<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="default-privileges">
      </a>
      2.9.4 Securing the Initial MySQL Account
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045326692464">
  </a>
  <a class="indexterm" name="idm46045326691008">
  </a>
  <a class="indexterm" name="idm46045326689520">
  </a>
  <a class="indexterm" name="idm46045326688448">
  </a>
  <a class="indexterm" name="idm46045326687376">
  </a>
  <a class="indexterm" name="idm46045326685888">
  </a>
  <a class="indexterm" name="idm46045326684816">
  </a>
  <a class="indexterm" name="idm46045326683328">
  </a>
  <a class="indexterm" name="idm46045326681840">
  </a>
  <a class="indexterm" name="idm46045326680352">
  </a>
  <a class="indexterm" name="idm46045326678864">
  </a>
  <a class="indexterm" name="idm46045326677376">
  </a>
  <a class="indexterm" name="idm46045326675888">
  </a>
  <a class="indexterm" name="idm46045326674400">
  </a>
  <a class="indexterm" name="idm46045326672912">
  </a>
  <a class="indexterm" name="idm46045326671424">
  </a>
  <a class="indexterm" name="idm46045326669936">
  </a>
  <a class="indexterm" name="idm46045326668448">
  </a>
  <a class="indexterm" name="idm46045326666960">
  </a>
  <a class="indexterm" name="idm46045326665472">
  </a>
  <p>
   The MySQL installation process involves initializing the data
      directory, including the grant tables in the
   <code class="literal">
    mysql
   </code>
   system schema that define MySQL accounts.
      For details, see
   <a class="xref" href="data-directory-initialization.html" title="2.9.1 Initializing the Data Directory">
    Section 2.9.1, “Initializing the Data Directory”
   </a>
   .
  </p>
  <p>
   This section describes how to assign a password to the initial
   <code class="literal">
    root
   </code>
   account created during the MySQL
      installation procedure, if you have not already done so.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    Alternative means for performing the process described in this
        section:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       On Windows, you can perform the process during installation
            with MySQL Configurator (see
       <a class="xref" href="mysql-configurator.html" title="2.3.2 Configuration: Using MySQL Configurator">
        Section 2.3.2, “Configuration: Using MySQL Configurator”
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       On all platforms, the MySQL distribution includes
       <a class="link" href="mysql-secure-installation.html" title="6.4.2 mysql_secure_installation — Improve MySQL Installation Security">
        <span class="command">
         <strong>
          mysql_secure_installation
         </strong>
        </span>
       </a>
       , a command-line
            utility that automates much of the process of securing a
            MySQL installation.
      </p>
     </li>
     <li class="listitem">
      <p>
       On all platforms, MySQL Workbench is available and offers the
            ability to manage user accounts (see
       <a class="xref" href="workbench.html" title="Chapter 33 MySQL Workbench">
        Chapter 33,
        <i>
         MySQL Workbench
        </i>
       </a>
       ).
      </p>
     </li>
    </ul>
   </div>
  </div>
  <p>
   A password may already be assigned to the initial account under
      these circumstances:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      On Windows, installations performed using the MSI installer
          and MySQL Configurator give you the option of assigning a password.
     </p>
    </li>
    <li class="listitem">
     <p>
      Installation using the macOS installer generates an initial
          random password, which the installer displays to the user in a
          dialog box.
     </p>
    </li>
    <li class="listitem">
     <p>
      Installation using RPM packages generates an initial random
          password, which is written to the server error log.
     </p>
    </li>
    <li class="listitem">
     <p>
      Installations using Debian packages give you the option of
          assigning a password.
     </p>
    </li>
    <li class="listitem">
     <p>
      For data directory initialization performed manually using
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld --initialize
        </strong>
       </span>
      </a>
      ,
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      generates an initial random
          password, marks it expired, and writes it to the server error
          log. See
      <a class="xref" href="data-directory-initialization.html" title="2.9.1 Initializing the Data Directory">
       Section 2.9.1, “Initializing the Data Directory”
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   The
   <code class="literal">
    mysql.user
   </code>
   grant table defines the initial
      MySQL user account and its access privileges. Installation of
      MySQL creates only a
   <code class="literal">
    'root'@'localhost'
   </code>
   superuser account that has all privileges and can do anything. If
      the
   <code class="literal">
    root
   </code>
   account has an empty password, your
      MySQL installation is unprotected: Anyone can connect to the MySQL
      server as
   <code class="literal">
    root
   </code>
   <span class="emphasis">
    <em>
     without a
      password
    </em>
   </span>
   and be granted all privileges.
  </p>
  <p>
   The
   <code class="literal">
    'root'@'localhost'
   </code>
   account also has a row
      in the
   <code class="literal">
    mysql.proxies_priv
   </code>
   table that enables
      granting the
   <a class="link" href="privileges-provided.html#priv_proxy">
    <code class="literal">
     PROXY
    </code>
   </a>
   privilege for
   <code class="literal">
    ''@''
   </code>
   , that is, for all users and all hosts.
      This enables
   <code class="literal">
    root
   </code>
   to set up proxy users, as
      well as to delegate to other accounts the authority to set up
      proxy users. See
   <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
    Section 8.2.19, “Proxy Users”
   </a>
   .
  </p>
  <p>
   To assign a password for the initial MySQL
   <code class="literal">
    root
   </code>
   account, use the following procedure. Replace
   <em class="replaceable">
    <code>
     root-password
    </code>
   </em>
   in the examples with the
      password that you want to use.
  </p>
  <p>
   Start the server if it is not running. For instructions, see
   <a class="xref" href="starting-server.html" title="2.9.2 Starting the Server">
    Section 2.9.2, “Starting the Server”
   </a>
   .
  </p>
  <p>
   The initial
   <code class="literal">
    root
   </code>
   account may or may not have a
      password. Choose whichever of the following procedures applies:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      If the
      <code class="literal">
       root
      </code>
      account exists with an initial
          random password that has been expired, connect to the server
          as
      <code class="literal">
       root
      </code>
      using that password, then choose a
          new password. This is the case if the data directory was
          initialized using
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld --initialize
        </strong>
       </span>
      </a>
      ,
          either manually or using an installer that does not give you
          the option of specifying a password during the install
          operation. Because the password exists, you must use it to
          connect to the server. But because the password is expired,
          you cannot use the account for any purpose other than to
          choose a new password, until you do choose one.
     </p>
     <div class="orderedlist">
      <ol class="orderedlist" type="1">
       <li class="listitem">
        <p>
         If you do not know the initial random password, look in
              the server error log.
        </p>
       </li>
       <li class="listitem">
        <p>
         Connect to the server as
         <code class="literal">
          root
         </code>
         using the
              password:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa74733933"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> root <span class="token property">-p</span>
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter the random root password here<span class="token punctuation">)</span></em><span class="token punctuation"></span></code></pre>
        </div>
       </li>
       <li class="listitem">
        <p>
         Choose a new password to replace the random password:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa76905037"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'root'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">root-password</em>'</span><span class="token punctuation">;</span></code></pre>
        </div>
       </li>
      </ol>
     </div>
    </li>
    <li class="listitem">
     <p>
      If the
      <code class="literal">
       root
      </code>
      account exists but has no
          password, connect to the server as
      <code class="literal">
       root
      </code>
      using no password, then assign a password. This is the case if
          you initialized the data directory using
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
          --initialize-insecure
        </strong>
       </span>
      </a>
      .
     </p>
     <div class="orderedlist">
      <ol class="orderedlist" type="1">
       <li class="listitem">
        <p>
         Connect to the server as
         <code class="literal">
          root
         </code>
         using no
              password:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa18688528"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> root <span class="token property">--skip-password</span></code></pre>
        </div>
       </li>
       <li class="listitem">
        <p>
         Assign a password:
        </p>
        <div class="copytoclipboard-wrapper">
         <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa62412339"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'root'</span>@<span class="token string">'localhost'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">root-password</em>'</span><span class="token punctuation">;</span></code></pre>
        </div>
       </li>
      </ol>
     </div>
    </li>
   </ul>
  </div>
  <p>
   After assigning the
   <code class="literal">
    root
   </code>
   account a password,
      you must supply that password whenever you connect to the server
      using the account. For example, to connect to the server using the
   <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
    <span class="command">
     <strong>
      mysql
     </strong>
    </span>
   </a>
   client, use this command:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa43093573"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> root <span class="token property">-p</span>
Enter password<span class="token punctuation">:</span> <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter root password here<span class="token punctuation">)</span></em><span class="token punctuation"></span></code></pre>
  </div>
  <p>
   To shut down the server with
   <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
    <span class="command">
     <strong>
      mysqladmin
     </strong>
    </span>
   </a>
   , use
      this command:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa33502945"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">$<span class="token operator">&gt;</span> mysqladmin <span class="token operator">-</span>u root <span class="token operator">-</span>p <span class="token keyword">shutdown</span>
Enter <span class="token keyword">password</span>: <span class="token punctuation"></span><em class="replaceable"><span class="token punctuation">(</span>enter root <span class="token keyword">password</span> here<span class="token punctuation">)</span></em><span class="token punctuation"></span></code></pre>
  </div>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    For additional information about setting passwords, see
    <a class="xref" href="assigning-passwords.html" title="8.2.14 Assigning Account Passwords">
     Section 8.2.14, “Assigning Account Passwords”
    </a>
    . If you forget your
    <code class="literal">
     root
    </code>
    password after setting it, see
    <a class="xref" href="resetting-permissions.html" title="B.3.3.2 How to Reset the Root Password">
     Section B.3.3.2, “How to Reset the Root Password”
    </a>
    .
   </p>
   <p>
    To set up additional accounts, see
    <a class="xref" href="creating-accounts.html" title="8.2.8 Adding Accounts, Assigning Privileges, and Dropping Accounts">
     Section 8.2.8, “Adding Accounts, Assigning Privileges, and Dropping Accounts”
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
