Hi Antony,

here the links to the before mentioned pages:

Authentication from MariaDB 10.4 -> https://mariadb.com/kb/en/authentication-from-mariadb-104/ Authentication in MariaDB 10.4 — Understanding the Changes -> https://mariadb.org/authentication-in-mariadb-10-4/

Here what mysql.global_priv contains:

MariaDB [(none)]> select * from mysql.global_priv; +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+ | Host | User | Priv | +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+ | localhost | mariadb.sys | {"access":0,"plugin":"mysql_native_password","authentication_string":"","account_locked":true,"password_last_changed":0} | | localhost | root | {"access":<same_token_as_mysql>,"plugin":"mysql_native_password","authentication_string":"invalid","auth_or":[{},{"plugin":"unix_socket"}]} | | localhost | mysql | {"access":<same_token_as_root_>,"plugin":"mysql_native_password","authentication_string":"invalid","auth_or":[{},{"plugin":"unix_socket"}]} | +-----------+-------------+--------------------------------------------------------------------------------------------------------------------------------------------+ 3 rows in set (0.000 sec)

MariaDB [(none)]>

Both account create to use unix_socket and share the same password.

The security model for unix_socket is that for connections from the socket the db only checks if the context of the program, which is connecting to the database, is running in is owned by root. Thats from my understanding should make no difference when trying to connect to the database as mysql.

Best Alex

--- Best regards / Mit freundlichen Grüßen Alexander Nolting

----- Ursprüngliche Mail ----- Von: "Antony Stone" Antony.Stone@mariadb.open.source.it An: "maria-discuss" maria-discuss@lists.launchpad.net Gesendet: Montag, 11. Januar 2021 19:30:17 Betreff: Re: [Maria-discuss] Issue authenticating as mysql in 10.5 on Ubuntu 20.04

On Monday 11 January 2021 at 18:53:33, Alexander Nolting wrote:

I did a fresh 20.04 and MariaDB 10.5.8 install and now I'm having a question related to the new authentication concept starting from 10.4.

As stated at Authentication from MariaDB 10.4 and Authentication in MariaDB 10.4 — Understanding the Changes

Please can you provide a link to that documentation?

there are two administrative accounts created: root and mysql.

I don't use Ubuntu, but I do use Debian and Devuan, and on both of those I get a 'root' user but I do not get a 'mysql' user.

Logging as normal user as root into mariadb using unix_sockets is no problem

Doing the same with as mysql testusr@host:~$ sudo mariadb -u mysql

ERROR 1698 (28000): Access denied for user 'mysql'@'localhost'.

1. What do you get from:

sudo mariadb -u root -e "select unique User from user"

?

That will show you what username have been set up for you.

2. Note that in the first case "sudo ... -u root" you *are* the root user at the same time as you are trying to connect as the root user.

In the second case "sudo ... -u mysql" you are the root user but you are trying to connect as the mysql user - I think this may break the security model. Does "sudo -u mysql mariadb -u mysql" do anything different?

Antony.