How to Install and Configure MySQL on a Linux VPS

To install MySQL on a Linux VPS, run sudo apt install mysql-server (Ubuntu/Debian) or sudo dnf install mysql-server (AlmaLinux/Rocky), then secure it with mysql_secure_installation. You'll have a production-ready database in under 30 minutes.

This guide walks you through the full process — from zero to a secured instance with proper users, permissions, and firewall rules. Follow the steps in order and don't skip the security section.

Step 1 — Install MySQL on Your VPS

The available package depends on your Linux distribution. The most common choices for VPS hosting are Ubuntu/Debian and AlmaLinux/Rocky Linux.

Ubuntu and Debian

sudo apt update
sudo apt install mysql-server -y

AlmaLinux, Rocky Linux, and CentOS Stream

sudo dnf install mysql-server -y
sudo systemctl enable --now mysqld

On Ubuntu, the service starts automatically. Verify it's running:

sudo systemctl status mysql

You should see active (running). If not, start it with sudo systemctl start mysql.

Step 2 — Secure the Installation with mysql_secure_installation

This interactive script removes insecure defaults. Run it immediately after installing:

sudo mysql_secure_installation

The wizard walks you through several prompts. Here are the recommended answers:

• VALIDATE PASSWORD component — Enable it (Y) to enforce strong passwords.
• Password strength level — Choose 2 (STRONG) for production systems.
• Remove anonymous users — Y. Anonymous users are a security hole.
• Disallow root login remotely — Y. Root should never connect from outside the server.
• Remove test database — Y. The test database serves no purpose in production.
• Reload privilege tables — Y. Apply changes immediately.

Step 3 — Create a Database and Dedicated User

Never use the root account to connect your application. Create a user with minimal privileges scoped to your project's database.

Connect to MySQL:

sudo mysql

Then run these commands, replacing the uppercase placeholders with your own values:

CREATE DATABASE my_app CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'my_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';
GRANT ALL PRIVILEGES ON my_app.* TO 'my_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

The utf8mb4 character set is mandatory if you need emoji or special character support — and in modern applications, you always do.

Step 4 — Configure the Firewall

MySQL listens on port 3306. This port should never be open to the internet by default. If your app runs on the same server as your database, keep the port closed externally:

# Confirm the port is NOT reachable from outside
sudo ss -tlnp | grep 3306

If you need remote connections (e.g., from a separate app server), open the port only for that specific IP:

# With UFW (Ubuntu/Debian)
sudo ufw allow from 192.168.1.100 to any port 3306

# With firewalld (AlmaLinux/Rocky)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

Replace 192.168.1.100 with your actual app server IP. Opening the port to the whole internet exposes you to brute-force attacks — don't do it.

Step 5 — Basic Performance Tuning

The main config file is /etc/mysql/mysql.conf.d/mysqld.cnf (Ubuntu) or /etc/my.cnf (RHEL-based). These are the most impactful settings for a VPS with 2–4 GB of RAM:

After editing the config file, restart the service:

sudo systemctl restart mysql

Check available RAM with free -h. Assign 70% to innodb_buffer_pool_size. On a 2 GB VPS, that's roughly 1400M.

If you need expert help choosing and configuring the right VPS plan for your database workload, the team at elenlace.com is ready to help.

Explore more server guides in our VPS servers section.

Key Takeaways

• Install MySQL using your distribution's package manager and confirm the service is active.
• Run mysql_secure_installation immediately after install — never skip it.
• Create a dedicated, least-privilege user per application; never use root in application code.
• Keep port 3306 closed to the internet unless you specifically need IP-restricted remote access.
• Set innodb_buffer_pool_size to 70% of available RAM for optimal performance.

With these five steps, your MySQL installation is production-ready. Need hands-on help with server configuration? Visit elenlace.com and talk to our team today.

FAQ

Can I use MariaDB instead of MySQL on my VPS?

Yes. MariaDB is a compatible MySQL fork and the default in many RHEL-based distributions. The installation and configuration commands are nearly identical — only the package and service names differ (mariadb-server / mariadb).

How do I connect my PHP app to MySQL?

Use the PDO extension with the MySQL driver: new PDO('mysql:host=localhost;dbname=my_app;charset=utf8mb4', 'my_user', 'password'). Always use prepared statements to prevent SQL injection.

What do I do if I forget the MySQL root password?

Stop the service, start it with --skip-grant-tables, connect without a password, reset the password with ALTER USER, then restart normally. The exact steps vary slightly between MySQL 5.7 and 8.0.

Is it safe to open port 3306 to the public internet?

No. Exposing MySQL directly to the internet makes it an immediate target for brute-force attacks and known exploits. If you need remote access, use an SSH tunnel (ssh -L 3306:localhost:3306 user@your-server) or a VPN, and restrict the port by IP at the firewall level.

Useful resources

Other providers and guides worth comparing:

• IONOS
• GoDaddy
• HostGator México