MySQL Secure Installation on RHEL 8 does not prompt for a root password because the default authentication plugin is
auth_socket, which validates users based on their operating system user account rather than a password. To resolve this, you must switch the root user’s authentication method to
mysql_native_password or
caching_sha2_password and explicitly set a strong password using the MySQL client command line. This ensures that remote connections and standard administrative workflows function as expected without relying solely on local OS-level access.
Understanding the Authentication Mechanism
When you install MySQL Server on Red Hat Enterprise Linux 8 via the
yum or
dnf package manager, the initialization process creates a root account that is configured to use the
auth_socket plugin by default. This plugin is designed for security; it allows the root user to connect from the localhost only if the OS username matches the MySQL username. Because of this design, the
mysql_secure_installation script skips the step where it would normally ask you to define a password. It assumes that if you have shell access to the server, you already have full control over the database.
This behavior is intentional to prevent weak passwords from being set during automated deployments, but it can be confusing for administrators who expect a traditional password-based login. If you attempt to connect remotely using the root account with a password, the connection will fail because the socket plugin ignores any password provided. You need to manually alter the authentication method to enable password-based logins for both local and remote access.
Switching Authentication Plugins
To fix the issue, you must first gain access to the MySQL monitor using your current OS privileges. Since you are logged in as root or a user with sudo privileges, you can execute the following command:
sudo mysql
Once inside the MySQL prompt, you need to identify the current authentication plugin for the root user. Run this query to check the configuration:
SELECT user, host, plugin FROM mysql.user WHERE user = 'root';
You will likely see
auth_socket listed in the
plugin column. To change this, you should update the root user to use
mysql_native_password or the newer
caching_sha2_password. The latter is recommended for MySQL 8.0 as it provides better performance and security. Execute the following command to set the password and change the plugin simultaneously:
ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'YourStrongPassword123!';
Replace
YourStrongPassword123! with a complex password that meets your organization's security policies. After running this command, flush the privileges to ensure the changes take effect immediately:
FLUSH PRIVILEGES;
Exit the MySQL monitor by typing
exit. You can now verify the change by attempting to log in with the new password:
mysql -u root -p
If you enter the password you just set and gain access, the issue is resolved. This approach directly addresses the lack of a prompt during installation by manually configuring the credentials after the fact.
Configuring Remote Access and Security
Changing the root password allows local password-based login, but it does not automatically enable remote connections. By default, the root user is restricted to connecting only from
localhost. If you need to manage the database from another machine, you must create a separate user or modify the root host permissions. Creating a dedicated admin user is generally safer than exposing the root account.
Create a new user with remote capabilities using this pattern:
CREATE USER 'admin'@'%' IDENTIFIED BY 'AnotherStrongPassword!';
GRANT ALL PRIVILEGES ON *.* TO 'admin'@'%' WITH GRANT OPTION;
FLUSH PRIVILEGES;
The
% wildcard allows connections from any IP address. However, this introduces significant security risks if not properly managed. Ensure that your firewall rules on RHEL 8 allow traffic on port 3306 only from trusted networks. You can manage these rules using
firewalld:
sudo firewall-cmd --permanent --add-port=3306/tcp
sudo firewall-cmd --reload
Additionally, consider disabling remote root login entirely. It is best practice to use non-root accounts for daily operations. You can lock down the root user to localhost only after verifying that your application uses a specific user account for database interactions. This limits the attack surface significantly. For more insights on securing your server environment, you might find
Securing an Ubuntu Server for Development Purposes useful, as many principles apply across Linux distributions.
Verifying the Setup
After making these changes, perform a comprehensive check to ensure everything is working correctly. First, test local connectivity with the new password. Then, test remote connectivity from a different machine using the client tool. Monitor the MySQL error log for any authentication failures:
sudo tail -f /var/log/mysqld.log
Look for entries related to
Access denied or
Plugin auth_socket. If you see repeated failures, verify that the correct plugin is assigned and that the password complexity meets the
validate_password policy requirements. You can adjust these policies if needed by modifying the
my.cnf configuration file under the
[mysqld] section.
For further context on how security updates impact database stability, reviewing
Long Homebrew MySQL @ 8.0 Gets Security Updates can provide additional perspective on maintaining secure database environments.
Frequently Asked Questions
Why didn't MySQL ask for a password during installation?
MySQL on RHEL 8 uses the
auth_socket plugin by default for the root user, which relies on OS-level authentication instead of a password. This design choice prioritizes security by preventing weak passwords and ensuring that only authorized system users can access the database locally.
Can I still use the root account for remote connections?
By default, the root account is restricted to
localhost connections only. While you can change the host field to allow remote access, it is strongly discouraged due to security risks. Instead, create a dedicated user with specific privileges for remote management tasks.
What happens if I forget the root password after changing it?
If you lose the password, you must reset it by stopping the MySQL service, starting it with the
--skip-grant-tables option, and then updating the user credentials directly. This method bypasses normal authentication checks but requires careful handling to avoid leaving the database in an insecure state.
Is auth_socket less secure than mysql_native_password?
auth_socket is considered more secure for local administration because it ties database access to the operating system user identity, eliminating the risk of password guessing or theft. However, it prevents remote connections and automation scripts that require password-based authentication from functioning seamlessly.
How do I check the current authentication plugin for all users?
You can view the authentication methods for all users by running
SELECT user, host, plugin FROM mysql.user; in the MySQL monitor. This query helps you identify users who might still be using older or less secure plugins that need to be updated.