How to reset MariaDB root login to use unix socket authentication

Written by - 0 comments

Published on - Listed in MariaDB Linux Databases


Since MariaDB 10.4 (and especially MariaDB on Debian), the default login method for the "root" user is unix_socket_authentication. But what if a password was set and now you want to reset back to the socket authentication method?

unix_socket_authentication shows invalid password

As mentioned before, the new default way in MariaDB is to use unix_socket_authentication for "root" access. This means you can directly use your system "root" user to authenticate via the MariaDB socket. The mysql cli automatically looks up the socket (usually located at /run/mysqld/mysqld.sock) when "localhost" is used as DB host (which is the default).

A password for the root user is not set after the installation of MariaDB. This can be seen in the mysql.user table, where the password column for the root user shows "invalid":

MariaDB [(none)]> select user,password,host from mysql.user;
+--------------+-------------------------------------------+-----------+
| User         | Password                                  | Host      |
+--------------+-------------------------------------------+-----------+
| mariadb.sys  |                                           | localhost |
| root         | invalid                                   | localhost |
| mysql        | invalid                                   | localhost |
| application1 | *517AA707E83516F23E490207C6867DCAB34E9ED4 | localhost |
| application2 | *FB361BAD4BBF7511B9D598D1DA088C6967D1FFD3 | localhost |
+--------------+-------------------------------------------+-----------+
5 rows in set (0.002 sec)

The "invalid" password is not actually an invalid password entry but is the normal initial string (when no password was set):

... the old authentication method - conventional MariaDB password - is still available. By default it is disabled ("invalid" is not a valid password hash), but one can set the password with a usual SET PASSWORD statement.

A password for the root user has been set

In the following output, a password was set for the root user (for both localhost and 127.0.0.1). In this case the encrypted password shows up in mysql.user table:

 MariaDB [(none)]> select user,password,host from mysql.user;
+--------------+-------------------------------------------+----------------+
| User         | Password                                  | Host           |
+--------------+-------------------------------------------+----------------+
| root         | *EB7AF80046273B56408B57048E2887113EDC2436 | localhost      |
| applicationx | *C0E89F8DAD61C8501B23769FA45C562CD6134117 | localhost      |
| mariadb.sys  |                                           | localhost      |
| root         | *EB7AF80046273B56408B57048E2887113EDC2436 | 127.0.0.1      |
+--------------+-------------------------------------------+----------------+
4 rows in set (0.001 sec)

Depending on the type of application running on the server you might run into a problem though - if the application expects unix_socket_authentication but is now greeted with an "Access denied for user" error because a password is expected. I ran into such a problem today while using the Ansible mysql_info module.

Reset root access back to unix_socket_authentication

The root user access can be reset to the default (unix_socket_authentication) again, by running mysql_secure_installation. This command will prompt a couple of questions related to access and security:

root@debian:~# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

Enable unix_socket authentication? [Y/n] Y
Enabled successfully!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] n
 ... skipping.

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

After this command finished, the mysql.user table shows the root entries with the invalid password entry - similar to a new installation of MariaDB:

MariaDB [(none)]> select user,password,host from mysql.user;
+--------------+-------------------------------------------+----------------+
| User         | Password                                  | Host           |
+--------------+-------------------------------------------+----------------+
| root         | invalid                                   | localhost      |
| applicationx | *C0E89F8DAD61C8501B23769FA45C562CD6134117 | localhost      |
| mariadb.sys  |                                           | localhost      |
+--------------+-------------------------------------------+----------------+
3 rows in set (0.001 sec)


Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.

RSS feed

Blog Tags:

  AWS   Android   Ansible   Apache   Apple   Atlassian   BSD   Backup   Bash   Bluecoat   CMS   Chef   Cloud   Coding   Consul   Containers   CouchDB   DB   DNS   Database   Databases   Docker   ELK   Elasticsearch   Filebeat   FreeBSD   Galera   Git   GlusterFS   Grafana   Graphics   HAProxy   HTML   Hacks   Hardware   Icinga   Influx   Internet   Java   KVM   Kibana   Kodi   Kubernetes   LVM   LXC   Linux   Logstash   Mac   Macintosh   Mail   MariaDB   Minio   MongoDB   Monitoring   Multimedia   MySQL   NFS   Nagios   Network   Nginx   OSSEC   OTRS   Office   PGSQL   PHP   Perl   Personal   PostgreSQL   Postgres   PowerDNS   Proxmox   Proxy   Python   Rancher   Rant   Redis   Roundcube   SSL   Samba   Seafile   Security   Shell   SmartOS   Solaris   Surveillance   Systemd   TLS   Tomcat   Ubuntu   Unix   VMWare   VMware   Varnish   Virtualization   Windows   Wireless   Wordpress   Wyse   ZFS   Zoneminder