Hardened MySQL 8.4 on Debian 12

Charges for this image cover the security hardening, optimization, and pre-integration work Hanwei performs on top of the upstream MySQL 8.4 and Debian 12 projects. MySQL 8.4 is installed from the MySQL community apt repository, the data directory is initialized and the service is enabled, so the server is listening when the instance finishes booting. This version replaces the earlier 8.0 image on this platform. The operating system underneath carries the same hardened and tuned baseline used across this catalogue.

What Hanwei Adds to Upstream MySQL 8.4

• Server installed and initialized at build time: packages come from the MySQL community apt repository, /var/lib/mysql is initialized and the mysql service is enabled, so the server accepts local connections as soon as the instance boots.
• Transparent huge pages disabled at boot: a oneshot unit sets them to never before the database starts, following the vendor's guidance. This is not the distribution default, where the tuned virtual-guest profile leaves them enabled.
• TLS material generated per instance, not baked into the image: the server certificate, CA and RSA key pair are removed before sealing and regenerated on first boot, so no two subscribers share a private key.
• Tuning baseline applied identically across the catalogue: the file descriptor limit goes from 1024 to 65536 and the memory-map ceiling from 65530 to 262144; the device receive backlog goes from 1000 to 16384 and the TCP SYN backlog from 128 to 8192, so bursts queue instead of being dropped; socket buffer maxima reach 16 MB for larger autotuned windows; connections keep their congestion window across idle periods; and the journal is capped at 500 MB. The profile raises ceilings only and does not alter protocol semantics or application behaviour.
• Applied hardening beyond the distribution default: SSH is limited to a vetted cipher, key exchange and MAC list, X11 forwarding is off, the login grace period is shortened and verbose authentication logging is on; auditd runs a base rule set for privileged command execution; the kernel drops ICMP redirects on IPv4 and IPv6, logs martian packets, filters reverse paths in loose mode, restricts dmesg and turns off sysrq.
• AWS operational integration: the SSM Agent is installed and enabled for Session Manager and Patch Manager without an inbound SSH rule; chrony points at the Amazon Time Sync Service; and the root filesystem extends at boot when the volume exceeds the image default.
• Patch level set at the build date: packages come from official upstream repositories at the newest level published when the image was built.
• Repeatable build and EC2 validation: each version comes from the same build process and is launched and exercised on EC2 before release.

Access and Security Posture

• AppArmor is active and auditd records activity against a base rule set.
• Sign in as 'admin' with the key pair selected at launch, then use 'sudo su -' for a root shell. Session Manager is available as an alternative that needs no inbound port.
• Direct root login over SSH is disabled and password authentication is not accepted.
• No authorized keys and no SSH private keys are embedded in the image.

Operational Impact on EC2

• Launch-to-usable-database time is reduced to a single boot cycle.
• Every instance starts from an identical configuration, removing drift between development, staging and production hosts.
• Network services need no per-host limit or backlog adjustment before handling load.
• Clock accuracy comes from the Amazon Time Sync Service, which matters for log correlation and request signing.
• Post-launch patching effort is lower because the package set is current at release.

Where This Image Fits

• Application backends on teams standardised on Debian rather than an RPM distribution.
• Migration target for workloads consolidating onto the 8.4 long-term support series.
• Development and test environments recreated frequently from an identical database configuration.
• Content management and e-commerce platforms that expect a MySQL-compatible server.

About MySQL 8.4 and Debian 12

MySQL 8.4 is a long-term support release, carrying the InnoDB engine, common table expressions, window functions, JSON document support and caching_sha2_password as the default authentication plugin. As an LTS release its behaviour is held stable through the series, with fixes rather than feature changes, and vendor support runs through 2032.

Debian 12 is a stable Debian release with security support into 2028, carrying the 6.1 kernel series, apt for package management and AppArmor for mandatory access control. Its conservative defaults and long support window make it a common base for database hosts. MySQL packages here come from the vendor's own apt repository rather than the Debian archive, which is what makes the 8.4 LTS series available and keeps the configuration layout consistent with the vendor's documentation.