I'm pulling my hair out trying to get basic username:password security working. I'm able to modify setting.js and get the login box to show up, but it does not accept my credentials. i was not able to install the admin tools, but I could use this tool to generate the hash:
but even when putting the hashed password into settings file and restarting NR, it will not take my credentials. I'm running NR in a docker container on a QNAP NAS. Any ideas would be appreciated.
As i continue to try everything I can think of, i've tried the default password scramble sample (which i believe is a scramble for the word password), which itself doesn't authenticate.
Definitely what you report is not a trivial issue (that sometimes pop up in the forum):
1- Editing the wrong settings.js file
2- mistake when copy / paste the lengthy hashed password to settings.js
3- Trying to login with the hashed password (60 bytes long)
The only thing that came to my mind you already tested: try the example password from the docs, which indeed match the word "password"
I will try to search in the old forum to see if I can find some clue.
Thank you!! I'm stumped and surely there is an explanation and way to resolve. Confident I'm editing the correct settings.js because I can comment out the password function and immediately remove the login prompt from the app. I've copied and pasted many many times to suspect that isn't the issue. I've also tried not only the node -e option to create one but several referenced online bcrypt generators and the fact that the example one doesn't work tells me its something more fundamental than the copy paste. I'm accessing the site by local IP. Can't think of anything that might in be in the equation to interfere, although this is hosted in a docker container on a QNAP NAS under container station. Just don't know if there isn't something screwy with installations and wherever the bcrypt code stuff comes from that could cause it to fail on the login (decrypt?).
Any help is appreciated. Love the app but really would like to secure it.
I'm not sure how to tell which version of node.js. is that part of the docker image? There IS a version of Node.js v8 8.9.4.0 that is installed as an app in the qnap's app center. The docker image installed for Node-red itself in the qnap's container station is v8.
.
also, as for an example hash returned, if I run this:
`node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" 7kA6H8rnGL9T
i get:
$2a$08$T8jtFOaq7VjPUHNQmKABXeXP/kVZ5Ntqermn6bk.nvEiZ6H3tddCm
which won't work. But again, just using the default value for password doesn't work either.
one other random thing. If I try to use node-red-admin path to get a hash, i can't install node-red-admin. i get a permissions error. I eventually abandoned trying to solve that having read that the node -e command could be run for the same purpose.
I spent a good deal of time trying to figure this one out but not being much of a linux guy and just recently getting into the docker thing (not to mention that this is running on QNAP in container station), i'm a bit stumped on how to go after that one. Adding sudo doesn't work. I'm sure there are path issues. (in the qnap scenario you SSH into QNAP and then navigate to the docker container using "docker exec -it [container name] /bin/bash" from there I can run the npm install of node-red-admin which clearly executes, downloads and attempts to install but this error: npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules
npm ERR! path /usr/local/lib/node_modules
npm ERR! code EACCES
npm ERR! errno -13
npm ERR! syscall access
npm ERR! Error: EACCES: permission denied, access '/usr/local/lib/node_modules'
npm ERR! { Error: EACCES: permission denied, access '/usr/local/lib/node_modules'
npm ERR! stack: 'Error: EACCES: permission denied, access '/usr/local/lib/node_modules'',
npm ERR! errno: -13,
npm ERR! code: 'EACCES',
npm ERR! syscall: 'access',
npm ERR! path: '/usr/local/lib/node_modules' }
npm ERR!
npm ERR! The operation was rejected by your operating system.
npm ERR! It is likely you do not have the permissions to access this file as the current user
npm ERR!
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator (though this is not recommended).
I'm going to guess the user you are running the command as doesn't actually have the root access required. But before we go there - Is the only reason you want node-red-admin to create the hash of the password ? - you can also do that using the command line below from within the node-red-install directory
that is the only reason. My real issue is that the hashed passwords don't work. In fact, even the default password in the sample file does not work. I can turn on and off the login prompt by commenting out the authentication section, which rules out working on the wrong settings file. I'm baffled.
its certainly one of the variables (and unfortunately not one easy to eliminate and rule out). Surely someone has proven this authentication model works with docker.
This thread is stale, but I have a potential solution for those using node red in a container.
When the container is started, if you create a volume, then the settings.js file will be stored in the docker volume directory.
for example /var/lib/docker/volumes/node_red_data/_data
Edit this settings file, rather than the one inside the container.
