Access denied for user 'root'@'ip' (using password: YES)

[tstivers1990]

I've previously set up a mariadb container without issue and was able to connect to the root account remotely to set up users, databases, etc.

I'm setting a new server up and, for whatever reason, I'm unable to connect to the root account, getting the message in the title.

Here is the command I used to create the container:

docker create --name=mariadb \
-p 3306:3306 \
-e MYSQL_ROOT_PASSWORD=[password] \
-v /mnt/disks/data/mariadb:/var/lib/mysql \
--restart always \
mariadb:latest

I've tried wiping the /mnt/disks/data/mariadb directory and starting over. I still get the message.

Logs are showing nothing out of the ordinary.

[tstivers1990]

Changing the password fixed the issue. I'm guessing the issue had something to do with special characters in the password. Perhaps this should be added to the documentation on docker hub so others can deal with this issue if they encounter it. Here is the password that was causing issues (it's no longer in use so not a security concern): Y%257z6v9-qFvVG%db%wS76=$xjxey7?

[wglambert]

Did you use quotes around the password string?

$ docker run -d --name=mariadb -p 3306:3306 -e MYSQL_ROOT_PASSWORD="Y%257z6v9-qFvVG%db%wS76=$xjxey7?" mariadb:latest
7b4333a33c1b69db75c79b0a77b334e4d0574cbcf51e12044feac37861d9331a

$ docker exec -it mariadb mysql -u root -pY%257z6v9-qFvVG%db%wS76=$xjxey7?
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 10.3.8-MariaDB-1:10.3.8+maria~bionic mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

[tstivers1990]

I did. I still wasn't able to connect. I suspect it's to do with the $ character being used for environment variables. AFAIK surrounding it with quotes wouldn't fix this. My first impression from what you posted is that, if my hunch is correct, your second command would effectively be the same password because it would still parse the environment variable (which is blank) and replace what it thinks is an environment variable with a blank string. Try connecting from something like dbForge studio with that password, and I suspect it won't work.

[wglambert]

In the container

root@7b4333a33c1b:/# env | grep PASSWORD
MYSQL_ROOT_PASSWORD=Y%257z6v9-qFvVG%db%wS76=?

[tstivers1990]

In the container

root@7b4333a33c1b:/# env | grep PASSWORD
MYSQL_ROOT_PASSWORD=Y%257z6v9-qFvVG%db%wS76=?

Indeed. I'm sure there's a way to prevent this. Perhaps single quotes. But I suspect most won't know this and it would be valuable to document this on the docker hub page. Perhaps rewriting the docs so that they prevent this from happening by default.

[wglambert]

I had somewhat forgotten about this duplicate issue: #183 "entrypoint script does not escape password properly"

Which is waiting on docker-library/mysql#471 (comment)

We could add the other issues, but they could just as well be done after, and the templating should make future fixes easier to handle

[tianon]

Closing as duplicate of #183. 👍

[tianon]

Oh, this is partially #183, but also just the way that shell quoting works:

$ echo foo $bar baz
foo baz

$ echo "foo $bar baz"
foo  baz

$ echo 'foo $bar baz'
foo $bar baz

See also https://www.gnu.org/software/bash/manual/bashref.html#Single-Quotes vs https://www.gnu.org/software/bash/manual/bashref.html#Double-Quotes.