How to reset MariaDB root login to use unix socket authentication

Written by Claudio Kuenzler - 0 comments

Published on February 18th 2024 - Listed in MariaDB Linux Databases

---

Since MariaDB 10.4 (and especially MariaDB on Debian), the default login method for the "root" user is unix_socket_authentication. But what if a password was set and now you want to reset back to the socket authentication method?

unix_socket_authentication shows invalid password

As mentioned before, the new default way in MariaDB is to use unix_socket_authentication for "root" access. This means you can directly use your system "root" user to authenticate via the MariaDB socket. The mysql cli automatically looks up the socket (usually located at /run/mysqld/mysqld.sock) when "localhost" is used as DB host (which is the default).

A password for the root user is not set after the installation of MariaDB. This can be seen in the mysql.user table, where the password column for the root user shows "invalid":

MariaDB [(none)]> select user,password,host from mysql.user;
+--------------+-------------------------------------------+-----------+
| User         | Password                                  | Host      |
+--------------+-------------------------------------------+-----------+
| mariadb.sys  |                                           | localhost |
| root         | invalid                                   | localhost |
| mysql        | invalid                                   | localhost |
| application1 | *517AA707E83516F23E490207C6867DCAB34E9ED4 | localhost |
| application2 | *FB361BAD4BBF7511B9D598D1DA088C6967D1FFD3 | localhost |
+--------------+-------------------------------------------+-----------+
5 rows in set (0.002 sec)

The "invalid" password is not actually an invalid password entry but is the normal initial string (when no password was set):

... the old authentication method - conventional MariaDB password - is still available. By default it is disabled ("invalid" is not a valid password hash), but one can set the password with a usual SET PASSWORD statement.

A password for the root user has been set

In the following output, a password was set for the root user (for both localhost and 127.0.0.1). In this case the encrypted password shows up in mysql.user table:

 MariaDB [(none)]> select user,password,host from mysql.user;
+--------------+-------------------------------------------+----------------+
| User         | Password                                  | Host           |
+--------------+-------------------------------------------+----------------+
| root         | *EB7AF80046273B56408B57048E2887113EDC2436 | localhost      |
| applicationx | *C0E89F8DAD61C8501B23769FA45C562CD6134117 | localhost      |
| mariadb.sys  |                                           | localhost      |
| root         | *EB7AF80046273B56408B57048E2887113EDC2436 | 127.0.0.1      |
+--------------+-------------------------------------------+----------------+
4 rows in set (0.001 sec)

Depending on the type of application running on the server you might run into a problem though - if the application expects unix_socket_authentication but is now greeted with an "Access denied for user" error because a password is expected. I ran into such a problem today while using the Ansible mysql_info module.

Reset root access back to unix_socket_authentication

The root user access can be reset to the default (unix_socket_authentication) again, by running mysql_secure_installation. This command will prompt a couple of questions related to access and security:

root@debian:~# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

Enable unix_socket authentication? [Y/n] Y
Enabled successfully!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] n
 ... skipping.

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

After this command finished, the mysql.user table shows the root entries with the invalid password entry - similar to a new installation of MariaDB:

MariaDB [(none)]> select user,password,host from mysql.user;
+--------------+-------------------------------------------+----------------+
| User         | Password                                  | Host           |
+--------------+-------------------------------------------+----------------+
| root         | invalid                                   | localhost      |
| applicationx | *C0E89F8DAD61C8501B23769FA45C562CD6134117 | localhost      |
| mariadb.sys  |                                           | localhost      |
+--------------+-------------------------------------------+----------------+
3 rows in set (0.001 sec)

Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.