We have a few MariaDB servers (MariaDB 10.5, running on Debian 11/bullseye) where we need to change the passwords for the DB root user and for other user accounts in the DB system (by which I mean users in MariaDB itself, not Linux account passwords).
These DB servers were set up at varying times but are all at least a few years old, and the OS and DB packages have been upgraded in place since then.
I was uncertain of the correct way to update the DB root user password (it having been originally set via mysql_secure_installation
way back whenever when(!)), but after some researching, it now seems to turn out that, from MariaDB 10.4 onwards, MariaDB allows local root account access via unix_socket authentication.
In fact, it looks as though during one of the DB upgrades, the use of the previously set DB root password was dropped from our systems without us noticing (as we still had .my.cnf
files, we didn't realise)? (See output below)
MariaDB [(none)]> SHOW GRANTS FOR 'root'@'localhost';
+------------------------------------------------------------------------------------------------+
| Grants for root@localhost |
+------------------------------------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO `root`@`localhost` IDENTIFIED VIA unix_socket WITH GRANT OPTION |
| GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION |
+------------------------------------------------------------------------------------------------+
2 rows in set (0.000 sec)
MariaDB [(none)]> SHOW CREATE USER 'root'@'localhost';
+-----------------------------------------------------------+
| CREATE USER for root@localhost |
+-----------------------------------------------------------+
| CREATE USER `root`@`localhost` IDENTIFIED VIA unix_socket |
+-----------------------------------------------------------+
1 row in set (0.000 sec)
Is there anything else that I also need to check, regarding what the current root access permissions are?
Although it is a bit counter-intuitive compared to the old world, the MariaDB rationale for this change seems reasonable, and therefore I presume there is actually no real need for me to try to set a new DB root password any more (although we have changed the Linux root user password, for reasons related to those that are also prompting these changes).
Regarding changing passwords for other DB user accounts, I am not sure whether I should be using the SET PASSWORD or ALTER USER commands? Do they both do effectively the same thing (as far as just changing passwords is involved (ALTER USER can obviously do more))? Is there a reason to use one of these commands rather than the other?
Thanks for any advice.