How to reset MariaDB root login to use unix socket authentication

Written by Claudio Kuenzler - 0 comments

Published on February 18th 2024 - last updated on August 14th 2026 - Listed in MariaDB Linux Databases

Since MariaDB 10.4 (and especially MariaDB on Debian), the default login method for the "root" user is unix_socket_authentication. But what if a password was set and now you want to reset back to the socket authentication method?

unix_socket_authentication shows invalid password

As mentioned before, the new default way in MariaDB is to use unix_socket_authentication for "root" access. This means you can directly use your system "root" user to authenticate via the MariaDB socket. The mysql cli automatically looks up the socket (usually located at /run/mysqld/mysqld.sock) when "localhost" is used as DB host (which is the default).

A password for the root user is not set after the installation of MariaDB. This can be seen in the mysql.user table, where the password column for the root user shows "invalid":

The "invalid" password is not actually an invalid password entry but is the normal initial string (when no password was set):

... the old authentication method - conventional MariaDB password - is still available. By default it is disabled ("invalid" is not a valid password hash), but one can set the password with a usual SET PASSWORD statement.

A password for the root user has been set

In the following output, a password was set for the root user (for both localhost and 127.0.0.1). In this case the encrypted password shows up in mysql.user table:

Depending on the type of application running on the server you might run into a problem though - if the application expects unix_socket_authentication but is now greeted with an "Access denied for user" error because a password is expected. I ran into such a problem today while using the Ansible mysql_info module.

Reset root access back to unix_socket_authentication

The root user access can be reset to the default (unix_socket_authentication) again, by running mysql_secure_installation. This command will prompt a couple of questions related to access and security:

root@debian:~# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

Enable unix_socket authentication? [Y/n] Y
Enabled successfully!
Reloading privilege tables..
... Success!

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] n
... skipping.

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
... Success!

Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

After this command finished, the mysql.user table shows the root entries with the invalid password entry - similar to a new installation of MariaDB:

What if you can't even use mysql commands anymore?

The fix above works as long as you can still access your MariaDB using mysql and other related commands. I've seen above situations after upgrading from Debian 11 to 12.

But you might completely lose access, too. I've seen this happening after MariaDB was upgraded to 11.8 (Debian 12 to Debian 13 upgrade).

Even with a correct and previously working password (using ~/.my.cnf), I could no longer connect to the local MariaDB:

root@debian:~# mysql
ERROR 1698 (28000): Access denied for user 'root'@'localhost'

root@debian:~# mariadb
ERROR 1698 (28000): Access denied for user 'root'@'localhost'

In this situation you run out of options - except one remaining one: Force a reset of the MariaDB root user's password.

To do this, you must stop the MariaDB service:

root@debian:~# systemctl stop mariadb

Sometimes it might also be necessary to stop the additional mariadb.socket service, too:

root@debian:~# systemctl stop mariadb.socket

Verify that no process listens on port 3306 anymore:

root@debian:~# ss -lntup | grep 3306

Now launch a manual mysqld_safe process, explicitly telling the process to skip the privilege table (hence allowing you to login without credentials):

root@debian:~# mysqld_safe --skip-grant-tables --skip-networking &
260814 06:23:28 mysqld_safe Logging to syslog.
260814 06:23:28 mysqld_safe Starting mariadbd daemon with databases from /var/lib/mysql

You can now use mysql / mariadb again to connect to the temporary MariaDB process and check the current users:

root@debian:~# mysql
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 8
Server version: 11.8.6-MariaDB-0+deb13u1 from Debian -- Please help get to 10k stars at https://github.com/MariaDB/Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> select user,host,plugin,password from mysql.user;
+-------------+-----------+-----------------------+-------------------------------------------+
| User | Host | plugin | Password |
+-------------+-----------+-----------------------+-------------------------------------------+
| root | localhost | unix_socket | |
| appsCH | localhost | mysql_native_password | *XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX |
| mariadb.sys | localhost | mysql_native_password | |
+-------------+-----------+-----------------------+-------------------------------------------+
3 rows in set (0.002 sec)

Now manually reset the password and privileges of the root user:

MariaDB [(none)]> UPDATE mysql.global_priv SET priv = JSON_SET( priv, '$.plugin', 'mysql_native_password', '$.authentication_string', PASSWORD('myrootpassword') ) WHERE User='root' AND Host='localhost';
Query OK, 1 row affected (0.001 sec)
Rows matched: 1 Changed: 1 Warnings: 0

In the mysql.user table you can now see the root user has switched from unix_socket to mysql_native_password:

Flush the privileges, then quit MariaDB and kill the temporary process:

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.002 sec)

MariaDB [(none)]> quit
Bye

root@debian:~# pkill mariadb
[1]+ Done mysqld_safe --skip-grant-tables --skip-networking

You can now start MariaDB normally again and you should be able to connect to it using your root credentials (update ~/.my.cnf if necessary):

root@debian:~# systemctl start mariadb
root@debian:~# mysql
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 9
Server version: 11.8.6-MariaDB-0+deb13u1 from Debian -- Please help get to 10k stars at https://github.com/MariaDB/Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> quit

Now you can launch mariadb-secure-installation to switch to the Unix Socket Authentication.

Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.

Blog Tags:

AI AWS Android Ansible Apache Apple Atlassian BSD Backup Bash Bluecoat CMS Chef Cloud Coding Consul Containers CouchDB DB DNS Databases Docker ELK Elasticsearch Filebeat FreeBSD Galera Git GlusterFS Grafana Graphics HAProxy HTML Hacks Hardware Icinga Influx Internet Java KVM Kibana Kodi Kubernetes LVM LXC Linux Logstash Mac Macintosh Mail MariaDB Minio MongoDB Monitoring Multimedia MySQL NFS Nagios Network Nginx OSSEC OTRS Observability Office OpenSearch PHP Perl Personal PostgreSQL PowerDNS Proxmox Proxy Python Rancher Rant Redis Roundcube SSL Samba Seafile Security Shell SmartOS Solaris Surveillance Systemd TLS Tomcat Ubuntu Unix VMware Varnish Virtualization Windows Wireless Wordpress Wyse ZFS Znuny Zoneminder