How to Install MySQL 8.0.46 on Linux with Verified Binaries and Secure Initialization

Overview

This article details a complete, production-style installation of MySQL Community Server 8.0.46 on Kylin V11 (x86_64, glibc 2.38) using the official generic binary tarball. Every step — dependency installation, package download, cryptographic verification, extraction, dedicated system user setup, configuration, data directory initialization, server startup, temporary password rotation, and functional validation — is executed on a real server (192.168.19.201) under /opt/mysql-course-8046 with port 3307. The guide emphasizes security hygiene: verifying GPG signatures, running the server as an unprivileged user, binding to localhost only, disabling the X Plugin, and replacing the generated temporary password with a strong random one via ALTER USER ... IDENTIFIED BY RANDOM PASSWORD.

1. Prerequisites and Dependencies

The environment must match the earlier article (Part 02): Kylin V11, x86_64, glibc 2.38. SSH passwordless login as root is assumed. Required shared libraries include libaio.so.1 and libnuma.so.1. Install them via DNF:

dnf install -y libaio numactl-libs libstdc++ ncurses-libs curl tar xz gnupg2

This installs OS-level dependencies only; the MySQL server itself comes from the official fixed-version tarball to avoid pulling whatever version the repository currently defaults to.

2. Obtaining and Verifying the Official Package

2.1 Download Fixed Version

The exact filename used is mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz (version 8.0.46, architecture x86_64, glibc 2.28 baseline). Download the tarball, its detached ASCII-armored signature ( .asc), and the MySQL release public key ( mysql-release-key.asc) from the official CDN:

cd /opt/mysql-course-8046/downloads
curl --fail --location --retry 2 --output mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz \
  https://cdn.mysql.com/Downloads/MySQL-8.0/mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz
curl --fail --location --output mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz.asc \
  https://cdn.mysql.com/Downloads/MySQL-8.0/mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz.asc
curl --fail --location --output mysql-release-key.asc \
  https://repo.mysql.com/RPM-GPG-KEY-mysql-2025

The --fail flag ensures HTTP errors (e.g., 404) cause the command to fail, preventing an error page from being saved as the tarball.

2.2 Verify MD5 and GPG Signature

First, check the MD5 hash published on the download page:

printf '%s  %s
' '367c6adbd976c0e4bcbe39bda4ea6ecf' 'mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz' | md5sum --check

Output shows “成功” (or “OK” in English locales). MD5 only confirms file integrity, not publisher identity.

Next, inspect the public key fingerprint:

gpg --show-keys --with-fingerprint mysql-release-key.asc

The full fingerprint must match the one listed in the MySQL documentation:

BCA4 3417 C3B4 85DD 128E  C6D4 B7B3 B788 A8D3 785C

After confirming the fingerprint, create a dedicated GnuPG homedir, import the key, and verify the detached signature:

mkdir -p /opt/mysql-course-8046/downloads/gnupg
chmod 700 /opt/mysql-course-8046/downloads/gnupg
gpg --homedir /opt/mysql-course-8046/downloads/gnupg --import mysql-release-key.asc
gpg --homedir /opt/mysql-course-8046/downloads/gnupg --verify \
  mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz.asc \
  mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz

The verification succeeds with “Good signature”. A warning about the key not being certified with a trusted signature is expected and does not invalidate the signature; it merely reflects the local trust database.

2.3 Extract and Validate Binaries

Extract the tarball into the installation root and create a stable symlink:

tar -xJf mysql-8.0.46-linux-glibc2.28-x86_64.tar.xz -C /opt/mysql-course-8046
ln -s /opt/mysql-course-8046/mysql-8.0.46-linux-glibc2.28-x86_64 /opt/mysql-course-8046/mysql

Confirm both client and server binaries report the correct version:

/opt/mysql-course-8046/mysql/bin/mysql --version
/opt/mysql-course-8046/mysql/bin/mysqld --version

Both output 8.0.46. Then verify dynamic library dependencies with ldd on both binaries; no “not found” entries should appear, confirming all required shared libraries are satisfied.

3. Dedicated Account and Configuration

3.1 Create System User and Directories

Create a system group and user mysqlcourse with no login shell and no home directory. Assign ownership of the data, log, and runtime directories to this user with restrictive permissions (750):

groupadd --system mysqlcourse
useradd --system --gid mysqlcourse --home-dir /nonexistent --shell /sbin/nologin mysqlcourse
chown mysqlcourse:mysqlcourse /opt/mysql-course-8046/{data,logs,run}
chmod 750 /opt/mysql-course-8046/{data,logs,run}

The MySQL program files remain owned by root; only the runtime directories are owned by the service account. This follows the official recommendation to run the server under a dedicated unprivileged user.

3.2 Write Configuration File

Create /opt/mysql-course-8046/conf/my.cnf with the following settings (written via a heredoc):

[mysqld]
user=mysqlcourse
basedir=/opt/mysql-course-8046/mysql
datadir=/opt/mysql-course-8046/data
socket=/opt/mysql-course-8046/run/mysql.sock
pid-file=/opt/mysql-course-8046/run/mysql.pid
log-error=/opt/mysql-course-8046/logs/mysql-error.log
port=3307
bind-address=127.0.0.1
mysqlx=OFF
character-set-server=utf8mb4
collation-server=utf8mb4_0900_ai_ci

Key points: basedir points to the program directory (the symlink), datadir to the data directory. socket, pid-file, log-error are placed under the dedicated run and logs directories. port=3307 avoids conflict with any existing MySQL on 3306. bind-address=127.0.0.1 restricts listening to localhost for this learning environment. mysqlx=OFF disables the X Plugin (not used in this series).

Character set and collation are set explicitly to avoid implicit defaults.

The file is owned by root:mysqlcourse with mode 640. All subsequent commands use --defaults-file=/opt/mysql-course-8046/conf/my.cnf as the first option after the binary to ensure the correct configuration is read.

4. Initialization and First Login

4.1 Initialize Data Directory

Ensure data is empty, then run:

/opt/mysql-course-8046/mysql/bin/mysqld \
  --defaults-file=/opt/mysql-course-8046/conf/my.cnf --initialize
printf 'initialize exit=%s
' "$?"

The --initialize flag creates the internal system tables, generates a temporary random password for 'root'@'localhost', and exits. It does not start the server. The exit code 0 confirms success. The temporary password is written to the error log; a sed command redacts it for safe screenshot capture:

sed -E 's/(temporary password is generated for root@localhost: ).*/\1[REDACTED]/' \
  /opt/mysql-course-8046/logs/mysql-error.log

The log shows initialization completed without errors.

4.2 Start the Server

Start the server in the background with --daemonize (cannot be combined with --initialize):

/opt/mysql-course-8046/mysql/bin/mysqld \
  --defaults-file=/opt/mysql-course-8046/conf/my.cnf --daemonize

Verify the server is listening on 127.0.0.1:3307 and the process runs as mysqlcourse:

ss -lnt 'sport = :3307'
ps -o user,pid,args -C mysqld

The ss output shows the listener; ps shows the user column truncated to “mysqlco+”.

4.3 Replace Temporary Password

Connect via the Unix socket using the temporary password (entered interactively, not on the command line):

/opt/mysql-course-8046/mysql/bin/mysql --no-defaults --default-character-set=utf8mb4 \
  --protocol=SOCKET --socket=/opt/mysql-course-8046/run/mysql.sock \
  -u root -p --connect-expired-password

Inside the client, execute:

ALTER USER 'root'@'localhost' IDENTIFIED BY RANDOM PASSWORD;

The server returns a generated strong password in the generated password column. Save this password immediately to a password manager before exiting. Subsequent connections must use the new password; the old temporary one is invalid.

5. Installation Verification

5.1 Confirm Instance Identity and Configuration

Reconnect with the new password and run:

SELECT CURRENT_USER() AS account;
QUIT;

Then reconnect again and query server version, compile OS/architecture, and key system variables:

SELECT VERSION() AS server_version,
       @@version_compile_os AS compile_os,
       @@version_compile_machine AS compile_machine;
SELECT @@port AS port,
       @@character_set_server AS charset,
       @@collation_server AS collation,
       @@default_storage_engine AS engine;

Results confirm: 8.0.46, Linux, x86_64, port 3307, utf8mb4, utf8mb4_0900_ai_ci, InnoDB. Session variables are also recorded:

SELECT @@SESSION.sql_mode AS sql_mode,
       @@SESSION.time_zone AS time_zone,
       @@SESSION.transaction_isolation AS isolation_level,
       @@SESSION.autocommit AS autocommit\G

Isolation level is REPEATABLE-READ, autocommit=1.

5.2 Read-Write Smoke Test

Create a test database and table, insert a row, and read it back:

CREATE DATABASE mysql_course_smoke CHARACTER SET utf8mb4;
USE mysql_course_smoke;
CREATE TABLE hello (
  id INT PRIMARY KEY,
  message VARCHAR(50) NOT NULL
) ENGINE = InnoDB;
INSERT INTO hello (id, message) VALUES (1, 'MySQL 8.0.46 is ready');
SELECT id, message FROM hello ORDER BY id;

The select returns the inserted row, proving the storage engine is functional.

5.3 Restart Persistence Test

Stop the instance cleanly using mysqladmin shutdown over the same socket, then restart with the identical command used initially:

/opt/mysql-course-8046/mysql/bin/mysqladmin --no-defaults \
  --protocol=SOCKET --socket=/opt/mysql-course-8046/run/mysql.sock \
  -u root -p shutdown
/opt/mysql-course-8046/mysql/bin/mysqld \
  --defaults-file=/opt/mysql-course-8046/conf/my.cnf --daemonize

After restart, reconnect and query the test table again; the row persists, confirming durable storage across a normal shutdown/startup cycle.

5.4 Cleanup and Retention

Drop the test database when no longer needed:

DROP DATABASE mysql_course_smoke;
SHOW DATABASES LIKE 'mysql_course_smoke';

Returns empty set. The SQL scripts are saved as smoke.sql and cleanup.sql. For pauses, stop the server with the same mysqladmin shutdown command; retain the program, config, and data directories — do not re-initialize.

6. Exercises and Completion Criteria

Initialization ≠ startup: initialization creates data structures; startup runs the daemon.

Client version ≠ server version: always query VERSION() after connecting.

Restart validation: stop, start with same config, reconnect, re-query original data.

Completion standard: verified official package, server runs as dedicated user, temporary password rotated, connection confirms 8.0.46, read-write works, data survives restart.

7. Official References

Binary Installation Guide [1]

DNF Command Reference [2]

MySQL 8.0.46 Download Page [3]

GPG Signature Verification [4]

Data Directory Initialization [9]

Server Options [5]

System Variables [6]

Disabling X Plugin [7]

Option File Processing [8]

ALTER USER Syntax [11]

mysqladmin Reference [14]

Release Notes 8.0.46 [15]

Connection Options [16]

8. Appendix: Error Scenario — Wrong Socket Path

Deliberately connecting to a non-existent socket file ( /opt/mysql-course-8046/run/absent.sock) produces:

ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/opt/mysql-course-8046/run/absent.sock' (2)

Error 2002 with system errno 2 (“No such file or directory”) indicates a connection endpoint mismatch, not an authentication failure. Correcting the socket path to the configured /opt/mysql-course-8046/run/mysql.sock restores connectivity, and SELECT VERSION(), @@socket confirms the server is still 8.0.46 on the expected socket.