Can only execute mysqladmin as root account created with unix socket, all other accounts fail

Question

I have a new install of MariaDB 10.2.27 on RHEL7. Our security scans have flagged the root account, so we have modified the name to orgdba, assigning all of the applicable privileges. I have not encountered any issues, except with mysqladmin. I know I have my password correct as I can connect via mysql using it. It is only erroring on mysqladmin. I ended up creating a root account specifically to execute mysqladmin commands. I cannot execute with that account either. It is not until I create the root account using the Unix Socket plugin that I can successfully execute mysqladmin commands. I cannot find anything in any documentation that expands on this topic. I have no idea if this is a bug in the version of MariaDB that I am using. Does anyone have any insight?

Error connecting to mysqladmin:

root@db01 $ mysqladmin -uorgdba -p status
Enter password:
mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'orgdba'@'localhost' (using password: YES)'


root@db01 $ mysqladmin -u orgdba -p status
Enter password:
mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user 'orgdba'@'localhost' (using password: YES)'

Same user/same password, successfully connects to mysql:

root@db01 $ mysql -u orgdba -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 52347
Server version: 10.2.27-MariaDB-log MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

Any insight on this, or additional documentation on mysqladmin, would be appreciated.

Answer 1

I have finally figured this out. I have SSL enabled, which I may have not mentioned in my original post. When I added the --ssl-ca parameter to the connection string, I was able to connect.

mysqladmin -u orgdba --ssl-ca=/etc/mysql/ssl/ca-cert.pem -p status

now returns the status as expected.

Hopefully this helps someone out in the future.