Since MySQL 5.7, the root user is configured to use the
auth_socket authentication plugin instead of a password.
Is it safe to leave the root user that way (without a password)?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
MySQL socket authentication is a bit different from conventional authentication. Instead of requiring you to type in a password, it simply checks who you are on the system. From the MySQL developer docs:
As of MySQL 5.5.10, a server-side auth_socket authentication plugin is available that authenticates clients that connect from the local host through the Unix socket file. The plugin uses the SO_PEERCRED socket option to obtain information about the user running the client program.
The socket plugin checks whether the socket user name (the operating system user name) matches the MySQL user name specified by the client program to the server, and permits the connection only if the names match.
Suppose that a MySQL account is created for an operating system user named valerie who is to be authenticated by the auth_socket plugin for connections from the local host through the socket file:
CREATE USER 'valerie'@'localhost' IDENTIFIED WITH auth_socket;
If a user on the local host with a login name of stefanie invokes mysql with the option --user=valerie to connect through the socket file, the server uses auth_socket to authenticate the client. The plugin determines that the --user option value (valerie) differs from the client user's name (stephanie) and refuses the connection. If a user named valerie tries the same thing, the plugin finds that the user name and the MySQL user name are both valerie and permits the connection. However, the plugin refuses the connection even for valerie if the connection is made using a different protocol, such as TCP/IP.
To summarize, this protocol assumes that a user who is already logged in to the system should be allowed to log in to the database as that user (assuming that user exists in the database). So, it relies on you having secured the server such that users who are accessing the database should already be trusted.
It also doesn't affect your remote attack surface, as the socket authentication can only be used locally.
TL;DR: as usual, your database's root account will be only as secure as the root account on the system.