🚨 MySQL Error Guide: 'Access denied for user root@localhost' — Fix ERROR 1698

Overview

ERROR 1698 looks identical to a wrong password but has a different cause — the account authenticates via the auth_socket (MySQL) / unix_socket (MariaDB) plugin, which ignores passwords entirely:

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

With socket authentication, MySQL checks that the operating-system user connecting over the local Unix socket matches the MySQL account name. So mysql -u root -p from a non-root shell fails no matter what password you type, because the plugin never consults a password at all. This is the default root setup on Debian/Ubuntu MySQL and MariaDB installs.

Symptoms

• mysql -u root -p rejects every password, including the one you just set.
• The same command works when run with sudo but not as a normal user.
• Setting or resetting the root password appears to succeed yet login still fails.
• Application accounts (with real passwords) connect fine, but root does not.
• Fresh Debian/Ubuntu install where root was never given a working password.

Common Root Causes

• auth_socket/unix_socket plugin on the account — authentication is by OS identity over the local socket, not by password.
• Connecting as the wrong OS user — the plugin requires the OS username to equal the MySQL username, so a non-root shell cannot log in as MySQL root.
• Assuming a password exists — the account may have no password authentication configured at all.
• TCP vs socket confusion — socket auth only applies to local localhost socket connections; forcing TCP changes the picture.
• A partially completed plugin switch — someone changed the plugin but not consistently, leaving login broken.

Diagnostic Workflow

Confirm which authentication plugin the account uses. Connect via sudo (which runs as the OS root the socket plugin expects):

sudo mysql -u root

SELECT user, host, plugin FROM mysql.user WHERE user = 'root';

If plugin is auth_socket (MySQL) or unix_socket (MariaDB), the account is socket-authenticated and passwords are irrelevant. Verify the OS user the socket sees:

whoami          # must equal the MySQL account name for socket auth to pass
id

Check whether you are being routed over the socket or TCP:

mysql -u root -p --protocol=SOCKET   # local socket (socket-auth applies)
mysql -u root -p --protocol=TCP -h 127.0.0.1   # forces TCP

Example Root Cause Analysis

After a fresh Ubuntu MySQL install, an engineer set a root password with ALTER USER and still could not log in:

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

Connecting with sudo mysql succeeded, and SELECT user, host, plugin FROM mysql.user showed root@localhost using auth_socket. The password they set was stored but never consulted, because the plugin authenticates by OS identity. From their normal (non-root) shell, whoami returned ubuntu, which does not match MySQL root, so the socket check failed. Two valid fixes existed: keep auth_socket and always administer via sudo mysql (most secure, no root password on disk), or, if a password login was genuinely required, switch the plugin deliberately: ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY '<strong-pw>';. They chose to keep socket auth for root and create a separate password-authenticated admin account for tooling.

Prevention Best Practices

• Understand that auth_socket/unix_socket is a security feature: it ties root to the OS root, so a stolen password alone cannot log in.
• Administer socket-authenticated accounts with sudo mysql rather than fighting the plugin.
• If password login is required, create a separate admin account with caching_sha2_password (or mysql_native_password for legacy drivers) instead of weakening root.
• Check the plugin column before assuming a password problem — 1698 and a wrong password look identical.
• Keep at least one working administrative path (socket via sudo) so a botched plugin change does not lock you out.
• Document each account’s authentication method so operators do not chase phantom password errors.

Quick Command Reference

sudo mysql -u root                                   -- log in via socket as OS root
whoami                                                -- OS user must match MySQL user

SELECT user, host, plugin FROM mysql.user WHERE user='root';   -- which plugin?
-- Switch to password auth deliberately (if truly needed):
ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY '<pw>';
FLUSH PRIVILEGES;

Conclusion

ERROR 1698 is not a wrong-password problem — it means the account uses auth_socket/unix_socket and authenticates by OS identity, so no password will ever work over the local socket. Connect with sudo mysql, confirm the plugin with SELECT ... plugin FROM mysql.user, and either keep socket auth (administering via sudo) or deliberately switch to a password plugin. Prefer a separate password-authenticated admin account over weakening root, and always keep one working login path so a plugin change never locks you out.