MARIADB default users

Question

I just installed mariadb 10.6 and can't understand...

SELECT Host,User,Password FROM mysql.user;

1. mariadb.sys@localhost password is empty.
2. root@localhost password hashed.
3. mysql@localhost password has "invalid" value in cell.

SHOW CREATE USER 'mariadb.sys'@localhost\G;

CREATE USER `mariadb.sys`@`localhost` ACCOUNT LOCK PASSWORD EXPIRE

SHOW CREATE USER 'root'@localhost\G;

CREATE USER `root`@`localhost` IDENTIFIED
VIA mysql_native_password USING '***' OR unix_socket

SHOW CREATE USER 'mysql'@localhost\G;

CREATE USER `mysql`@`localhost` IDENTIFIED
VIA mysql_native_password USING 'invalid' OR unix_socket

1. What for default users are? root@localhost = for me, mariadb.sys@localhost = for mariadb.sys system, mysql@localhost = for mysql user and for linux system.
2. I used mysql_secure_installation command. Do i really need do anything else? Is everything OK with secure?
3. Can I delete mariadb.sys@localhost or mysql@localhost users?
4. Why do I need to setup password for mysql@localhost user?
5. "invalid" in password cell means not password, but mariadb "secure feature"?
6. ACCOUNT LOCK PASSWORD EXPIRE what is this?
7. As far as I understand I can't and I don't need to setup password for mariadb.sys@localhost?

Thank you!

Versions:

• Kernel: linux510 (Linux 5.10.56-1)
• Distro: Manjaro 21.1.0 (Arch Linux)
• MariaDB Version: MariaDB 10.6.4

Answer 1

• root@localhost - you, but its also helpful if this is there, unmodified (setting a password is ok - as you have done, but keep the OR unix_socket part for package updates
• mariadb.sys@localhost this is the owner of the mysql.users compatibility view, which is why its account is locked/password expired.
• mysql@localhost - I suspect this is some packaging decision to create this. It might be tied to logrotate or some monitoring system.

2. mysql_secure_installation - I can't tell if this changed anything from the default installation. Nothing else is needed.
3. No, don't delete these users. Understand why mysql@localhost exists, however its not usable by anything else, something needs to switch to the mysql unix user to be used.
4. you don't need to set a password for mysql@localhost.
5. invalid is a place holder of a hash that doesn't have a real password that maps to it. Its there so if a user desires, they can set a password on the account.
6. ACCOUNT LOCK is a locked account. PASSWORD EXPIRE is an expired password.
7. Changing mariadb.sys@localhost isn't needed. It is recommended you don't change this.