Seeing ERROR 1698 (28000): Access denied for user 'root'@'localhost' when you try to log into MySQL on Ubuntu? You are not locked out — this is normal behavior on a fresh Ubuntu install of MySQL 8.x. On Ubuntu, the root MySQL account uses socket authentication (auth_socket) by default instead of a password, which means you can only log in as root through the system root account, not with a password.

This guide walks you through exactly why this happens and gives you three reliable fixes: log in the right way with sudo, create a dedicated admin user (recommended), or switch root to password authentication. If you have lost the root password entirely, there is also a safe-mode password reset. Follow the steps in order and you will have working root access in about five minutes.

Prerequisites

  • Ubuntu 22.04 or 24.04 server (these steps also apply to Debian 11/12)
  • MySQL 8.x or MariaDB 10.x/11.x already installed
  • A user account with sudo privileges
  • Terminal access (SSH or direct console)

Step 1: Understand why root is denied

First, check how your root account is configured. On Ubuntu, MySQL and MariaDB install root to authenticate via a Unix socket plugin — that means "you may only log in if you are the OS root user". Try logging in with a password and you get the famous error:

mysql -u root -p
ERROR 1698 (28000): Access denied for user 'root'@'localhost'

That error alone does not mean your password is wrong — it means MySQL is ignoring passwords entirely for root and demanding socket auth. Confirm it with the root OS account:

sudo mysql

This works because sudo runs the MySQL client as the system root user, and the auth_socket plugin matches the OS user to the MySQL user. Inside the client, inspect the root account's plugin:

SELECT user, host, plugin FROM mysql.user WHERE user = 'root';

The output shows which plugin guards root — on Ubuntu installs you will see auth_socket (MySQL) or unix_socket (MariaDB). Once you know this, the fix is a deliberate choice, not guesswork.

Step 2: Pick your fix strategy

There are three legitimate fixes. Pick one — do not mix and match in one session:

  • Option A — Create a dedicated admin user with a password (recommended). This is the best practice: tools like phpMyAdmin, WordPress, and remote admin tools connect with a username/password, and keeping root socket-only is actually a security feature. This is the right choice for most people.
  • Option B — Give root a password. Switch root from socket auth to password auth. Simple, but root-with-password is a larger attack surface — make the password strong.
  • Option C — Full password reset. Only needed if you changed something and are now locked out of everything (e.g. you broke root auth and have no other privileged user). This uses safe mode.

Options A and B take under two minutes. Do them first; only use Option C if you are truly locked out.

Step 3 (Option A): Create a dedicated admin user

Log in with socket auth, then create an administrator account that authenticates with a normal password:

sudo mysql

You are now inside the MySQL client as root. Run these statements one by one:

CREATE USER 'admin'@'localhost' IDENTIFIED BY 'ChangeMeToAStrongPassword123!';
GRANT ALL PRIVILEGES ON *.* TO 'admin'@'localhost' WITH GRANT OPTION;
FLUSH PRIVILEGES;
EXIT;

CREATE USER makes the account with password authentication; GRANT ALL PRIVILEGES ... WITH GRANT OPTION gives it full administrative power including the ability to create other users; FLUSH PRIVILEGES reloads the grant tables so the changes take effect immediately.

Test the new account right away — it should log in with its password:

mysql -u admin -p

If you connect without an error, Option A is done. Use admin for phpMyAdmin, application configs, and everyday admin work, and leave root socket-only.

Step 4 (Option B): Set a password on root

If you specifically want the root account itself to use a password, log in with socket auth and change its authentication plugin:

sudo mysql

Inside the client, run (for MySQL 8.x):

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'ChangeMeToAStrongPassword123!';
FLUSH PRIVILEGES;
EXIT;

ALTER USER ... IDENTIFIED WITH mysql_native_password BY ... replaces socket authentication with classic password authentication and stores the new password. (FLUSH PRIVILEGES is technically optional after ALTER USER since MySQL 5.7.6, but harmless.)

Test it:

mysql -u root -p

Enter your new password when prompted — you should land at the mysql> prompt. If you run MariaDB instead of MySQL, the equivalent statement is:

ALTER USER 'root'@'localhost' IDENTIFIED VIA mysql_native_password USING PASSWORD('ChangeMeToAStrongPassword123!');

MariaDB uses IDENTIFIED VIA ... USING PASSWORD(...) syntax because its grant system differs slightly from MySQL 8's.

Step 5 (Option C): Reset a lost root password with safe mode

Use this only if you are completely locked out — no working privileged account and no socket access. This briefly starts MySQL without any access checks, so do it quickly and never leave it running this way.

Stop the running MySQL service:

sudo systemctl stop mysql

Start MySQL in safe mode, skipping grant tables and disabling networking so nobody else can connect:

sudo mysqld_safe --skip-grant-tables --skip-networking &

--skip-grant-tables tells the server to skip all permission checks, and --skip-networking makes sure no TCP clients can reach it during the reset. Now connect with no password:

sudo mysql -u root

Inside the client, reload the grant tables (required, since we skipped them) and set the new password:

FLUSH PRIVILEGES;
ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'BrandNewStrongPassword456!';
EXIT;

Stop the safe-mode server. The clean way from inside a fresh client connection is the SHUTDOWN command:

sudo mysql -u root -p -e "SHUTDOWN;"

(You will be prompted for the new password you just set.) Then start the normal service again:

sudo systemctl start mysql

Verify you can log in with the new password:

mysql -u root -p -e "SELECT VERSION();"

If this returns the MySQL version, the reset worked and the server is running normally with full security back on.

Verify it worked

Run these three checks from the terminal to confirm your access is solid:

  1. Password login works: mysql -u root -p -e "SELECT USER(), CURRENT_USER();" — both should show root@localhost.
  2. The service is healthy: sudo systemctl status mysql should show active (running).
  3. Your admin tools work: if you use phpMyAdmin, log in with the account you set up — you should reach the dashboard with no access-denied error.

Common issues and fixes

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

This is the socket-auth issue this guide fixes. You tried a password login against a socket-only root. Use sudo mysql and apply Option A or B.

ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)

Unlike 1698, this one genuinely means the password is wrong — or a client is hashing the password for a different plugin than the server expects. If you set the password yourself and it fails, reset it with Option C. After switching plugins, some older clients need a reconnect — close the client completely and open a new one.

phpMyAdmin still says access denied after the fix

phpMyAdmin connects over TCP with a username and password, so it can never use socket auth. Either configure phpMyAdmin to use your new admin user (Option A), or switch root to password auth (Option B) and use the new password. Never share the root password with a web application if you can avoid it.

ERROR 2002 (HY000): Can't connect to local MySQL server through socket

This is a different failure — the server is not running at all. Check sudo systemctl status mysql, look at the error log with sudo journalctl -u mysql --no-pager | tail -30, and start the service with sudo systemctl start mysql.

MariaDB: root still asks for a password that never works

MariaDB's unix_socket plugin is the same concept with different syntax. Log in with sudo mariadb and run the MariaDB variant of the ALTER USER statement from Step 4. After that, normal password logins work.

Conclusion

On Ubuntu, "access denied for root" is almost never a real lockout — it is the auth_socket plugin doing its job. The five-minute fix: use sudo mysql to get in, then either create a dedicated admin user with a password (best practice) or switch root to password authentication. True password resets via safe mode are rare and should be done carefully.

Stuck on a database or server problem you cannot crack alone? XpertBees handles Linux server setup, MySQL hardening, and database troubleshooting for teams of every size — reach out and let us fix it for you.