MySQL: lost credentials

The scenario: a server you have not touched for six months, a MySQL whose root password nobody remembers and a client asking why their site no longer connects to the database. The root password is lost and there is no config file with it lying around.

The procedure

# 1. Stop MySQL
/etc/init.d/mysql stop

# 2. Start without grant tables
mysqld_safe --skip-grant-tables --skip-networking &

# 3. Connect without password
mysql -u root mysql

# 4. Change the root password
UPDATE user SET Password=PASSWORD('newpass') WHERE User='root';
FLUSH PRIVILEGES;
EXIT;

# 5. Kill mysqld_safe and restart cleanly
killall mysqld_safe mysqld
/etc/init.d/mysql start

The --skip-grant-tables flag disables ALL authentication: anyone can connect as anyone. The --skip-networking flag prevents external TCP connections during the recovery window (only the local socket works). Both together are the safe procedure.

Verification

mysql -u root -p'newpass' -e "SELECT User, Host FROM mysql.user;"

If it answers, root is recovered. The other users need checking (they were not touched by the procedure, only root was modified).

Root recovered

The procedure requires shell access to the server. If you do not have shell access, you do not have MySQL recovery, you have a reinstall. That is why the MySQL root password must be stored in a secrets manager, or at least in a root-only file (chmod 600) on the server itself.

The --skip-networking is essential: without it, the recovery window (where everyone is root without a password) is open to the network. The kernel will not tell you, MySQL will not tell you and the attacker scanning port 3306 during the 30-second recovery window has root.

[edit: 2026] The procedure has not changed since 2008. MariaDB copied it as-is. The column name Password became authentication_string in MySQL 5.7+, but the --skip-grant-tables principle remains the same and remains just as dangerous without --skip-networking.

[edit: 2026] The Ansible implementation of all this: the mariadb role .