Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOn Ubuntu, a freshly installed MySQL server commonly creates root@localhost with the auth_socket authentication plugin. That means sudo mysql -u root works without a MySQL password, while mysql -u root -p can fail with “Access denied.” To use password login, connect through the Unix socket, change the account to a password-based plugin, set a strong password with ALTER USER, and test the exact command your client will use.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are changing
A MySQL account is identified by both its user name and host. The administrative account normally discussed here is 'root'@'localhost', not every account named root on the server. Its password and its authentication plugin are separate settings:
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Password: the secret MySQL checks when a password-based plugin is used.
- Authentication plugin: the method MySQL uses to verify the connection, such as
auth_socketorcaching_sha2_password.
Changing a password does not automatically change the plugin. If root remains on auth_socket, a password supplied with -p will not be used for authentication. Conversely, changing the plugin without setting a usable password can leave password login unusable.
Before you begin
- You need an Ubuntu account with
sudoprivileges. Local socket authentication depends on operating-system access, so a user who cannot runsudocannot use this recovery path. - Confirm that the server is MySQL, not MariaDB. Plugin names and account syntax can differ. The command-line client usually prints a server banner after connection; you can also run
SELECT VERSION();once connected. - Use a long, unique password that is not reused for Ubuntu, applications, or another database. Do not put the real secret in a shell command, screenshot, script, or documentation.
- Plan how the account will be used. Keep root local for administration whenever possible; applications should have a separate least-privilege account.
Step 1: Inspect the root account
Ubuntu’s packaged MySQL commonly expects the first administrative connection to use the local Unix socket. Open a root session with:
sudo mysql -u rootIf that command opens a mysql> prompt, inspect every root row and its plugin:
SELECT user, host, plugin FROM mysql.user WHERE user = 'root';A typical result includes root, localhost, and auth_socket. The host value matters: an 'root'@'localhost' account is a different account from 'root'@'127.0.0.1' or 'root'@'%'. Apply changes to the row that matches the connection you intend to test.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →While connected, you can record the server version for plugin compatibility:
SELECT VERSION();Do not copy an authentication-plugin name from an old tutorial without checking this result. Current MySQL 8 installations support caching_sha2_password; older releases and MariaDB packages may expose different defaults or names.
Choose the authentication method first
| Method | How root proves identity | Advantages | Trade-offs | Typical connection |
|---|---|---|---|---|
auth_socket |
A local Unix-socket client is checked against the operating-system user. | No database password to store for local administration; access is constrained to the machine and its local users. | Clients that expect a password cannot log in as root; recovery requires a working sudo path. |
sudo mysql -u root |
Password plugin, such as caching_sha2_password |
MySQL verifies the password supplied by the client. | Works with clients and automation that require password authentication. | The secret must be protected, rotated, and kept out of logs; exposing root for remote use increases risk. | mysql -u root -p |
There is no requirement to switch away from auth_socket merely because a password has not been set. Choose password authentication only when a specific client or operational workflow needs it.
Switch root to password authentication and set the password
Keep the session opened with sudo mysql -u root. For a current MySQL 8 server, assign the password and select the supported password plugin in one statement:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →ALTER USER 'root'@'localhost'
IDENTIFIED WITH caching_sha2_password BY 'NEW_STRONG_PASSWORD';Replace NEW_STRONG_PASSWORD with the secret you selected. The account host must exactly match the row returned by the inspection query. If your server reports a different supported password plugin, use that plugin’s documented name rather than blindly substituting an older mysql_native_password example.
MySQL’s ALTER USER statement is the supported way to assign or change the password of an existing account. It updates the account; it does not create another root user and it does not grant additional privileges.
Exit the administrative session:
EXIT;Now test password authentication without sudo:
mysql -u root -pAt the password prompt, enter the new secret. Nothing is echoed while you type. A successful login returns a MySQL prompt. Test from the same environment your application will use, because socket, TCP, user, and host combinations can select different account rows.
Keep socket authentication instead
If local-only administration is the goal, leave the root account on auth_socket. Use:
sudo mysql -u rootThe plugin authenticates a local Unix-socket client and does not require a MySQL password. Setting a password while leaving the plugin unchanged will not make mysql -u root -p work; the authentication method still determines how the login is checked.
This arrangement is appropriate when administrators have controlled sudo access and no application needs to connect as root. Give applications their own account instead of weakening the local-only root policy.
Verify the result and the account you actually changed
After testing, reconnect through the administrative method you chose and confirm the plugin:
sudo mysql -u rootSELECT user, host, plugin FROM mysql.user WHERE user = 'root';For a password-based setup, the intended row should show the selected password plugin. For a socket-based setup, it should show auth_socket. If several rows are returned, inspect each host value and remove ambiguity from your client tests: localhost commonly uses a Unix socket, while an explicit IP address requests TCP and can match another account row.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use the least powerful test that proves your requirement. A local administrative check does not prove that a remote client can or should connect as root, and a successful root login does not validate an application’s account permissions.
Optional hardening with mysql_secure_installation
Ubuntu provides an interactive hardening utility:
sudo mysql_secure_installationOn Ubuntu Noble’s packaged MySQL, the utility can offer to:
Best Value
- Set a password for root accounts.
- Remove root accounts that are accessible from outside the local host.
- Remove anonymous users.
- Remove the test database.
Read each prompt for the server’s real use case. This workflow is optional; it does not replace inspecting the account’s plugin and host. If you already changed root with ALTER USER, avoid making a second change blindly. Confirm the resulting account and test the intended login afterward.
Troubleshoot common failures
mysql -u root -p returns “Access denied”
First try the Ubuntu socket path:
sudo mysql -u rootThen inspect plugin for 'root'@'localhost'. If it is auth_socket, password login is expected to fail until you deliberately switch the account to a supported password plugin with ALTER USER. If the plugin is already password-based, check that you are using the correct host row and the current password.
sudo mysql -u root also fails
Verify that the Linux account can run sudo, that the MySQL service is running, and that the client is connecting to the intended local server. If the machine has more than one MySQL-compatible installation, confirm the server banner and package before applying MySQL-specific account commands. Without operating-system administrator access, an Ubuntu administrator or the server’s documented recovery procedure is required.
ALTER USER reports an error
Check the exact account identity and server capabilities:
- Run the inspection query and use the returned
hostvalue, such aslocalhost, in theALTER USERstatement. - Run
SELECT VERSION();and verify that the chosen plugin is supported by that release. - Confirm that you are connected to MySQL rather than MariaDB, whose syntax and plugin set can differ.
- Check that the SQL statement’s quotes and semicolon are intact. A password containing a single quote requires proper SQL escaping; do not paste an unescaped secret into a command copied from a shell.
The password works locally but not from an application
The application may be selecting a different account row because it uses a different host, socket, or TCP setting. Compare its connection parameters with the rows returned by SELECT user, host, plugin FROM mysql.user WHERE user = 'root';. More importantly, do not use root for routine application access. Create a separate account with only the permissions the application needs, and test that account using the application’s exact connection mode.
A remote root login is being considered
Do not expose the root account for remote application access. Remote root expands the impact of a leaked secret and conflicts with the local-administration purpose of auth_socket. Keep root local and use a dedicated, least-privilege account for remote administration or application traffic, protected by the server’s normal network and access controls.
Quick Recap
Password-handling practices that prevent a second incident
- Enter the password at MySQL’s prompt instead of placing it after
-p, which can expose it through shell history or process inspection. - Store credentials in the application’s supported protected configuration mechanism, not in source control or world-readable files.
- Use a unique secret for each environment and rotate it through a planned maintenance procedure.
- After rotation, test both the administrative path and each legitimate client path, then remove obsolete credentials from deployment systems.
- Keep a documented break-glass procedure that requires controlled
sudoaccess if root remains socket-authenticated.
MySQL versus MariaDB: stop before copying commands
This procedure targets Ubuntu’s MySQL packages. MariaDB may display a different server banner, use different authentication plugins, or interpret account-management syntax differently. Identify the server and package first, then follow that server’s documentation. A command that is valid on MySQL 8 is not automatically valid on every MariaDB release.
Quick decision checklist
- Connect with
sudo mysql -u rootand inspectuser,host, andplugin. - If local socket administration is sufficient, keep
auth_socketand usesudo mysql -u root. - If a client requires a password, run
ALTER USERfor the exact root host row with a plugin supported by the installed MySQL version. - Exit and verify with
mysql -u root -p, entering the password only at the prompt. - Run
sudo mysql_secure_installationonly if its hardening choices fit this server, and review every prompt. - Keep root local and create a separate least-privilege account for applications or remote connections.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
