart
sudo systemctl stop mysql
sudo systemctl start mysql
sudo systemctl restart mysql

# Enable start at boot
sudo systemctl enable mysql

Rocky Linux / RHEL

# Service state
sudo systemctl status mysqld

# Stop / start
sudo systemctl stop mysqld
sudo systemctl start mysqld

# Enable start at boot
sudo systemctl enable mysqld

Do not confuse an active service with an enabled one. Active (active (running) in systemctl status) means it is running right now. Enabled (enabled, visible on the Loaded: line and through systemctl is-enabled mysql, or mysqld on RHEL/Rocky) means it will be started at the next boot. Only the second guarantees that the instance comes back after the machine restarts.

Applying configuration changes

MySQL has no real reload like PostgreSQL. Most InnoDB parameters can only be changed with a restart, or dynamically with SET GLOBAL / SET PERSIST in SQL. The Configuration guide details the parameters that can be changed on the fly.

The installed packages

Here is what the Oracle installation puts on the system (Debian):

dpkg -l 'mysql*' | grep '^ii'

ii  mysql-apt-config         0.8.36-1         all    Auto configuration for MySQL APT Repo.
ii  mysql-client             8.4.11-1debian12 amd64  MySQL Client meta package for v8.4
ii  mysql-common             8.4.11-1debian12 amd64  MySQL Common
ii  mysql-community-client   8.4.11-1debian12 amd64  MySQL Client
ii  mysql-community-server   8.4.11-1debian12 amd64  MySQL Server
ii  mysql-server             8.4.11-1debian12 amd64  MySQL Server meta package for v8.4

Package	Contents
mysql-community-server	The mysqld server, the configuration files, the systemd scripts
mysql-community-client	The client tools: mysql, mysqldump, mysqladmin, mysqlbinlog
mysql-common	Shared configuration files
mysql-apt-config	Management of the Oracle repository (version selection)

Swipe to see more

The configuration files

The location of the configuration depends on the distribution:

Distribution	Server configuration	Datadir
Debian / Ubuntu	/etc/mysql/mysql.conf.d/mysqld.cnf	/var/lib/mysql/
RHEL / Rocky	/etc/my.cnf	/var/lib/mysql/

Swipe to see more

MySQL reads its configuration files in a precise order:

mysqld --verbose --help 2>/dev/null | grep -A1 "Default options"

Default options are read from the following files in the given order:
/etc/my.cnf /etc/mysql/my.cnf ~/.my.cnf

On Debian, the main file /etc/mysql/my.cnf includes the files of /etc/mysql/conf.d/ and /etc/mysql/mysql.conf.d/:

/etc/mysql/
├── my.cnf                          → Main file (includes conf.d/ and mysql.conf.d/)
├── conf.d/
│   └── mysql.cnf                   → mysql client options
└── mysql.conf.d/
    └── mysqld.cnf                  → mysqld server configuration

Here is the default content of mysqld.cnf (the essential parameters):

grep -v '^#\|^$' /etc/mysql/mysql.conf.d/mysqld.cnf

[mysqld]
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock
datadir         = /var/lib/mysql
log-error       = /var/log/mysql/error.log

This file contains no bind-address line, not even a commented one: the server therefore keeps its default value and listens on all interfaces. Oracle's RPM packages (/etc/my.cnf) behave the same way. The "How do you restrict MySQL's network listening?" section further down shows how to fix this.

Connect with the mysql client

The local connection goes through a Unix socket, which is the default behaviour when you do not specify -h. If you left the root password empty (auth_socket), replace the command below with sudo mysql:

mysql -u root -p

Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.4.11 MySQL Community Server - GPL

Copyright (c) 2000, 2026, Oracle and/or its affiliates.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

Check the version and the connection:

SELECT VERSION();

+-----------+
| VERSION() |
+-----------+
| 8.4.11    |
+-----------+

\s

--------------
mysql  Ver 8.4.11 for Linux on x86_64 (MySQL Community Server - GPL)

Connection id:          8
Current database:
Current user:           root@localhost
SSL:                    Not in use
Current pager:          stdout
Using outfile:          ''
Using delimiter:        ;
Server version:         8.4.11 MySQL Community Server - GPL
Protocol version:       10
Connection:             Localhost via UNIX socket
Server characterset:    utf8mb4
Db     characterset:    utf8mb4
Client characterset:    utf8mb4
Conn.  characterset:    utf8mb4
UNIX socket:            /var/run/mysqld/mysqld.sock
Binary data as:         Hexadecimal
Uptime:                 15 min 32 sec

Connection: Localhost via UNIX socket confirms that the connection goes through the socket, with no network.

Check the key parameters after installation

SELECT @@innodb_buffer_pool_size / 1024 / 1024 AS buffer_pool_mb,
       @@max_connections,
       @@bind_address,
       @@log_bin,
       @@gtid_mode;

+----------------+-----------------+--------------+---------+-----------+
| buffer_pool_mb | max_connections | bind_address | log_bin | gtid_mode |
+----------------+-----------------+--------------+---------+-----------+
|            128 |             151 | *            |       1 | OFF       |
+----------------+-----------------+--------------+---------+-----------+

Parameter	Default value	What it means
innodb_buffer_pool_size	128 MB	InnoDB memory cache, far too small for production
max_connections	151	Maximum of 151 simultaneous connections
bind_address	*	All interfaces: MySQL accepts network connections (see "How do you restrict MySQL's network listening?")
log_bin	ON (MySQL 8.4)	The binary log is enabled by default
gtid_mode	OFF	GTID is disabled by default, to be enabled for replication

Swipe to see more

Above all, remember the bind_address line: the value * means that mysqld listens on all network interfaces, not only on the local machine. The "How do you restrict MySQL's network listening?" section further down shows how to check this and fix it.

Now check the authentication plugin of the existing accounts:

SELECT user, host, plugin FROM mysql.user WHERE user = 'root';

+------+-----------+-----------------------+
| user | host      | plugin                |
+------+-----------+-----------------------+
| root | localhost | caching_sha2_password |
+------+-----------+-----------------------+

default_authentication_plugin removed in 8.4

In MySQL 8.4, the default_authentication_plugin variable is removed. The default plugin for new accounts remains caching_sha2_password. To check an account's plugin, query the mysql.user table.

Secure the initial installation

mysql_secure_installation

MySQL provides an interactive script that applies the first security measures:

sudo mysql_secure_installation

The script asks several questions depending on your installation method. On RPM/YUM installations, the validate_password component is often already installed and enabled at first startup, so the corresponding question does not appear.

Question	Recommended answer	Why
Setup VALIDATE PASSWORD component?	Yes (if offered)	Enables the password complexity policy
Password validation policy	MEDIUM (1)	Requires length + uppercase + digits + special characters
Change root password?	No (if already changed)	Pointless if you just set it during installation
Remove anonymous users?	Yes	Removes the nameless accounts that allow a connection without authentication
Disallow root login remotely?	Yes	Prevents root from connecting from another server
Remove test database?	Yes	Removes the test database that anyone can access
Reload privilege tables?	Yes	Applies the changes immediately

Swipe to see more

After running it, check that no anonymous account is left:

SELECT user, host, plugin FROM mysql.user;

+------------------+-----------+-----------------------+
| user             | host      | plugin                |
+------------------+-----------+-----------------------+
| mysql.infoschema | localhost | caching_sha2_password |
| mysql.session    | localhost | caching_sha2_password |
| mysql.sys        | localhost | caching_sha2_password |
| root             | localhost | caching_sha2_password |
+------------------+-----------+-----------------------+

Three system accounts (mysql.infoschema, mysql.session, mysql.sys) and the root@localhost account, no anonymous account, no root@% (remote) account. This check protects at the account level: it does not close the network, which is what the next section does.

Authentication plugin

All accounts use caching_sha2_password, the default plugin since MySQL 8.0. It is a secure replacement for the old mysql_native_password, and uses SHA-256 with a server-side cache mechanism for performance. If an old client does not support this plugin, the Security guide explains the compatibility options.

How do you restrict MySQL's network listening?

After an installation from the Oracle packages (.deb or .rpm), mysqld listens on all interfaces: the shipped configuration file contains no bind-address line, and the default value of the bind_address variable is * (MySQL 8.4 documentation, "Server System Variables" page). The TCP 3306 (classic protocol) and TCP 33060 (X protocol) ports are therefore reachable from the network, as long as no firewall blocks them. This section is about the Oracle repository used by this guide.

Start by observing the actual state. The ss command lists the listening sockets (-t TCP, -l listening, -n numeric values, -p process, which requires sudo):

sudo ss -tlnp | grep mysqld

You get two LISTEN lines for the mysqld process, on ports 3306 and 33060. If the local address is *, 0.0.0.0 or [::] instead of 127.0.0.1, the server is open to all interfaces.

Two measures combine. The first is a firewall that only allows port 3306 from the addresses that need it: check what is active with sudo ufw status (Debian/Ubuntu) or sudo firewall-cmd --list-all (RHEL/Rocky). The second closes the door at the source with bind-address. If your applications run on the same machine as MySQL, add these two lines to the [mysqld] section of /etc/mysql/mysql.conf.d/mysqld.cnf (Debian/Ubuntu) or of /etc/my.cnf (RHEL/Rocky):

[mysqld]
bind-address        = 127.0.0.1
mysqlx-bind-address = 127.0.0.1

mysqlx-bind-address is needed because port 33060 has its own variable: bind-address does not restrict it. These variables cannot be changed on the fly: a restart of the service is required (sudo systemctl restart mysql on Debian/Ubuntu, sudo systemctl restart mysqld on RHEL/Rocky). Then run the ss command again: both lines should now show 127.0.0.1.

SELECT @@bind_address, @@mysqlx_bind_address;

Both values should be 127.0.0.1. If a remote client or a replica has to connect, list the required addresses instead, as the Configuration and Security guides explain.

Create a first administration user

Do not work day to day with the root account. Create a dedicated account:

CREATE USER 'labadmin'@'localhost' IDENTIFIED BY 'StrongPassword!2026';
GRANT ALL PRIVILEGES ON *.* TO 'labadmin'@'localhost' WITH GRANT OPTION;

For an account that must connect from the network (lab, development), the '%' host stands for any address:

CREATE USER 'labadmin'@'%' IDENTIFIED BY 'StrongPassword!2026';
GRANT ALL PRIVILEGES ON *.* TO 'labadmin'@'%' WITH GRANT OPTION;

Warning: as long as the server listens on all interfaces (see the previous section), this labadmin@'%' account with all privileges is really reachable from the network. Keep it for an isolated lab, restrict the host to your subnet (for example 'labadmin'@'192.168.122.%') or keep only labadmin@'localhost' combined with a local bind-address.

FLUSH PRIVILEGES is unnecessary here. The CREATE USER, GRANT and REVOKE statements take effect immediately. FLUSH PRIVILEGES is only needed if you modify the grant tables (mysql.user, mysql.db) directly.

GRANT ALL is not for production

GRANT ALL PRIVILEGES ON *.* gives all privileges on all databases. It is acceptable for a lab or an administration account, but in production, create accounts with the minimum permissions they need. The Security guide details the separation of roles.

Put it into practice

The lab hands you db1.lab, a blank Debian 13 machine: no MySQL, no repository for it. You declare Oracle's repository by binding it to the signing key with which Oracle signs its packages (the one apt verifies at every apt update), install MySQL 8.4 LTS and close what the server listens on. The validation reads the actual listening reported by ss, not a configuration file, because two measured facts make the file misleading: Oracle's packages ship no bind-address line (the variable is therefore * by default), and bind-address alone does not restrict port 33060, which has its own variable, mysqlx-bind-address. A server you believe closed is therefore still reachable through its second door.

The validation also checks the expiry date of the key and of its subkeys (secondary keys attached to the main key, each with its own deadline), and that is what made it useful: Oracle's 2023 key expired on 2025-10-22 (its expiry has since been pushed back, see the troubleshooting), and a repository bound to an outdated copy of the key breaks apt-get update without the message mentioning a date.

Guided lab Practice

Learn how to do it

Install MySQL 8.4 LTS, and close the door the packages leave open

$ dsoxlab run mysql-01-installer

Environment: VM·Duration: ~35 min

How it is checked: the state of the system is checked after a reboot, not the command you typed.

First time? What DSOXLab is and how to install it

DSOXLab is the command line that prepares a disposable environment (an isolated shell or a VM), runs the lab scenario, then checks the real state of the system and computes a score. Nothing is installed or broken on your workstation.

It needs Python 3.11 or later, uv or pipx, and git. The installation guide details these prerequisites; on Windows, or on a Mac without Python, use the appliance instead.

This lab starts virtual machines: it also needs ansible-playbook, a hypervisor (KVM or Incus), Terraform and hardware virtualization (/dev/kvm), which inside a VirtualBox VM means nested virtualization. The first time, dsoxlab start mysql-01-installer checks all of it before creating the machines. Prepare your machine for vm labs.

Install the CLI and add the catalogue, once:

uv tool install dsoxlab   # or: pipx install dsoxlab
dsoxlab catalog add https://github.com/stephrobert/bdd-dsoxlab-training

Before you run the lab, check:

• DSOXLab installed
• catalogue available
• compatible environment (isolated shell or VM)

To check, nothing is probed from this page: run dsoxlab doctor. Read the diagnosis

Run this lab, then validate your work:

dsoxlab run mysql-01-installer
dsoxlab check mysql-01-installer

See every lab: dsoxlab list-labs. Track your progress: dsoxlab progress. The full dsoxlab guide covers scoring and the pitfalls.

Troubleshooting

The service does not start

Read the error logs:

# Debian / Ubuntu
sudo cat /var/log/mysql/error.log | tail -30

# RHEL / Rocky
sudo cat /var/log/mysqld.log | tail -30

# Or through journalctl
sudo journalctl -u mysql --no-pager -n 30    # Debian
sudo journalctl -u mysqld --no-pager -n 30   # RHEL

Frequent causes:

Symptom	Likely cause	Fix
[ERROR] Can't start server: Bind on TCP/IP port: Address already in use	Another process is using port 3306	ss -tlnp | grep 3306 to identify the conflict
[ERROR] --initialize specified but the data directory has files in it	The datadir already contains files	Either delete /var/lib/mysql/*, or use another datadir
[ERROR] InnoDB: Unable to lock ./ibdata1	Another mysqld instance is already running	ps aux | grep mysqld and stop the conflicting instance
Service not found	Wrong service name	mysql (Debian) vs mysqld (RHEL)
apt update complains about a signature, although the repository key was imported	The key or one of its subkeys has expired (Oracle's 2023 key expired on 2025-10-22, then its expiry was pushed back to 2027-10-23, with the same fingerprint: a repository or key file left on the old copy still shows it as expired)	gpg --show-keys on the key file: an outdated key is marked [expired: …], you have to fetch the up-to-date key from Oracle
A remote client reaches MySQL although you thought access was local only	bind_address is * (default of the Oracle packages)	sudo ss -tlnp | grep mysqld, then bind-address and firewall ("How do you restrict MySQL's network listening?" section)
ERROR 1819 (HY000): Your password does not satisfy the current policy requirements on an ALTER USER or a CREATE USER	The validate_password component is active, MEDIUM policy by default	Give the password at least 8 characters, a lowercase letter, an uppercase letter, a digit and a special character. Read the policy in force with SHOW VARIABLES LIKE 'validate_password%'

Swipe to see more

Lost root password

If you lose the root password, you can reset it in maintenance mode (--skip-grant-tables). The procedure differs between Debian/Ubuntu, where you start mysqld by hand, and RHEL/Rocky, where you pass the options through a systemd environment variable:

Debian / Ubuntu

1. Stop MySQL

   sudo systemctl stop mysql

2. Start in skip-grant-tables mode

   sudo mysqld --skip-grant-tables --skip-networking --user=mysql &

   The --skip-networking option prevents any network connection during this sensitive operation.

3. Connect without a password and reset

   mysql -u root

   FLUSH PRIVILEGES;
   ALTER USER 'root'@'localhost' IDENTIFIED BY 'YourPassword!2026';

4. Stop the process and restart normally

   sudo kill $(cat /var/run/mysqld/mysqld.pid)
   sudo systemctl start mysql

Rocky Linux / RHEL

1. Stop MySQL

   sudo systemctl stop mysqld

2. Start in skip-grant-tables mode, without network

   sudo systemctl set-environment MYSQLD_OPTS="--skip-grant-tables --skip-networking"
   sudo systemctl start mysqld

   The MYSQLD_OPTS variable is passed to mysqld by the systemd unit. The --skip-networking option cuts every network connection during the operation.

3. Connect without a password and reset

   mysql -u root

   FLUSH PRIVILEGES;
   ALTER USER 'root'@'localhost' IDENTIFIED BY 'YourPassword!2026';

4. Remove the options and restart normally

   sudo systemctl unset-environment MYSQLD_OPTS
   sudo systemctl restart mysqld

Sensitive operation

The --skip-grant-tables mode disables all authentication. Even with --skip-networking, a local user can connect freely. Use this procedure only when necessary, and restart the service normally as soon as possible.

Conflict with MariaDB

If you get a package conflict error at installation:

# List the installed MariaDB packages
dpkg -l | grep mariadb

# Uninstall MariaDB (data is kept unless you purge)
sudo apt remove --purge mariadb-server mariadb-client mariadb-common

# Clean the datadir if needed
sudo rm -rf /var/lib/mysql/*

# Reinstall MySQL
sudo apt update
sudo apt install -y mysql-server

Data loss

Deleting /var/lib/mysql/* destroys all existing MariaDB databases. Take a backup with mysqldump --all-databases before this operation if you have data to keep.

Key points

• Use the Oracle repositories to get MySQL 8.4 LTS, because distribution repositories often ship MariaDB or an old MySQL version.
• On Debian/Ubuntu, the installer offers to set the root password (leaving it empty enables Unix socket authentication). On RHEL/Rocky, a temporary password is generated in /var/log/mysqld.log.
• The service is called mysql on Debian and mysqld on RHEL, do not mix them up.
• Run mysql_secure_installation right after installation to remove anonymous accounts and the test database: it never touches the network listening.
• An active service is running now, an enabled service will start at the next boot: only systemctl is-enabled guarantees that the instance comes back after a restart.
• An apt update that complains about a signature calls first for a gpg --show-keys on the repository key: the key or one of its subkeys may have expired.
• The Oracle packages let mysqld listen on all interfaces (bind_address = *, ports 3306 and 33060): add a firewall or bind-address = 127.0.0.1 (and mysqlx-bind-address) in the configuration.
• The default authentication plugin is caching_sha2_password (SHA-256), more secure than the old mysql_native_password.
• The server configuration lives in /etc/mysql/mysql.conf.d/mysqld.cnf (Debian) or /etc/my.cnf (RHEL).
• The buffer pool at 128 MB by default is insufficient for production, the Configuration guide details the sizing.
• Create a dedicated account for daily work, use root only for system administration.

Knowledge check

Eight questions on what Oracle's packages ship and do not ship, the two doors MySQL opens, the signing key and its subkeys, the difference between an active and an enabled service, and what mysql_secure_installation never touches.

Knowledge check

Check what you have learned with this interactive quiz

8 questions

8 min

70% to pass

How it works

• The timer starts when you click Start
• Multiple choice, true/false and short answer questions
• You can move between questions
• Detailed results are shown at the end

Start the quiz

Starts the quiz and the timer

×

See in the glossary →