MySQL Error 1698 — Password Not Rejected, Never Even Checked?
Diagnosing Error 1698: why auth_socket ignores passwords, leveraging sudo mysql, migrating to caching_sha2_password, and distinguishing from Error 1045.
Operational Verification & Reliability Metadata
The error string is a symptom, not the root cause. Do not restart the server blindly. Run the diagnostic queries below to pinpoint the actual failure mode.
▸Symptom
ERROR 1698 (28000): Access denied for user 'root'@'localhost'SQLSTATE code: 28000.
On Debian and Ubuntu platforms, this error is a rite of passage: You execute mysql -u root -p, enter the password, and receive ERROR 1698.
The issue is neither privilege revocation nor an incorrect password: It is driven entirely by the authentication plugin architecture.
root@localhost using the `auth_socket` plugin. This plugin ignores passwords entirely; instead, it matches the operating system effective user ID (UID) of the caller against the requested database account name.
If you are not executing the client as the OS root user (via sudo), MySQL rejects the connection immediately, regardless of what password string you supply.▸Distinguishing Error 1698 from Error 1045
- •Error 1045 (`Access denied ... Using password: YES`): The password was evaluated and rejected (H-03).
- •Error 1698: The password was never evaluated. Bypassing grant tables via
--skip-grant-tablesis completely unwarranted.
▸Diagnostic Step: Confirming `auth_socket`
Log in via elevated operating system credentials:
sudo mysqlInspect the plugin definition:
SELECT user, host, plugin FROM mysql.user WHERE user = 'root';If plugin is set to auth_socket, root is strictly bound to OS-level authentication.
▸Step-by-Step Resolution
Option 1: Migrate to Password Authentication (Local Dev Environments)
ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'StrongPassword123!';
FLUSH PRIVILEGES;mysql_native_password. It is deprecated in MySQL 8.0 and fully removed in MySQL 9.0. Standardize on `caching_sha2_password`.Option 2: Preserve auth_socket for Hardened Production Nodes
In production, leaving root governed by auth_socket provides excellent defense-in-depth: Root access requires local SSH and sudo privileges, eliminating remote password stuffing risks. Provision dedicated application accounts for DML traffic:
CREATE USER 'app_service'@'10.0.2.%' IDENTIFIED WITH caching_sha2_password BY 'AppSecurePassword!';
GRANT SELECT, INSERT, UPDATE, DELETE ON app.* TO 'app_service'@'10.0.2.%';▸Related Error Guides & Hub Links
- •MySQL Access Denied 1045 (H-03) — Password evaluation and grant failures
- •MySQL SELECT Command Denied 1142 (H-42) — Granular object access denial
- •MySQL Can't Connect Socket 2002 (H-40) — UNIX domain socket communication
- •MySQL Hub — Security standards and authentication engineering
Other Database Error Triage Playbooks
Other battle-tested diagnostic guides for high-severity database errors.
MySQL ERROR 1045 Access denied: root Password Reset Guide
Four causes of MySQL 1045, meaning of using password: YES/NO, and safe credential recovery via --init-file.
MySQL Deadlock ERROR 1213: Graph Analysis and Permanent Prevention
Root causes of MySQL 1213 deadlock, parsing LATEST DETECTED DEADLOCK output, gap lock concurrency issues, and resilient application retry design.
MySQL Lock wait timeout exceeded: Finding Blocking Sessions
Finding the blocking transaction using performance_schema, safe KILL decision matrices, and permanent locking reduction.