I tried MANY things: like:
use mysql;
update user SET PASSWORD=PASSWORD("password") WHERE USER='root';
flush privileges;
or
mysql_secure_installation
or
mysqladmin -u root -p password newpass
Then flush privileges, restart mysql
and root password is still BLANK: I can login to mysql with a simple
mysql
with no password
(and of course I cannot login to phpmyadmin)
Since Debian 9 the default authentication (when connecting via a unix socket/localhost) is done via the unix socket authentication plugin:
"The unix_socket authentication plugin works by calling the getsockopt system call with the SO_PEERCRED socket option, which allows it to retrieve the uid of the process that is connected to the socket. It is then able to get the user name associated with that uid. Once it has the user name, it will authenticate the connecting user as the MariaDB account that has the same user name."
So changing the password will of course not work, unless you disable the plugin. See also Authentication Plugin - Unix Socket