Turkey (Turkish)
Germany (German)
Worldwide (English)
Ubuntu resolute packages provide the MySQL 8.4 series; the exact security/update build changes over time.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Ubuntu 26.04 ships the MySQL 8.4 series. A production deployment is more than package installation: bind address, account model, backup validation, storage behavior and slow-query visibility belong together.
Question whether the database port must be public at all. Binding MySQL to 0.0.0.0:3306 for convenience unnecessarily expands attack surface.
If the application runs on the same VPS, keep MySQL bound locally by default. For remote access, prefer private networking/VPN or source-IP allow-lists over exposing 3306 globally, and use a dedicated least-privilege DB account.
If the application runs on the same VPS, keep MySQL bound locally by default. For remote access, prefer private networking/VPN or source-IP allow-lists over exposing 3306 globally, and use a dedicated least-privilege DB account.
Install MySQL 8.4 on Ubuntu 26.04 with production-focused bind rules, user privileges, TLS, firewalling, backups, slow-query logging and InnoDB sizing.
Ubuntu resolute packages provide the MySQL 8.4 series; the exact security/update build changes over time.
For same-host applications, localhost-only listening provides a smaller attack surface.
Open only when remote access is required and restrict by source address.
A backup is successful only when it can be restored into a clean instance.
Inspect repository origin and candidate version before installing on production.
sudo apt updateapt-cache policy mysql-serversudo apt install mysql-server -ymysql --versionsystemctl status mysql --no-pagerThe application account should receive only required privileges on its own schema. Global `ALL PRIVILEGES` is usually unnecessary.
sudo mysql -e "CREATE DATABASE uygulama CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;"sudo mysql -e "CREATE USER 'uygulama'@'localhost' IDENTIFIED BY 'GUCLU_PAROLA';"sudo mysql -e "GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER,INDEX ON uygulama.* TO 'uygulama'@'localhost'; FLUSH PRIVILEGES;"sudo mysql -e "SHOW GRANTS FOR 'uygulama'@'localhost';"The interface MySQL listens on and the sources allowed by the firewall are separate layers. Verify both.
| Scenario | Bind | Firewall |
|---|---|---|
| Web + DB on same VPS | 127.0.0.1 | 3306 closed externally |
| Separate DB on private LAN | Private IP | App subnet/IP only |
| Temporary remote admin | Prefer private IP | VPN or one source IP |
sudo ss -lntp | grep 3306sudo mysql -e "SHOW VARIABLES LIKE 'bind_address';"sudo ufw status numberedFor small and medium databases, `mysqldump` is a clear baseline; large deployments may need physical backup, replicas or snapshots.
mysqldump --single-transaction --routines --triggers uygulama | gzip > uygulama-$(date +%F).sql.gzmysql -e "CREATE DATABASE restore_test CHARACTER SET utf8mb4;"gunzip -c uygulama-YYYY-MM-DD.sql.gz | mysql restore_testmysql -e "SELECT table_schema,COUNT(*) tables_count FROM information_schema.tables WHERE table_schema IN ('uygulama','restore_test') GROUP BY table_schema;"The goal is to capture queries that contribute to user latency, not dump every query to disk. Consider log growth and sensitive SQL content.
sudo mysql -e "SHOW VARIABLES WHERE Variable_name IN ('slow_query_log','long_query_time','log_output');"sudo mysql -e "SET GLOBAL long_query_time=1.0; SET GLOBAL slow_query_log=ON;"sudo tail -f /var/log/mysql/mysql-slow.logIf PHP, web server, Redis or workers share the VPS, MySQL cannot own all memory. Measure actual process usage first.
free -hps -eo pid,comm,%mem,rss --sort=-rss | head -20sudo mysql -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size';"sudo mysql -e "SHOW GLOBAL STATUS LIKE 'Threads_connected';"“8 GB VPS” alone is not a database sizing strategy. Choose Eka Sunucu VPS/VDS based on active data set, concurrency, query mix and storage latency.
Primary documentation and technical references used by this guide.
Continue with related infrastructure and implementation guides.
Ubuntu 26.04 + MySQL 8.4
Yes. Ubuntu resolute provides the MySQL 8.4 series. The exact update build changes over time; inspect it with `apt-cache policy mysql-server`.
No. You can apply the underlying account and test-database controls manually. What matters is the resulting security state.
Standard web proxying is not designed for this. Prefer VPN, private networking, SSH tunnels or an appropriate TCP proxy product.
Your acceptable data-loss window (RPO) determines frequency. An order system may need daily full backups plus binlogs or a tighter strategy.