{"id":2324,"date":"2024-06-02T16:16:39","date_gmt":"2024-06-02T13:16:39","guid":{"rendered":"https:\/\/www.fibacloud.com\/community\/tutorials\/?p=2324"},"modified":"2026-09-20T21:55:54","modified_gmt":"2026-09-20T18:55:54","slug":"resetting-your-mysql-or-mariadb-root-password-on-ubuntu","status":"publish","type":"post","link":"https:\/\/www.fibacloud.com\/community\/tutorials\/en\/resetting-your-mysql-or-mariadb-root-password-on-ubuntu\/","title":{"rendered":"Reset MySQL 8.4 or MariaDB 10.11 Root Password on Ubuntu"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2324\" class=\"elementor elementor-2324\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d4a374d e-flex e-con-boxed e-con e-parent\" data-id=\"d4a374d\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2d6a2d3 elementor-widget elementor-widget-text-editor\" data-id=\"2d6a2d3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 08-05-2024 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>This guide separates Oracle MySQL 8.4 LTS from MariaDB 10.11 LTS. Both product families can use local socket authentication, so an operating-system administrator may already have database access without a database password. Try that route before stopping a service. The emergency MySQL procedure uses the official init-file method; the MariaDB emergency procedure is only for a password-based account whose socket access has been removed. [S1, S4]<\/p>\n<p><strong>Validation \u2014 20 September 2026:<\/strong> Recovery was exercised on Ubuntu 24.04 with MySQL 8.4.11 and MariaDB 10.11.14 in an isolated environment. Successful and failed resets, rejected old passwords, preserved application accounts\/data, disabled recovery TCP listeners, and return to normal daemon operation were checked. Boot, <code>systemctl<\/code> integration and enforcing AppArmor were not tested; validate those on a matching test server before production recovery.<\/p>\n<h2>Scope and preparation<\/h2>\n<p>The commands below target a single, package-managed server on Ubuntu 24.04 with the standard paths <code>\/var\/lib\/mysql<\/code>, <code>\/run\/mysqld\/mysqld.sock<\/code>, and <code>\/usr\/sbin\/mysqld<\/code> or <code>\/usr\/sbin\/mariadbd<\/code>. They do not upgrade a database. MySQL 8.4 is a separate product\/version choice; do not assume Ubuntu\u2019s default MySQL package is 8.4. Do not apply the commands unchanged to containers, managed databases, custom data directories, multiple instances, replication or Galera clusters.<\/p>\n<p>Before starting:<\/p>\n<ul>\n<li>Use an existing SSH account with sudo and keep a second administrator terminal or provider console available. Linux root and database root are different accounts.<\/li>\n<li>Schedule downtime for the application if emergency recovery is needed. Have a verified backup or application-consistent snapshot and its restore procedure.<\/li>\n<li>Confirm the server executable, version, service configuration and existing data directory. Never run <code>--initialize<\/code>, <code>mariadb-install-db<\/code>, delete a data directory, or install another database version as a password-reset step.<\/li>\n<li>Use a new, long, unique password from a password manager. Replace every password placeholder. The examples assume no literal single quote or backslash in the generated password; otherwise use the server\u2019s documented SQL escaping rules. Do not place a password after a shell <code>-p<\/code> argument, in screenshots, or in support tickets.<\/li>\n<li>MariaDB grant-bypass recovery is inappropriate while untrusted local users or workloads can reach the host. Use an isolated maintenance environment in that case. Disabling TCP alone does not protect a local Unix socket.<\/li>\n<\/ul>\n<p>Check only the product that is installed:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aa47790 elementor-widget elementor-widget-text-editor\" data-id=\"aa47790\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\"># Oracle MySQL\nmysqld --version\nsudo systemctl cat mysql\n\n# MariaDB\nmariadbd --version\nsudo systemctl cat mariadb<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-75c1617 elementor-widget elementor-widget-text-editor\" data-id=\"75c1617\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The service must use the same default configuration and existing data directory as the manual recovery process below. If its ExecStart has a custom defaults file or other instance-specific settings, stop and adapt the procedure with your administrator. MySQL\u2019s systemd packages need not include mysqld_safe; this guide starts the server executable directly. [S2]<\/p>\n\n<figure class=\"fc-editorial-figure\" data-fc-visual=\"20260920\" aria-labelledby=\"fc-editorial-caption-2324\"><a href=\"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-inline-20260920.webp\" target=\"_blank\" rel=\"noopener\" aria-label=\"Open full-size illustration\"><picture><source media=\"(max-width: 600px)\" srcset=\"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-mobile-20260920.webp\" width=\"720\" height=\"1140\"><img loading=\"lazy\" src=\"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-inline-20260920.webp\" srcset=\"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-inline-20260920.webp 1440w, https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-inline-20260920-300x242.webp 300w, https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-inline-20260920-1024x825.webp 1024w, https:\/\/www.fibacloud.com\/community\/tutorials\/wp-content\/uploads\/community-editorial-20260920\/fc-recovery-en-inline-20260920-768x619.webp 768w\" sizes=\"auto, (max-width: 900px) 100vw, 820px\" width=\"1440\" height=\"1160\" alt=\"The access recovery decision path\" class=\"wp-image-2530\"  decoding=\"async\"><\/picture><\/a><figcaption id=\"fc-editorial-caption-2324\"><strong>The access recovery decision path<\/strong> Try existing authorized access first. Emergency recovery requires a backup and maintenance window; restoration of normal authentication is part of completion.<details><summary>Step-by-step explanation<\/summary><ol><li>Check: Try existing authorized access.<\/li><li>Prepare: Back up and plan a maintenance window.<\/li><li>Recover: Follow the procedure for your product\/version.<\/li><li>Verify: Restore normal authentication.<\/li><\/ol><\/details><\/figcaption><\/figure>\n<h2>1. Try existing local administrative access<\/h2>\n<p>For MySQL:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-711a9d0 elementor-widget elementor-widget-text-editor\" data-id=\"711a9d0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo env MYSQL_HISTFILE=\/dev\/null mysql --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7a596be elementor-widget elementor-widget-text-editor\" data-id=\"7a596be\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>For MariaDB:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a87d3b7 elementor-widget elementor-widget-text-editor\" data-id=\"a87d3b7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo env MYSQL_HISTFILE=\/dev\/null mariadb --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b0cef6 elementor-widget elementor-widget-text-editor\" data-id=\"3b0cef6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>If the connection works, inspect the account locally. SHOW CREATE USER can include password hashes; keep its output private.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a9e647d elementor-widget elementor-widget-text-editor\" data-id=\"a9e647d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SELECT VERSION(), CURRENT_USER();\nSHOW CREATE USER 'root'@'localhost';<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-048e760 elementor-widget elementor-widget-text-editor\" data-id=\"048e760\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Confirm <code>CURRENT_USER()<\/code> is <code>root@localhost<\/code>; do not modify a different account by guesswork.<\/p>\n<ul>\n<li><strong>MySQL auth_socket:<\/strong> successful sudo access is the intended authentication method. There may be no database password to recover. Keep socket authentication unless a deliberate account-policy change is required; that change is outside this recovery procedure.<\/li>\n<li><strong>MySQL password plugin and an already authorized session:<\/strong> use <code>ALTER USER<\/code> below, then verify the new password in a separate terminal. No emergency restart is required.<\/li>\n<li><strong>MariaDB unix_socket only:<\/strong> keep using sudo; setting a password for a socket-only account is not a password reset and may be rejected\/ignored.<\/li>\n<li><strong>MariaDB unix_socket OR mysql_native_password:<\/strong> the following SET PASSWORD enables or changes the password-based alternative while preserving socket access. This is the usual modern installation pattern, but confirm the account definition. [S4, S5]<\/li>\n<\/ul>\n<p>MySQL only:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1b2ede7 elementor-widget elementor-widget-text-editor\" data-id=\"1b2ede7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">ALTER USER 'root'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_LONG_UNIQUE_PASSWORD';<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-21d8af6 elementor-widget elementor-widget-text-editor\" data-id=\"21d8af6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>MariaDB only, when the account has a password-capable authentication method:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-11e268d elementor-widget elementor-widget-text-editor\" data-id=\"11e268d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SET PASSWORD FOR 'root'@'localhost' = PASSWORD('REPLACE_WITH_A_LONG_UNIQUE_PASSWORD');<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d6b3df1 elementor-widget elementor-widget-text-editor\" data-id=\"d6b3df1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><code>PASSWORD()<\/code> is valid in this MariaDB statement; it was removed from MySQL 8.0. Never copy this MariaDB statement into MySQL. Neither product requires a direct UPDATE of mysql.user. [S3, S5]<\/p>\n<p>If no authorized database session is available, choose exactly one emergency branch below.<\/p>\n<h2>2. MySQL 8.4: recover with an init file<\/h2>\n<p>This method executes one account-management statement at startup while normal grant checks remain enabled. Network listeners are disabled during this maintenance start. It is preferable to disabling grant checks. [S1]<\/p>\n<p>Stop the normal service. <code>is-active<\/code> should print <code>inactive<\/code>; it normally returns a nonzero status in that state. <code>pgrep<\/code> must not find another mysqld process in this single-instance scope. Do not start a second server on the same data directory.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-097cdbb elementor-widget elementor-widget-text-editor\" data-id=\"097cdbb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo systemctl stop mysql\nsudo systemctl is-active mysql\npgrep -a -x mysqld<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-22c41e8 elementor-widget elementor-widget-text-editor\" data-id=\"22c41e8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Prepare a restricted file readable by the mysql OS user. The shell uses noclobber and creates the file with mode 600; if that filename already exists, creation fails and the editor does not open. Stop and investigate instead of overwriting it. The mysql-files directory is the intended candidate path for the Ubuntu package; confirm the installed AppArmor policy permits reading it. Do not disable AppArmor to make recovery work.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d357351 elementor-widget elementor-widget-text-editor\" data-id=\"d357351\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo install -d -o mysql -g mysql -m 750 \/var\/lib\/mysql-files\nsudo -u mysql sh -c 'set -C; umask 077; : &gt; \/var\/lib\/mysql-files\/fc-root-reset.sql' &amp;&amp; sudoedit \/var\/lib\/mysql-files\/fc-root-reset.sql<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54d16d7 elementor-widget elementor-widget-text-editor\" data-id=\"54d16d7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Put only this statement in the file, with your new password. It targets the exact account, including its host part. Do not change the authentication plugin to mysql_native_password as a workaround.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a8d851d elementor-widget elementor-widget-text-editor\" data-id=\"a8d851d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">ALTER USER 'root'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_LONG_UNIQUE_PASSWORD';<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0f1e80 elementor-widget elementor-widget-text-editor\" data-id=\"f0f1e80\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In terminal A, start the same existing database in the foreground. Keep this terminal open. The executable reads its normal option files; the explicit options below restrict this maintenance start. If startup exits or logs an error, use the recovery\/cleanup section instead of starting another process.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2a94c8e elementor-widget elementor-widget-text-editor\" data-id=\"2a94c8e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo install -d -o mysql -g mysql -m 755 \/run\/mysqld\nsudo \/usr\/sbin\/mysqld --user=mysql --datadir=\/var\/lib\/mysql --socket=\/run\/mysqld\/mysqld.sock --pid-file=\/run\/mysqld\/mysqld.pid --init-file=\/var\/lib\/mysql-files\/fc-root-reset.sql --skip-networking --mysqlx=OFF<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-52b9bfe elementor-widget elementor-widget-text-editor\" data-id=\"52b9bfe\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In terminal B, use the new password at the prompt. A server reaching \u201cready\u201d does not prove the init statement succeeded: a weak password or incorrect account can make ALTER USER fail. Successful authentication with the new password is mandatory.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2f50134 elementor-widget elementor-widget-text-editor\" data-id=\"2f50134\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">env MYSQL_HISTFILE=\/dev\/null mysql --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root --password<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-099cfa7 elementor-widget elementor-widget-text-editor\" data-id=\"099cfa7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Confirm the account, version and disabled TCP networking:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-338cff6 elementor-widget elementor-widget-text-editor\" data-id=\"338cff6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SELECT CURRENT_USER(), VERSION(), @@skip_networking;<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cdb01eb elementor-widget elementor-widget-text-editor\" data-id=\"cdb01eb\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Expect root@localhost, MySQL 8.4, and skip_networking = 1. Also inspect <code>sudo ss -ltnp<\/code>: this recovery database process must not own a TCP listener, including an administrative or X Plugin listener. If it does, shut it down and resolve the configuration before continuing. In terminal B, leave the SQL client with <code>exit<\/code>; the server stays running. Delete the plaintext init file from the shell as soon as the new password has been verified, then shut down the recovery server using the new password. This shutdown, unlike exiting the client, stops the server process.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1bd6d73 elementor-widget elementor-widget-text-editor\" data-id=\"1bd6d73\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo rm -- \/var\/lib\/mysql-files\/fc-root-reset.sql\nmysqladmin --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root --password shutdown<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e8e9b6e elementor-widget elementor-widget-text-editor\" data-id=\"e8e9b6e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Terminal A must return. Confirm no recovery process remains before starting the ordinary service:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f7dff9f elementor-widget elementor-widget-text-editor\" data-id=\"f7dff9f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">pgrep -a -x mysqld\nsudo systemctl start mysql\nsudo systemctl is-active mysql<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ec840c8 elementor-widget elementor-widget-text-editor\" data-id=\"ec840c8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h2>3. MariaDB 10.11: emergency recovery only when socket access is unavailable<\/h2>\n<p>Use section 1 if sudo\/socket access works. The following branch assumes root@localhost uses a password-capable method and no authorized session remains. It temporarily disables account checks and therefore requires exclusive trusted local maintenance access. [S4]<\/p>\n<p>Stop the service and confirm no old server remains. Then start the existing database in terminal A, without TCP networking:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-406c422 elementor-widget elementor-widget-text-editor\" data-id=\"406c422\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo systemctl stop mariadb\nsudo systemctl is-active mariadb\npgrep -a -x mariadbd\npgrep -a -x mysqld\nsudo install -d -o mysql -g mysql -m 755 \/run\/mysqld\nsudo \/usr\/sbin\/mariadbd --user=mysql --datadir=\/var\/lib\/mysql --socket=\/run\/mysqld\/mysqld.sock --pid-file=\/run\/mysqld\/mysqld.pid --skip-grant-tables --skip-networking<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cf8571d elementor-widget elementor-widget-text-editor\" data-id=\"cf8571d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Keep terminal A open. Connect from terminal B without a database password:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9535ed0 elementor-widget elementor-widget-text-editor\" data-id=\"9535ed0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">sudo env MYSQL_HISTFILE=\/dev\/null mariadb --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-60e57ed elementor-widget elementor-widget-text-editor\" data-id=\"60e57ed\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Check the server and exact root account. The expected version starts with 10.11 and skip_networking is 1. Inspect <code>sudo ss -ltnp<\/code> and confirm that this recovery database process owns no TCP listener; stop recovery if one remains. Then reload grants <strong>before<\/strong> SET PASSWORD. That ordering is required for this MariaDB recovery path; the older \u201cFLUSH at the very end\u201d recipe does not apply. [S4]<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b009c9 elementor-widget elementor-widget-text-editor\" data-id=\"8b009c9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SELECT VERSION(), @@skip_networking;\nSELECT User, Host FROM mysql.user WHERE User = 'root';\nFLUSH PRIVILEGES;\nSHOW CREATE USER 'root'@'localhost';<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-918dfd8 elementor-widget elementor-widget-text-editor\" data-id=\"918dfd8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Confirm the existing password-capable authentication method; do not remove or replace any existing socket method. For the scoped mysql_native_password account, run:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-383e9ed elementor-widget elementor-widget-text-editor\" data-id=\"383e9ed\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SET PASSWORD FOR 'root'@'localhost' = PASSWORD('REPLACE_WITH_A_LONG_UNIQUE_PASSWORD');<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fafc33a elementor-widget elementor-widget-text-editor\" data-id=\"fafc33a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>If SET PASSWORD is rejected because the account is socket-only or uses an external\/custom plugin, stop; do not update mysql.user or mysql.global_priv directly. Follow that plugin\u2019s administration procedure.<\/p>\n<p>Shut down the recovery server from the still-authorized SQL session. Do not merely EXIT and then start systemd:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d8b6336 elementor-widget elementor-widget-text-editor\" data-id=\"d8b6336\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SHUTDOWN;<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9d3e6f7 elementor-widget elementor-widget-text-editor\" data-id=\"9d3e6f7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>When terminal A returns and no recovery process remains, restart normally:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e77b89c elementor-widget elementor-widget-text-editor\" data-id=\"e77b89c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\">pgrep -a -x mariadbd\npgrep -a -x mysqld\nsudo systemctl start mariadb\nsudo systemctl is-active mariadb<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bb870c1 elementor-widget elementor-widget-text-editor\" data-id=\"bb870c1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<h2>4. Verify normal operation<\/h2>\n<p>For the password-capable account, connect from a non-root OS account and enter the new password at the prompt. This matters for MariaDB dual authentication: a sudo connection can succeed through unix_socket even when the password is wrong. Test the old password separately and expect rejection. Socket-only accounts should instead retain their documented sudo access; do not invent a password check for them.<\/p>\n<p>Use the client for the installed product:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-033874c elementor-widget elementor-widget-text-editor\" data-id=\"033874c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-bash\"># Oracle MySQL\nenv MYSQL_HISTFILE=\/dev\/null mysql --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root --password\n\n# MariaDB\nenv MYSQL_HISTFILE=\/dev\/null mariadb --no-defaults --protocol=socket --socket=\/run\/mysqld\/mysqld.sock --user=root --password<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78aed99 elementor-widget elementor-widget-text-editor\" data-id=\"78aed99\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Check recovery options and compare networking with its documented pre-maintenance configuration. A deliberately socket-only deployment may normally keep skip_networking ON; do not enable TCP just to match an example.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4645366 elementor-widget elementor-widget-text-editor\" data-id=\"4645366\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<pre><code class=\"language-sql\">SELECT CURRENT_USER(), VERSION();\nSHOW VARIABLES WHERE Variable_name IN ('skip_grant_tables', 'skip_networking', 'init_file');<\/code><\/pre>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6fce316 elementor-widget elementor-widget-text-editor\" data-id=\"6fce316\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul>\n<li>Grant bypass must be off. On the MySQL init-file branch, init_file must be empty and the recovery SQL file absent.<\/li>\n<li>The application must connect with its own existing database account; verify one harmless read and its usual health check. Its data and privileges must be unchanged. Do not switch application credentials to root.<\/li>\n<li>If MariaDB originally had socket authentication, verify sudo access and the authentication definition are preserved.<\/li>\n<li>Perform a controlled service restart during the maintenance window and repeat the authentication and application checks.<\/li>\n<\/ul>\n<h2>If a step fails<\/h2>\n<p>Keep application traffic paused. Inspect the local server error log; do not post passwords, hashes or the init file. If a recovery process is still running and normal authenticated shutdown is unavailable, identify the exact recovery PID from the configured pid file, verify its command and owner, and send that process SIGTERM. Do not use broad pkill commands or SIGKILL. Wait for it to stop before starting the original service.<\/p>\n<p>For MySQL, remove the temporary init file even when its ALTER USER failed, and start without any recovery options. The old password may still be in force when ALTER USER failed; verify instead of assuming a reset happened. For MariaDB, stop the bypass process and restart with ordinary configuration even when SET PASSWORD failed. Never leave an unprotected recovery process running. Do not restore a whole data directory casually; use the previously verified recovery plan if data recovery is required.<\/p>\n<h2>Official references<\/h2>\n<ul>\n<li>[S1] <a href=\"https:\/\/dev.mysql.com\/doc\/refman\/8.4\/en\/resetting-permissions.html\" rel=\"nofollow noopener\" target=\"_blank\">MySQL 8.4 \u2014 Resetting the Root Password<\/a><\/li>\n<li>[S2] <a href=\"https:\/\/dev.mysql.com\/doc\/refman\/8.4\/en\/using-systemd.html\" rel=\"nofollow noopener\" target=\"_blank\">MySQL 8.4 \u2014 Managing MySQL Server with systemd<\/a><\/li>\n<li>[S3] <a href=\"https:\/\/dev.mysql.com\/doc\/refman\/8.0\/en\/mysql-nutshell.html\" rel=\"nofollow noopener\" target=\"_blank\">MySQL 8.0 \u2014 Removed Features: PASSWORD()<\/a><\/li>\n<li>[S4] <a href=\"https:\/\/mariadb.com\/docs\/server\/security\/user-account-management\/authentication-from-mariadb-10-4\" rel=\"nofollow noopener\" target=\"_blank\">MariaDB \u2014 Authentication from MariaDB 10.4<\/a><\/li>\n<li>[S5] <a href=\"https:\/\/mariadb.com\/docs\/server\/reference\/sql-statements\/account-management-sql-statements\/set-password\" rel=\"nofollow noopener\" target=\"_blank\">MariaDB \u2014 SET PASSWORD<\/a><\/li>\n<li>[S6] <a href=\"https:\/\/mariadb.org\/about\/#maintenance-policy\" rel=\"nofollow noopener\" target=\"_blank\">MariaDB Foundation \u2014 Maintenance policy<\/a><\/li>\n<li>[S7] <a href=\"https:\/\/mariadb.com\/docs\/server\/server-management\/starting-and-stopping-mariadb\/mariadbd-options\" rel=\"nofollow noopener\" target=\"_blank\">MariaDB \u2014 mariadbd options<\/a><\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Separate MySQL 8.4 and MariaDB 10.11 recovery procedures with socket access, restricted recovery files, shutdown and authentication checks.<\/p>\n","protected":false},"author":1,"featured_media":2529,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-2324","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials-en"],"lang":"en","translations":{"en":2324,"tr":1626},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/posts\/2324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/comments?post=2324"}],"version-history":[{"count":7,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/posts\/2324\/revisions"}],"predecessor-version":[{"id":2331,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/posts\/2324\/revisions\/2331"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/media\/2529"}],"wp:attachment":[{"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/media?parent=2324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/categories?post=2324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fibacloud.com\/community\/tutorials\/wp-json\/wp\/v2\/tags?post=2324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}