Querious Docs
Account

Common MySQL Connection Errors

Short explanations for the MySQL and MariaDB connection and login errors you are most likely to run into, and the usual ways to fix them. Each error has its own link target.

Can't connect to local MySQL server through socket (Error 2002) # 

ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)

Querious tried a local Unix-socket connection and found nothing at that socket file. The (2) is the system error "no such file or directory".

  • Server not running — start it (mysql.server start, brew services start mysql, or systemctl start mysql).
  • Wrong socket path — the server's socket is elsewhere. Run SHOW VARIABLES LIKE 'socket'; from any working client and put that path in Querious. Common locations: /tmp/mysql.sock, /var/run/mysqld/mysqld.sock (Debian/Ubuntu), /var/lib/mysql/mysql.sock (RHEL), /opt/homebrew/var/mysql/mysql.sock (Homebrew), /Applications/MAMP/tmp/mysql/mysql.sock (MAMP).
  • You want a network connection — switch the connection from Socket to TCP/IP with host 127.0.0.1 and port 3306.

Can't connect to MySQL server on host (Error 2003) # 

ERROR 2003 (HY000): Can't connect to MySQL server on 'db.example.com:3306' (61)

The TCP connection to that host and port could not be made. (61) / (111) means "connection refused" (nothing is listening); (60) / (110) means "timed out" (a firewall is dropping the packets).

  • Server not running, or on another port — verify the port and start the server.
  • Server only listens locally — set bind-address = 0.0.0.0 (and remove skip-networking) in the server config, then restart.
  • Firewall or cloud security group — a timeout almost always means port 3306 is blocked. Open it, or connect through an SSH tunnel.
  • Wrong host — typo, stale DNS, or the name points at the wrong machine.

Unknown MySQL server host (Error 2005) # 

ERROR 2005 (HY000): Unknown MySQL server host 'dbhost' (0)

The host name could not be resolved to an IP address. Nothing was contacted.

  • Typo in the host name.
  • You are not on the VPN that provides that internal name — connect to it, or use the IP address.
  • No DNS record exists — add an /etc/hosts entry or use the IP address.

Access denied for user (Error 1045) # 

ERROR 1045 (28000): Access denied for user 'appuser'@'10.0.0.5' (using password: YES)

The server was reached but rejected the credentials. using password: NO means no password was sent; YES means one was sent and did not match. MySQL accounts are tied to both a user name and the host you connect from.

  • Wrong password or user name, or the password field was left empty.
  • Account is for a different host — 'appuser'@'localhost' and 'appuser'@'%' are separate accounts. Connecting by TCP to 127.0.0.1 does not match localhost (that is the socket). Check SELECT user, host FROM mysql.user;.
  • A more specific host row shadows yours — a stale 'appuser'@'10.0.0.5' entry wins over 'appuser'@'%'.
  • Anonymous user — a default ''@'localhost' row can shadow your account; drop the anonymous users.
  • Password just changed — run FLUSH PRIVILEGES;.

Access denied for user to database (Error 1044) # 

ERROR 1044 (42000): Access denied for user 'appuser'@'%' to database 'reporting'

Login succeeded, but the user has no privileges on that schema (often the optional Database field in the connection settings).

  • Grant access: GRANT ALL ON reporting.* TO 'appuser'@'%'; (or something narrower).
  • Typo in the Database field, or the schema does not exist — clear the field or correct it.
  • On Linux servers, schema names are case-sensitive.

Host is not allowed to connect to this MySQL server (Error 1130) # 

ERROR 1130 (HY000): Host '203.0.113.9' is not allowed to connect to this MySQL server

The server refused the connection based purely on your IP address — no account has a host pattern that matches it. The password was never checked.

  • No account for that host — create one: CREATE USER 'appuser'@'203.0.113.%' IDENTIFIED BY '...'; then grant privileges.
  • skip-name-resolve is on while the account is defined with a host *name* — define it by IP instead.
  • Provider allowlist (RDS, managed MySQL) does not include your IP.

Access denied for user 'root'@'localhost' (Error 1698) # 

ERROR 1698 (28000): Access denied for user 'root'@'localhost'

The account uses the auth_socket plugin, which ignores passwords and requires your operating-system user name to match the MySQL user name. Common on fresh Debian/Ubuntu installs, where root works only as sudo mysql.

  • Switch the account to password login from a shell that can get in:
  • ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY 'newpass';
FLUSH PRIVILEGES;
  • Better: leave root alone and create a normal admin user that has a password.

Authentication plugin cannot be loaded / unknown to client (Error 2059, 1251) # 

ERROR 2059 (HY000): Authentication plugin 'caching_sha2_password' cannot be loaded
ERROR 1251 (08004): Client does not support authentication protocol requested by server
The server requested authentication method unknown to the client

The account uses an authentication plugin the client cannot complete. caching_sha2_password is the MySQL 8 default and will not send a password over an unencrypted connection.

  • Turn on SSL for the connection — that gives caching_sha2_password a secure channel and the error goes away. (Related message: Public Key Retrieval is not allowed.)
  • Switch the account to the classic plugin if you cannot use TLS: ALTER USER 'appuser'@'%' IDENTIFIED WITH mysql_native_password BY '...'; (deprecated in 8.0, removed in 9.x).
  • Update to a current Querious build, which ships a recent client library.

Lost connection to MySQL server (Error 2013) # 

ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet'
ERROR 2013 (HY000): Lost connection to MySQL server during query

The connection opened but was then dropped — during the handshake, or later while a query ran.

  • "reading initial communication packet" — the server closed the connection during the handshake: the host is blocked (see Error 1129), a firewall or bind-address is in the way, or the port is not MySQL.
  • Slow reverse-DNS on the server — set skip-name-resolve and define accounts by IP.
  • "during query" — a network blip, a firewall dropping idle connections, a result larger than max_allowed_packet, or the server being restarted.

MySQL server has gone away (Error 2006) # 

ERROR 2006 (HY000): MySQL server has gone away

The connection was open, but the server had already closed it by the time the client sent something.

  • Idle too long — the session passed wait_timeout / interactive_timeout. Raise them, or just reconnect.
  • Statement too large — a query or import bigger than max_allowed_packet. Raise it on the server and client.
  • Server restarted or the session was killed (admin action or the OOM killer).
  • A firewall or load balancer silently dropped an idle connection.

Too many connections (Error 1040) # 

ERROR 1040 (HY000): Too many connections

The server has reached max_connections. One extra slot is reserved for a user with CONNECTION_ADMIN / SUPER.

  • An application or pool is leaking connections — find the source; kill idle sessions with SHOW PROCESSLIST; then KILL <id>;.
  • Genuinely too few slots — SET GLOBAL max_connections = 500; now, and set it in my.cnf to persist.
  • Connect as an admin user (reserved slot) to get in and investigate.

Host is blocked because of many connection errors (Error 1129) # 

ERROR 1129 (HY000): Host 'host_name' is blocked because of many connection errors;
unblock with 'mysqladmin flush-hosts' or 'FLUSH HOSTS'

That client IP produced more than max_connect_errors failed or aborted handshakes in a row, so the server blacklisted it.

  • Clear the block: FLUSH HOSTS;, or mysqladmin flush-hosts, or TRUNCATE performance_schema.host_cache; (8.0.23+).
  • Fix the cause — a flaky network, a port scanner or health check hitting 3306, or a misconfigured client.
  • Raise max_connect_errors if the default is too sensitive.

Connections using insecure transport are prohibited (Error 3159) # 

ERROR 3159 (HY000): Connections using insecure transport are prohibited while --require_secure_transport=ON.

The server accepts only encrypted connections, and this one was not encrypted.

  • Turn on the SSL security option for the connection. (A Unix socket also counts as secure; an SSH tunnel on its own does not.)
  • If encryption is not actually wanted, set require_secure_transport = OFF on the server.

SSL connection error / Public Key Retrieval is not allowed # 

Public Key Retrieval is not allowed
SSL connection error: ...

A problem negotiating TLS, or the client refusing to fetch the server's key over an insecure link.

  • Public Key Retrieval is not allowed — a caching_sha2_password account used over a plaintext connection. Turn on SSL for the connection.
  • Handshake failures — the server requires SSL and the client is not configured for it, or the server certificate fails verification. Provide the server's CA certificate, or use a mode that does not verify it for a trusted internal host.
  • Wrong port — TLS to a non-MySQL service produces garbled handshake errors.

Unknown database (Error 1049) # 

ERROR 1049 (42000): Unknown database 'myapp'

The schema named for the connection (usually the Database field) does not exist on this server.

  • Typo, or wrong server.
  • On Linux, schema names are case-sensitive by default (MyApp is not myapp).
  • Leave the Database field blank to connect without selecting a schema.