tl;dr
- Using
sudo
is the advised method. (e.g. sudo mysql
)
- Set the
root
account's password only when necessary.
Introduction
Starting from MariaDB 10.4.3, the default authentication method changed to unix_socket
.
Once (the unix_socket
plugin) has the (UNIX) user name, it will authenticate the connecting user as the MariaDB account that has the same user name. — Authentication Plugin - Unix Socket
Using unix_socket means that if you are the system root user, you can login as root@locahost
without a password. — Authentication from MariaDB 10.4
To paraphrase, if you are the system's 'root' user, then you can access the MariaDB's 'root' user without any password. This can be achieved using the sudo
command in linux and macOS.
Unix
The mysql
command is denied, because there is no MariaDB user whose name is 'username'.
username@hostname:~$ mysql --version
# mysql Ver 15.1 Distrib 10.6.12-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper
username@hostname:~$ mysql
# ERROR 1045 (28000): Access denied for user 'username'@'localhost' (using password: NO)
The sudo mysql
command worked because there is a DB user named 'root' out-of-the-box.
username@hostname:~$ sudo mysql
# Welcome to the MariaDB monitor. Commands end with ; or \g.
# Your MariaDB connection id is 32
# Server version: 10.6.12-MariaDB-0ubuntu0.22.04.1 Ubuntu 22.04
MariaDB [(none)]> SELECT CURRENT_USER;
# +----------------+
# | CURRENT_USER |
# +----------------+
# | root@localhost |
# +----------------+
# 1 row in set (0.001 sec)
The 'root' and 'mysql' users have the authentication string set as invalid
, which is not a valid password hash. This is the reason why the these accounts seem to have a password set.
MariaDB [(none)]> SELECT user, plugin, authentication_string FROM mysql.user;
# +-------------+-----------------------+-----------------------+
# | User | plugin | authentication_string |
# +-------------+-----------------------+-----------------------+
# | mariadb.sys | mysql_native_password | |
# | root | mysql_native_password | invalid |
# | mysql | mysql_native_password | invalid |
# +-------------+-----------------------+-----------------------+
# 3 rows in set (0.002 sec)
Two all-powerful accounts are created by default — root and the OS user that owns the data directory, typically mysql. They are created as:
CREATE USER root@localhost IDENTIFIED VIA unix_socket OR mysql_native_password USING 'invalid'
CREATE USER mysql@localhost IDENTIFIED VIA unix_socket OR mysql_native_password USING 'invalid'
— Authentication from MariaDB 10.4
macOS and Brew
For some reason, the latest version of MariaDB installed with Brew has a different setup.
username@hostname ~ % mysql
# Welcome to the MariaDB monitor. Commands end with ; or \g.
# Your MariaDB connection id is 20
# Server version: 10.11.3-MariaDB Homebrew
MariaDB [(none)]> SELECT CURRENT_USER;
# +--------------------+
# | CURRENT_USER |
# +--------------------+
# | username@localhost |
# +--------------------+
# 1 row in set (0.001 sec)
MariaDB [(none)]> SELECT user, plugin, authentication_string FROM mysql.user;
# +-------------+-----------------------+-----------------------+
# | User | plugin | authentication_string |
# +-------------+-----------------------+-----------------------+
# | mariadb.sys | mysql_native_password | |
# | root | mysql_native_password | invalid |
# | username | mysql_native_password | invalid |
# | PUBLIC | | |
# +-------------+-----------------------+-----------------------+
# 4 rows in set (0.003 sec)
The mysql
command and the authentication WORKS without sudo
because there is another MariaDB user created by default - it's username matches the macOS username.
mysql_secure_installation
The infamous mysql_secure_installation
script is probably not necessary in MariaDB 10.4+.
Note that many of the reasons for the existence of this script no longer apply. In particular, from MariaDB 10.4, Unix socket authentication is applied by default, and there is usually no need to create a root password. See Authentication from MariaDB 10.4. — mysql_secure_installation
mysql_install_db
. Try tobrew remove mariadb
and reinstall again.mysql_install_db
right? (or something similiar)mysql_install_db
is run by the Homebrew's Mariadb install script at/usr/local/Homebrew/Library/Taps/homebrew/homebrew-core/Formula/mariadb.rb
but it needs some specific parameters.