I just installed mariadb 10.6 and can't understand...

SELECT Host,User,Password FROM mysql.user;
  1. mariadb.sys@localhost password is empty.
  2. root@localhost password hashed.
  3. mysql@localhost password has "invalid" value in cell.

SHOW CREATE USER 'mariadb.sys'@localhost\G;


SHOW CREATE USER 'root'@localhost\G;

CREATE USER `root`@`localhost` IDENTIFIED
VIA mysql_native_password USING '***' OR unix_socket

SHOW CREATE USER 'mysql'@localhost\G;

CREATE USER `mysql`@`localhost` IDENTIFIED
VIA mysql_native_password USING 'invalid' OR unix_socket
  1. What for default users are? root@localhost = for me, mariadb.sys@localhost = for mariadb.sys system, mysql@localhost = for mysql user and for linux system.
  2. I used mysql_secure_installation command. Do i really need do anything else? Is everything OK with secure?
  3. Can I delete mariadb.sys@localhost or mysql@localhost users?
  4. Why do I need to setup password for mysql@localhost user?
  5. "invalid" in password cell means not password, but mariadb "secure feature"?
  7. As far as I understand I can't and I don't need to setup password for mariadb.sys@localhost?

Thank you!


  • Kernel: linux510 (Linux 5.10.56-1)
  • Distro: Manjaro 21.1.0 (Arch Linux)
  • MariaDB Version: MariaDB 10.6.4

1 Answer 1

  • root@localhost - you, but its also helpful if this is there, unmodified (setting a password is ok - as you have done, but keep the OR unix_socket part for package updates
  • mariadb.sys@localhost this is the owner of the mysql.users compatibility view, which is why its account is locked/password expired.
  • mysql@localhost - I suspect this is some packaging decision to create this. It might be tied to logrotate or some monitoring system.
  1. mysql_secure_installation - I can't tell if this changed anything from the default installation. Nothing else is needed.
  2. No, don't delete these users. Understand why mysql@localhost exists, however its not usable by anything else, something needs to switch to the mysql unix user to be used.
  3. you don't need to set a password for mysql@localhost.
  4. invalid is a place holder of a hash that doesn't have a real password that maps to it. Its there so if a user desires, they can set a password on the account.
  5. ACCOUNT LOCK is a locked account. PASSWORD EXPIRE is an expired password.
  6. Changing mariadb.sys@localhost isn't needed. It is recommended you don't change this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.