1. MySQL下载就不说了，以5.7版本举例

2. 解压安装包

tar -zxvf mysql-5.7.41-linux-glibc2.12-x86_64.tar.gz

3. 重命名目录

mv mysql-5.7.41-linux-glibc2.12-x86_64  /usr/local/mysql

4. 创建mysql用户组和用户

groupadd mysql
useradd -r -g mysql mysql

5. 创建数据目录并赋予权限

#创建目录
mkdir -p /data/mysql 
#赋予权限
chown mysql:mysql -R /data/mysql 

6. 修改配置文件 

vim /etc/my.cnf

[mysqld]
bind-address=0.0.0.0
port=3306
user=mysql
basedir=/usr/local/mysql
datadir=/data/mysql
socket=/tmp/mysql.sock
log-error=/data/mysql/mysql.err
pid-file=/data/mysql/mysql.pid
character_set_server=utf8mb4
symbolic-links=0
explicit_defaults_for_timestamp=true
lower_case_table_names=1
[client]
default-character-set=utf8
[mysql]
default-character-set=utf8

7. 初始化数据库

# 如缺少权限，进行授权
chmod 755 /data

./mysqld --defaults-file=/etc/my.cnf --basedir=/usr/local/mysql/ --datadir=/data/mysql/ --user=mysql --initialize

8. 查看root用户密码

#初始化完成后，默认会生成一个root用户的密码，最后一行，如下位置。这里要记住，后面登录的时候需要使用。
cat /data/mysql/mysql.err

9. 启动mysql服务

cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqlservice mysql start

10. 登录mysql命令行，修改密码

./mysql -u root -p

SET PASSWORD = PASSWORD('Abc@135246');
ALTER USER 'root'@'localhost' PASSWORD EXPIRE NEVER;
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'Abc@135246';
flush privileges;

11. 创建数据库

create database testdb default character set utf8mb4 collate utf8mb4_general_ci;

12. 创建DB用户并授权

CREATE USER 'dbuser'@'%' IDENTIFIED BY 'Abc@135246';
GRANT ALL PRIVILEGES ON testdb.* TO 'dbuser'@'%';

13. mysql口令复杂度设置

show variables like 'validate%';
INSTALL PLUGIN validate_password SONAME 'validate_password.so';SET GLOBAL validate_password_length = 8;
SET GLOBAL validate_password_policy = 'MEDIUM';
SET GLOBAL validate_password_number_count = 1;
SET GLOBAL validate_password_special_char_count = 1;

14. 设置密码错误超过次数锁定策略

install plugin CONNECTION_CONTROL soname 'connection_control.so';
install plugin CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS soname 'connection_control.so';#失败五次
SET GLOBAL connection_control_failed_connections_threshold = 5;
#锁定10分钟
SET GLOBAL connection_control_min_connection_delay = 600000;

15. 防火墙配置

systemctl status firewalld
firewall-cmd --zone=public --add-port=3306/tcp --permanent
systemctl restart firewalld.service