Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOn Ubuntu, the packaged MySQL server commonly creates root@localhost with the auth_socket authentication plugin. That means the first successful administrative command is usually sudo mysql -u root, not mysql -u root -p. A password can be assigned while leaving socket authentication in place, but password logins will continue to fail until you also change the account’s authentication plugin.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To switch a current MySQL 8 installation to password authentication, open a local administrative session, verify the account row, run ALTER USER with a supported password plugin, exit, and test with mysql -u root -p. If you prefer Ubuntu’s local-only model, keep auth_socket and continue using sudo mysql -u root.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you are changing
MySQL identifies an account by two values: its user name and its host. The account shown as 'root'@'localhost' is a different account from 'root'@'127.0.0.1', 'root'@'::1', or 'root'@'%'. A password change succeeds only when the statement targets the row that your client actually uses.
There are also two separate settings involved:
- Credential: the secret assigned to the account.
- Authentication plugin: the method MySQL uses to verify a connection, such as
auth_socketor a password plugin.
Changing the credential does not automatically change the plugin. With auth_socket, a local Unix-socket connection is authorized through the operating-system user and does not require a MySQL password. Therefore, setting a password while leaving the plugin unchanged does not make mysql -u root -p work.
#1 Best Overall
Before you begin
Confirm that the server is MySQL
The commands below are for Oracle MySQL. MariaDB uses related SQL but can have different plugin names, defaults, and package behavior. Check the server banner before applying a MySQL-specific plugin command:
mysql --versionIf the output identifies MariaDB, use that product’s documentation and supported authentication plugins rather than copying the MySQL 8 example unchanged.
Use a local administrative shell
You need operating-system sudo access for Ubuntu’s default socket-authenticated root account. Run commands in a terminal on the database host, or through a trusted administrative session. Do not place a real password in a command-line argument, shell history, source-control file, or published guide.
Know which client behavior you need
Decide whether the account must be used by a password-based client, or whether local administration through sudo is sufficient. Applications should normally receive a separate, least-privilege MySQL account; changing root authentication to accommodate an application is usually the wrong design.
Inspect the root account first
Ubuntu’s initial root account is commonly configured for auth_socket. Start the local session with:
sudo mysql -u rootThe -u root option selects the MySQL user, while sudo allows the client to authenticate through the local Unix socket as the operating-system administrator. Once you see the MySQL prompt, inspect every root row:
SELECT user, host, plugin FROM mysql.user WHERE user = 'root';Typical output includes a row for root at localhost. Read the host and plugin columns carefully. If more than one row is returned, each row is a separate account and may require a separate administrative decision. Do not assume that changing 'root'@'localhost' changes a root account defined for another host.
Change root to password authentication
Use this path when a local tool or administrative workflow specifically needs to connect with a MySQL password.
1. Choose a strong secret
Use a long, unique password generated for this server. Do not reuse an operating-system password, an application secret, or a password from another database. Store it in an approved password manager or secret-management system. The example token below is a placeholder, not a password to copy literally.
2. Alter the exact account row
For a current MySQL 8 installation, a supported password plugin is caching_sha2_password:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →ALTER USER 'root'@'localhost'
IDENTIFIED WITH caching_sha2_password BY 'NEW_STRONG_PASSWORD';MySQL documents ALTER USER with an IDENTIFIED BY clause as the statement for assigning or changing an existing account password. The form above also explicitly selects the password authentication plugin, which is the important difference from merely assigning a password to an account that remains on auth_socket.
Plugin support and package defaults vary by MySQL release. Inspect the installed server and its available plugins before using a plugin name from an older tutorial. In particular, do not blindly replace the command with older mysql_native_password instructions; verify that the server version supports the choice and that all clients you must support can use it.
3. Leave the session and test the intended mode
Exit the administrative session:
EXIT;Now test the same connection style that your client or maintenance script will use:
mysql -u root -pAt the password prompt, enter the new secret. Keeping the password out of the command itself prevents it from appearing in shell history and process listings. A successful prompt confirms that the targeted account row now accepts password authentication from that client mode.
4. Verify the plugin after reconnecting
Once logged in, verify the account state again:
SELECT user, host, plugin FROM mysql.user WHERE user = 'root';The targeted row should show the password plugin you selected. If it still shows auth_socket, you either altered a different host row, the statement did not complete, or another account is being selected by the connection.
Keep Ubuntu’s socket authentication instead
Socket authentication is a valid security choice for a server administered only from its own host. With auth_socket, MySQL authenticates a local Unix-socket client and does not require a MySQL password. The normal command remains:
sudo mysql -u rootThis model ties root access to control of the operating-system account that can invoke sudo. It avoids storing or distributing a root database password, but it also means a password-only client cannot use this account. A password assigned by some other operation does not override the plugin; you must explicitly switch the plugin if password login later becomes a requirement.
Socket authentication is most appropriate when:
- administration is performed locally on the Ubuntu host;
sudoaccess is tightly controlled and audited;- no remote tool or application needs to log in as MySQL root.
If you lose sudo access, socket authentication does not provide a separate password-based recovery path. Plan operating-system access and emergency administration accordingly.
Recommended Free Tools
Password versus socket authentication: choosing deliberately
| Consideration | auth_socket |
Password authentication |
|---|---|---|
| Local-only security | Restricts the normal root login to local Unix-socket access and operating-system privileges. | Allows a password-based client wherever the account and server permit that connection. |
| Application compatibility | Many password-only clients cannot use it for root login. | Works with clients that support the selected password plugin. |
| Operational recovery | Requires working Ubuntu sudo access for the standard login. |
Requires protecting, rotating, and recovering the database secret. |
| Version considerations | Availability and default behavior depend on the packaged server. | Plugin names and client support vary by MySQL release; verify before changing them. |
For normal production operation, use root for administration and create a separate account for each application or service. Grant only the privileges that service needs, keep the account’s host scope narrow, and avoid exposing root to network clients.
Optional hardening with mysql_secure_installation
Ubuntu also supplies an interactive hardening utility:
sudo mysql_secure_installationOn Ubuntu Noble, the manpage describes package version mysql-server-core-8.0 8.0.46-0ubuntu0.24.04.4 and lists these possible actions:
- set a password for root accounts;
- remove root accounts accessible from outside the local host;
- remove anonymous users;
- remove the test database.
The exact prompts depend on the installed package and current server state. Read each question instead of accepting a tutorial’s answer blindly. Removing remote root rows is generally appropriate, but confirm that no legitimate administrative workflow depends on one. Removing anonymous users and the test database can also affect an intentionally configured development environment.
This utility is a hardening workflow, not a substitute for understanding the root account’s plugin. After it finishes, inspect mysql.user and test the connection method you intend to keep.
Troubleshooting common failures
Access denied from mysql -u root -p
The most common cause on Ubuntu is that root@localhost still uses auth_socket. Connect with:
sudo mysql -u rootThen run the inspection query and read the plugin value. If password login is required, alter the correct row with a supported password plugin and test again. If socket authentication is intentional, continue using the sudo command instead of trying to force a password login.
sudo mysql -u root also fails
Check that the MySQL service is running and that your operating-system account still has the required sudo rights. Confirm that the client is connecting to the intended local server rather than a different socket or instance. If the server is MariaDB, stop and verify its authentication configuration before applying MySQL syntax.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsALTER USER reports an unknown account
The host portion probably does not match. Query the account table first:
SELECT user, host, plugin FROM mysql.user WHERE user = 'root';Use the exact host value shown by the query in the ALTER USER statement. For example, 'root'@'localhost' and 'root'@'127.0.0.1' are distinct rows. Do not create an additional root row merely to avoid identifying the existing one.
The plugin name is rejected
Authentication plugin support is version-dependent. Check mysql --version, inspect the server’s installed plugins, and consult documentation for that release. Commands written for an older MySQL version may mention mysql_native_password even when a newer installation expects a different default or has different support. Do not guess a plugin name.
The password works locally but not from an application
Test the application’s exact network path, host name, TLS settings, and client-library version. MySQL account matching includes the connecting host, so an application connecting over TCP may not use the same account row as a local Unix-socket client. Check the account rows and grants, then create a dedicated application account rather than granting remote root access.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Remote root login is being considered
Do not expose root for routine application or remote service access. Remote root increases the impact of a stolen credential and complicates host-based account matching. Keep root local, restrict administrative access through the operating system, and create narrowly privileged accounts for remote clients. The Ubuntu hardening utility can remove root accounts accessible from outside the local host; review its prompt against your actual operational requirements.
Account-host matching in practice
Suppose the inspection query returns:
root localhost auth_socket
root 127.0.0.1 caching_sha2_passwordChanging 'root'@'localhost' affects only the first row. A client using a Unix socket may select localhost, while a client forced to TCP with 127.0.0.1 may select the second row. Conversely, changing the second row does not convert the socket-authenticated account. Always reproduce the client’s actual connection mode when testing.
Do not infer the selected row from the user name alone. The host, protocol, and server’s account-matching rules all matter. Query the table after each deliberate change and record which account is intended for local administration, automation, or an application.
Safe operating checklist
- Identify whether the server is Oracle MySQL or MariaDB.
- Record the installed MySQL version before choosing an authentication plugin.
- Open the local administrative session with
sudo mysql -u rootwhen Ubuntu’s socket authentication is in use. - Inspect
user,host, andpluginfor every root row. - Choose socket or password authentication based on the required client workflow.
- If using a password, generate a unique secret and keep it out of shell history and source code.
- Target the exact account host in
ALTER USER. - Test the precise socket or TCP connection mode used by the real client.
- Keep root local and create least-privilege application accounts.
- Review every prompt in
mysql_secure_installationinstead of applying answers mechanically. - Document how an administrator will recover access if operating-system
sudoor the root secret becomes unavailable.
What a successful change looks like
A password-authenticated setup has all of these properties: the intended root@host row shows a supported password plugin; mysql -u root -p prompts for and accepts the new secret; and the same client mode used by maintenance tooling succeeds without embedding the password in a command. A socket-authenticated setup instead keeps auth_socket visible in the row and succeeds through sudo mysql -u root.
If those observations do not agree, return to the account inspection query. The discrepancy is usually a host mismatch, an unchanged plugin, a different server instance, or a MariaDB/MySQL difference—not a need to repeatedly guess passwords.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
