SQL Server installation on Linux (RHEL / Ubuntu, production-ready)

Installs SQL Server 2022 or 2025 from the Microsoft repository on a single Linux server (RHEL family or Ubuntu): edition choice, secure handling of the sa password, mssql-tools18 (sqlcmd/bcp), separate data/log/tempdb/backup directories, a memory limit, max server memory, MAXDOP and tempdb file count calculated from memory and CPU, optional TLS and firewall. You end up with a verified instance that has its first backup and the sa account disabled.

For Windows Server open the SQL Server installation on Windows guide. If you are building an Always On AG on Linux, install each node with this guide first, then move on to the Always On AG (Linux, Pacemaker) guide.

Topology: 1 server

Before you start

• The server runs a supported operating system (…RHEL family ……Ubuntu ……) on x86-64 and is up to date. Time zone is correct and NTP is in sync.
• RAM and CPU match the form: … GB, … logical CPUs, … NUMA node(s) (memory and MAXDOP are calculated from these). At least 2 GB of RAM is mandatory; swap is configured.
• The disks/LVs for the data (…), log (…), tempdb (…) and backup (…) directories are ready, persistent in fstab, XFS (recommended) or ext4, mounted with noatime. At least 6 GB is free for /var/opt/mssql.
• Hostname … is set and resolves (at most 15 characters recommended; it matters for AD/AG). The application network (…) is reachable.
• The server can reach packages.microsoft.com over HTTPS, or an internal mirror is configured.
• Port … is not used by another process.
• Edition decided: …. …This edition cannot be used in production.…Express: 10 GB per database (50 GB in SQL Server 2025), limited memory/CPU; no Agent.…The license (and the product key if needed) is ready.…
• A strong sa password has been chosen (at least 8 characters, with at least three of: uppercase, lowercase, digits, symbols) and stored in the password vault. A separate password is also ready for the … login.
• The TLS certificate (…) and key (…) are on the server. The certificate's CN/SAN matches the FQDN clients will connect to; the chain is trusted on the clients.
• Logged in as root or as a user with sudo rights; a maintenance window is booked and a snapshot of the server has been taken.

Phases of the guide

• Operating system preparation — Set the hostname and update the system · Write the TuneD mssql profile · Activate the TuneD profile
• Installing the SQL Server software — Add the Microsoft SQL Server repository · Add the Microsoft SQL Server repository · Install SQL Server · Install the command-line tools (mssql-tools18)
• Instance configuration (mssql-conf setup) — Run the initial configuration (edition, sa password, collation)
• Directories and server settings (mssql-conf) — Create the data, log, tempdb and backup directories · Set the default directories, the memory limit and Agent · Configure the TLS certificate and force encryption · Restart the service · Configure server-level settings (sp_configure) · Move tempdb and add data files …
• Network and security — Open the port in the firewall · Create the administrator login (…)
• Verification — Check version, edition and settings · Check that Agent is running · Check the errorlog · Test a remote connection
• Post-installation — Take the first backup of the system databases · Plan maintenance and monitoring · Disable the sa account