How to Install MySQL 8.4 on Rocky Linux 9 and EL9

CentOS Linux 7 reached end-of-life on June 30, 2024, so you should not build a new production MySQL server on it. This updated guide explains how to install MySQL 8.4 LTS on Enterprise Linux 9, including Rocky Linux 9, AlmaLinux 9, Oracle Linux 9, and compatible RHEL 9 systems.

If you still operate MySQL on CentOS 7, plan an operating-system and database migration. Do not treat archived CentOS packages as a secure long-term platform.

Why this guide no longer recommends CentOS 7

CentOS announced that Linux 7 would stop receiving updates after June 30, 2024. Running an internet-connected database on an unsupported operating system leaves newly discovered kernel and library vulnerabilities without normal security fixes.

Use a supported Enterprise Linux release and a supported MySQL release track. MySQL offers LTS and Innovation tracks. This guide deliberately chooses MySQL 8.4 LTS for a conservative production baseline.

Before installing MySQL

• Use a fresh supported EL9 server.
• Confirm at least one sudo-enabled administrator.
• Apply operating-system updates.
• Check whether MariaDB or another MySQL distribution is already installed.
• Choose an LTS or Innovation policy before enabling repositories.
• Back up any existing database and configuration.

Check the operating system:

cat /etc/os-release
uname -r

Install updates:

sudo dnf upgrade --refresh

Reboot if the kernel or important system libraries were updated.

Step 1: Check for existing database packages

rpm -qa | grep -Ei 'mysql|mariadb|percona'
systemctl list-unit-files | grep -Ei 'mysql|mariadb'

Do not install Oracle MySQL over an existing MariaDB or third-party deployment without a tested migration plan. Package conflicts and data-format differences can cause service failure or data loss.

Step 2: Download the official MySQL Yum repository package

Open the official MySQL Yum Repository download page and select the current EL9 repository RPM. Repository package filenames change as Oracle publishes updates.

At the time this guide was reviewed, the MySQL 8.4 EL9 package used this form:

mysql84-community-release-el9-VERSION.noarch.rpm

Download only from an official MySQL domain and compare the published checksum or signature. Do not reuse an unverified RPM from a random tutorial mirror.

Step 3: Install the repository RPM

From the directory containing the verified download:

sudo dnf install ./mysql84-community-release-el9-VERSION.noarch.rpm

Replace VERSION with the real filename. Review the package origin and transaction before accepting it.

Check enabled MySQL repositories:

sudo dnf repolist enabled | grep -i mysql

Step 4: Confirm the MySQL release track

sudo dnf repolist all | grep -i mysql

Only one server release track should be enabled. For this guide, confirm that the MySQL 8.4 LTS community repository is active and the Innovation server repository is not selected accidentally.

Repository defaults can change over time, so do not assume the filename alone proves which server track is enabled.

Step 5: Install MySQL Community Server

sudo dnf install mysql-community-server

Review the package list, repository source, and GPG signature result. The installation normally adds the server, client, shared libraries, common files, and supporting components.

Confirm installed packages:

rpm -qa | grep '^mysql-community'
mysqld --version
mysql --version

Step 6: Start and enable MySQL

sudo systemctl enable --now mysqld
sudo systemctl status mysqld --no-pager

Check that the server listens locally:

sudo ss -ltnp | grep ':3306 '

Do not open port 3306 to the internet. A local-only listener is appropriate when the application runs on the same server.

Step 7: Find the temporary root password

The Oracle MySQL community package normally generates a temporary password on first start:

sudo grep 'temporary password' /var/log/mysqld.log

Treat the value as a secret. Do not paste it into tickets, chat rooms, screenshots, or shell history.

Step 8: Change the MySQL root password

mysql -u root -p

Enter the temporary password, then set a unique new value:

ALTER USER 'root'@'localhost'
  IDENTIFIED BY 'replace-with-a-long-random-password';

The default validation component may require uppercase and lowercase letters, numbers, special characters, and a minimum length. Prefer a long generated password stored in a password manager.

Exit:

exit

Step 9: Run the secure installation helper

mysql_secure_installation

Review each prompt rather than accepting answers blindly. On a normal production database:

• Keep a strong root password.
• Remove anonymous accounts.
• Keep remote root login disabled.
• Remove an unused test database.

The helper is not a replacement for firewall rules, least-privilege application users, encrypted remote connections, updates, or backups.

Step 10: Verify the MySQL installation

mysql -u root -p -e "SELECT VERSION();"
mysql -u root -p -e "SHOW DATABASES;"
sudo systemctl is-enabled mysqld
sudo systemctl is-active mysqld

Read recent service messages:

sudo journalctl -u mysqld -n 100 --no-pager

Step 11: Create an application database and user

Do not run a website as MySQL root:

CREATE DATABASE app_database
  CHARACTER SET utf8mb4;

CREATE USER 'app_user'@'localhost'
  IDENTIFIED BY 'another-long-random-password';

GRANT SELECT, INSERT, UPDATE, DELETE
ON app_database.*
TO 'app_user'@'localhost';

SHOW GRANTS FOR 'app_user'@'localhost';

Add schema privileges only when the application’s migration process requires them. Our MySQL user-management guide covers account scopes and least privilege.

Configure firewalld

No inbound database rule is required for a local application. For a separate application server, bind MySQL only to the private database interface and allow TCP 3306 only from the exact trusted source.

Example rich rule:

sudo firewall-cmd --permanent --zone=public \
  --add-rich-rule='rule family="ipv4" source address="10.0.20.30/32" port port="3306" protocol="tcp" accept'

sudo firewall-cmd --reload

Also apply the cloud firewall and TLS controls described in our remote MySQL connection guide.

SELinux considerations

Keep SELinux enforcing. The official RPM packages install supported policies for normal MySQL paths and ports. If you move the data directory or port, add the correct SELinux label through supported tools rather than disabling SELinux.

Check status:

getenforce
sudo ausearch -m AVC -ts recent

Investigate the intended access and label first. Do not generate and install a broad allow policy simply because one denial appears.

Set up backups before adding production data

A database is not production-ready until recovery is tested. Create an automated backup, store copies away from the server, protect credentials, and restore to a separate environment regularly.

For smaller logical backups, use our mysqldump backup and restore guide.

Update MySQL safely

The enabled Yum repository participates in normal DNF updates:

sudo dnf check-update
sudo dnf upgrade

Before a database upgrade:

• Read the MySQL release notes.
• Confirm that the repository still selects the intended LTS track.
• Run MySQL’s upgrade checks where applicable.
• Verify a recent restorable backup.
• Test the application and connector in staging.
• Schedule a maintenance and rollback plan.

Do not enable a different major or Innovation track during routine production patching without an upgrade project.

Migrating from CentOS 7

For an existing CentOS 7 database, a fresh EL9 server and planned migration is usually clearer than trying to transform the old operating system in place.

1. Inventory the MySQL version, storage engines, plugins, accounts, character sets, and application connectors.
2. Choose a supported MySQL upgrade path.
3. Build and secure the new EL9 server.
4. Test logical dump/load, MySQL Shell utilities, replication, or another supported migration method.
5. Validate data, application behaviour, performance, backups, and monitoring.
6. Schedule the final cutover and preserve a rollback point.
7. Retire the unsupported CentOS 7 host after verification.

Do not copy old MySQL data files directly between incompatible server versions without an officially supported procedure.

Common installation problems

No MySQL package is available

Check enabled repositories and the platform package:

sudo dnf repolist enabled | grep -i mysql
sudo dnf clean all
sudo dnf makecache

On EL8, the distribution MySQL module can mask Oracle repository packages and may need to be disabled. EL9 repository behaviour should be checked on the actual platform.

GPG signature verification fails

Stop. Confirm system time, repository configuration, package origin, and the current official MySQL signing-key instructions. Do not bypass signature checking.

mysqld fails to start

sudo systemctl status mysqld --no-pager
sudo journalctl -u mysqld -n 100 --no-pager
sudo tail -100 /var/log/mysqld.log

Look for port conflicts, invalid configuration, disk space, permission problems, or incompatible old data.

The temporary root password is missing

The data directory may have been initialised earlier, or another package created the installation. Review logs and package history rather than repeatedly deleting data. Never remove /var/lib/mysql on a server that might contain real databases.

The root password does not meet policy

Use a longer random value that satisfies the validation policy. Weakening the global password policy is not the best way to finish an installation.

Frequently asked questions

Can I still install MySQL on CentOS 7?

Packages may remain available, but CentOS 7 no longer receives normal security updates. Use a supported operating system for new and production deployments.

Should I install MySQL 8.4 LTS or an Innovation release?

LTS is a sensible choice when stability and a longer production lifecycle matter. Innovation releases provide newer features but require a faster upgrade cadence. Choose deliberately and enable only one track.

Should my application connect as root?

No. Create a separate account restricted to its database, source host, and required operations.

Should I open port 3306 publicly?

No. Keep it local or private. When remote access is necessary, restrict the listener, firewall source, account host, privileges, and TLS configuration.

Official references

• MySQL 8.4: Install with the Yum repository
• Official MySQL Yum Repository downloads
• MySQL LTS and Innovation release tracks
• CentOS announcement: CentOS Linux 7 end of life

You now have a supported path to install MySQL 8.4 LTS on an EL9 server without recommending a new CentOS 7 deployment. Verify the repository track, protect root access, create a limited application account, keep the database private, and test backups before production use.