Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
On an Ubuntu VPS, the reliable MySQL workflow is straightforward: install the distribution package, verify and secure the service, create a database-specific application account, keep MySQL off the public internet unless remote access is truly required, and operate a backup-and-restore process you have actually tested.
This guide covers those tasks in the order you will need them, including commands, privilege decisions, firewall boundaries, backup choices, recovery checks, and the maintenance habits that prevent a small configuration change from becoming an outage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you are managing when you run MySQL on a VPS
MySQL is a database server process running inside your virtual private server. It stores schemas (databases), tables, indexes, users, and configuration on the VPS filesystem. Your web application normally connects over the local socket or loopback interface, so the database does not need to be reachable from the public internet.
There are two different kinds of “root” to keep straight:
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Linux root is the operating-system administrator account.
sudotemporarily gives a permitted command that level of access. - MySQL root is a database account. MySQL identifies an account by both username and client host, so
'root'@'localhost'and'root'@'some-host'are distinct account identities.
Use the Linux administrator account to install packages and edit service configuration. Use MySQL accounts and SQL privileges to control what applications and operators can do inside the server.
Install MySQL on Ubuntu and verify the service
Install from the operating-system package
For an Ubuntu VPS, install the packaged server rather than downloading an unrelated binary:
sudo apt update
sudo apt install mysql-serverThe package normally starts MySQL after installation. Confirm that it is running:
sudo systemctl status mysql
# or
sudo service mysql statusA running service should show an active state. If it failed, read the service journal before changing settings:
sudo journalctl -u mysqlKeep the output, including the first error in the sequence. Later messages often describe consequences rather than the original cause.
Complete the initial security workflow
MySQL’s post-installation workflow includes starting the server, testing access, securing the initial account, and arranging automatic startup. On Ubuntu package installations, run the interactive hardening utility when it is available:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
sudo mysql_secure_installationRead each prompt instead of accepting a remembered answer from another server. The appropriate choices depend on whether you need legacy accounts, anonymous access, test objects, or local administrative access. Verify that you can still perform the administrative action you need before ending the session.
Do not place a password directly in a shell command line. Shell history and process listings can expose it. Prefer the client’s password prompt, a protected option file, or MySQL’s login-path mechanism with filesystem permissions that prevent other users from reading the credentials.
Create a database and a least-privilege application user
Create the schema and account
Open an administrative MySQL session, then create a schema and an account whose host is limited to the machine where the application runs:
sudo mysql
CREATE DATABASE appdb;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'use-a-secret-manager-or-prompt';
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'appuser'@'localhost';The example grants the four data-manipulation permissions commonly needed by a simple runtime account. Replace the names and secret-handling method for your deployment. A framework that creates or alters tables may need additional data-definition permissions during a migration; grant those temporarily to a separate migration account or remove them after the migration rather than making the runtime account permanently administrative.
Recommended Free Tools
Understand privilege scope
MySQL privileges can apply globally, to one database, to individual tables, to columns, or to stored routines. The broad form ON *.* affects every database and should not be the default for an application. The narrower ON appdb.* confines access to one schema.
Be especially cautious with:
FILE, which can allow interaction with files on the server host.- Administrative privileges that can change server operation or inspect other workloads.
GRANT OPTION, which lets an account delegate its own privileges to other accounts.
Oracle’s MySQL 8.4 Reference Manual summarizes the rule plainly: “It is a good idea to grant to an account only those privileges that it needs.” List the resulting grants when auditing an account:
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
SHOW GRANTS FOR 'appuser'@'localhost';Separate human, runtime, and migration access
Do not make every developer or application use the MySQL root account. Give each service its own named account, and give human operators individual accounts where practical. This makes revocation and audit trails possible. A deployment process that runs schema migrations can use a short-lived account with the extra DDL rights it needs, while the application process continues using its restricted runtime account.
Decide whether MySQL should accept network connections
Keep a same-VPS application local
If your application and database are on the same VPS, leave MySQL listening on the local interface. Local-only operation avoids exposing port 3306 to scanners and removes an entire class of firewall and authentication mistakes. An application can connect through the local socket or loopback address without any public DNS record or inbound database rule.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRemote access requires several controls
Changing MySQL’s bind-address to a non-local interface is justified only when a client genuinely runs elsewhere. Ubuntu stores package configuration under /etc/mysql; locate the active server configuration, change the bind address there, and restart only after validating the file:
grep -R "^[[:space:]]*bind-address" /etc/mysql
sudo systemctl restart mysql.service
sudo systemctl status mysqlDo not “fix” a connection by opening port 3306 to every IPv4 and IPv6 address. Prefer an SSH tunnel or a private network for administration. If a public or routed connection is unavoidable, combine all of these controls:
- Bind only to the required interface.
- Allow the port in the firewall only from known source addresses or a tightly defined subnet.
- Create MySQL accounts with a host restriction matching the intended client, rather than a blanket wildcard host.
- Use secure authentication and TLS appropriate to the environment.
- Monitor failed connections and remove the rule when the remote task ends.
Use Ubuntu’s firewall without locking yourself out
Ubuntu identifies ufw as its default firewall configuration tool. Preserve your SSH access before enabling or editing rules. A source-restricted rule is safer than a global allow; adapt the address and port to your network:
sudo ufw status verbose
sudo ufw allow from 203.0.113.25 to any port 3306 proto tcp
sudo ufw enableThe address above is an example documentation range, not a recommendation to copy blindly. If the database is local-only, do not add a 3306 allow rule at all. Check the effective rules after every change and test from the real client network.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Choose a backup method that matches your recovery need
Backups are a recovery system, not merely an export file. MySQL’s documentation lists system crashes, hardware failures, accidental deletion, upgrades, migrations, and replica setup as reasons to maintain backups. Decide what you can lose, how quickly service must return, and where a copy can survive loss of the VPS.
| Method | What it produces | Best fit described in the documentation | Important trade-off |
|---|---|---|---|
mysqldump |
Logical SQL text | Smaller databases and editable SQL restores | Restore time grows with the amount of SQL to execute |
| MySQL Shell Dump Utility | Programmatic logical backup with filtering | Logical backups that need filtering or automation | Requires learning the Shell utility and its output workflow |
| Percona XtraBackup | Physical backup of database files | Larger production databases where backup performance matters | Physical backup and restore procedures are more operationally involved |
Logical and physical methods are not mutually exclusive. A smaller VPS may use logical dumps for portability and keep a provider snapshot for quick rollback. A larger production workload may add physical backups to reduce recovery time. Provider snapshots are useful only if you know what they include, how long they are retained, and whether you have tested restoring one.
Make a logical backup and protect it
Run a basic dump
For a small schema, the documented pattern is:
mysqldump -u root -p appdb > appdb.sql
mysql -u root -p appdb < appdb.sqlThe -p option prompts for the password; it does not put the secret in the command text. Use an account with the dump privileges required by your objects rather than assuming the application account can export everything. Protect the resulting file because it contains the data in a readily readable form:
chmod 600 appdb.sqlFor a real schedule, decide which schemas and objects are included, how often jobs run, how many generations remain, and how failures are reported. Encrypt dumps before sending them to storage outside the VPS. Keep at least one copy separated from the server; a removable external drive can provide an offline copy, but one drive alone is not an off-site, redundant strategy.
Combine fast rollback with independent copies
A practical VPS arrangement is an on-server or attached snapshot for rapid rollback, plus encrypted logical dumps copied to separate storage. Keep copies in a different failure domain, such as removable media or a WAN/off-site location. Document the credentials and encryption-key recovery path separately from the backup files; an encrypted backup without its key is not a usable recovery asset.
Prove that restoration works
A successful dump command proves only that a file was written. It does not prove that the file is complete, readable, or suitable for your application’s recovery time. Periodically restore into a disposable database or staging VPS:
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Create an isolated target that cannot overwrite production data.
- Restore the dump with the same class of MySQL version and account privileges you expect to use during an incident.
- Check that tables, row counts, users or grants required by the application, and representative queries work.
- Start the application against the restored database and exercise a login, a read, and a write path.
- Record elapsed restore time, missing steps, and the next action needed to improve the runbook.
Restore rehearsals are an operational recommendation rather than a universal calendar requirement; set the interval according to how damaging data loss would be and how often your schema changes.
Back up configuration before maintenance
Database contents are only part of a recoverable MySQL installation. Before an invasive upgrade or configuration edit, preserve the package configuration and a database backup. Ubuntu’s package configuration is under /etc/mysql; a simple archive can capture the text settings:
sudo tar -czf mysql-config-$(date +%F).tgz /etc/mysqlDo not copy a live MySQL data directory as if it were a consistent backup. Use a supported physical-backup tool, a provider snapshot designed for the workload, or stop the service when your chosen procedure requires a quiescent filesystem copy. Keep configuration archives with controlled permissions because they may reveal topology or authentication settings.
Maintain the service without guessing at tuning
Change one setting at a time
Keep custom values in the package-supported MySQL configuration locations rather than scattering ad-hoc files. Back up /etc/mysql and the database before invasive changes. When a setting requires a restart, use:
sudo systemctl restart mysql.service
sudo systemctl status mysql
sudo journalctl -u mysqlDo not copy tuning values from an unrelated VPS. Useful settings depend on available memory, storage latency, query shape, concurrency, and the application’s workload. Measure before and after a change, and keep a record so you can revert a setting that increases latency or causes startup failure.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use status and logs as your first diagnostic branch
- Service inactive after installation: inspect
systemctl status mysql, then readjournalctl -u mysqlfor the first configuration or permission error. - MySQL starts but the application cannot connect locally: verify the socket or loopback settings, the account host component, the selected database, and the account’s grants.
- Remote client times out: check the bind address, the VPS firewall, any upstream provider firewall, and whether the client source address is actually allowed.
- Remote client is refused immediately: confirm that MySQL is listening on the intended interface and port; a firewall change cannot make a service listen where it is not bound.
- Restore fails: capture the exact error, verify dump-file integrity and permissions, confirm target version compatibility, and repeat in an isolated environment rather than experimenting against production.
A repeatable VPS checklist
- Install MySQL with
sudo apt install mysql-server. - Verify the service and inspect the journal if it is not active.
- Run the initial security workflow and confirm administrative access.
- Create one schema and separate named accounts for runtime, migration, and human administration as appropriate.
- Grant only the required schema, table, column, or routine privileges; avoid broad administrative rights and
GRANT OPTION. - Keep MySQL local unless a documented remote requirement exists.
- If remote access is required, constrain binding, MySQL host matching, firewall sources, and authentication together.
- Choose logical, physical, or combined backups based on database size and recovery-time needs.
- Schedule backups, encrypt copies, retain them separately from the VPS, and document key recovery.
- Perform restore rehearsals and back up
/etc/mysqlbefore major changes.
Following this sequence gives a beginner a manageable MySQL installation without treating convenience as security or a successful export as proof of recoverability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
