Applies to: MySQL 8.4.11 on Ubuntu 26.04 LTS and MySQL 8.0.46 on Ubuntu 24.04 LTS; MariaDB as an alternative
Run sudo apt install mysql-server. Ubuntu 26.04 installs MySQL 8.4 LTS; Ubuntu 24.04 installs MySQL 8.0. Oracle has moved the 8.0 series to Sustaining Support and recommends 8.4 LTS or 9.7 LTS, so for a new server, Ubuntu 26.04 is the better starting point.
1. Install MySQL
sudo apt update sudo apt install mysql-server mysql --version
Our results:
mysql Ver 8.4.11-0ubuntu0.26.04.1 for Linux on x86_64 ((Ubuntu)) # Ubuntu 26.04 mysql Ver 8.0.46-0ubuntu0.24.04.4 for Linux on x86_64 ((Ubuntu)) # Ubuntu 24.04
The service starts at once and at every boot. Check it with systemctl status mysql and look for Active: active (running).
2. Log in as root
sudo mysql
No password is needed, because the MySQL root user is tied to the Linux root user (the auth_socket plugin). This is what a fresh install looks like:
mysql> SELECT user, host, plugin FROM mysql.user; +------------------+-----------+-----------------------+ | user | host | plugin | +------------------+-----------+-----------------------+ | debian-sys-maint | localhost | auth_socket | | mysql.infoschema | localhost | caching_sha2_password | | mysql.session | localhost | caching_sha2_password | | mysql.sys | localhost | caching_sha2_password | | root | localhost | auth_socket | +------------------+-----------+-----------------------+
Without sudo, mysql -u root fails with ERROR 1698 (28000): Access denied for user 'root'@'localhost'. That is expected; see access denied for root after installing MySQL.
3. Secure the installation
sudo mysql_secure_installation
It asks about the password validation component, then prints Skipping password set for root as authentication with auth_socket is used by default. Answer y to the next four questions: remove anonymous users, disallow remote root login, remove the test database and reload the privilege tables.
4. Create a database and a user for your application
Never let a website connect as root. In sudo mysql:
CREATE DATABASE appdb; CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'Use-A-Long-Unique-Password'; GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'localhost';
Then test the new login with mysql -u appuser -p. SHOW GRANTS; should list:
GRANT USAGE ON *.* TO `appuser`@`localhost` GRANT ALL PRIVILEGES ON `appdb`.* TO `appuser`@`localhost`
More on permissions: create a MySQL user and grant permissions.
MySQL 8.4: old password plugin is off
In MySQL 8.4 the old mysql_native_password plugin is disabled. Creating a user with it fails:
ERROR 1524 (HY000) at line 1: Plugin 'mysql_native_password' is not loaded
Create users without IDENTIFIED WITH, as in step 4, and they get the default caching_sha2_password. If a very old application cannot log in, update the application or its database driver.
5. Allow remote connections (only if you need them)
By default MySQL listens on 127.0.0.1 only, which is the safe choice when the website runs on the same server. For a remote client:
- In
/etc/mysql/mysql.conf.d/mysqld.cnf, changebind-address = 127.0.0.1tobind-address = 0.0.0.0, then runsudo systemctl restart mysql.SHOW VARIABLES LIKE 'bind_address';then shows0.0.0.0. - Create the user for the client’s IP address:
CREATE USER 'appuser'@'203.0.113.5' IDENTIFIED BY '...';and grant it the same rights. - Open port 3306 for that IP address only:
sudo ufw allow from 203.0.113.5 to any port 3306 proto tcp. See UFW on Ubuntu.
Details and client settings: access a MySQL database remotely.
Alternatives
- MariaDB:
sudo apt install mariadb-serverinstalls MariaDB 11.8 on Ubuntu 26.04 and 10.11 on 24.04. WordPress, for example, recommends MySQL 8.0 or later or MariaDB 10.11 or later, so either package works for it. - A newer MySQL: Oracle’s MySQL APT repository (
mysql-apt-config) offers MySQL 8.4 LTS and 9.7 LTS for Ubuntu.
Before you put data in, set up backups: back up a database with mysqldump.
Official documentation: Ubuntu Server: install and configure a MySQL server and MySQL APT repository.
Ucartz services for this topic
- KVM VPS hosting: NVMe SSD and full root access, with Free Basic Managed Support.
- Managed cPanel VPS: cPanel included; we handle updates, security and monitoring.
- Server management: on-demand administration, hardening, migrations and monitoring.
