# Authentication Help Needed

**URL:** <https://discourse.nodered.org/t/authentication-help-needed/7492>\
**Category:** General\
**Created:** [1 February 2019 17:49 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492 "2019-02-01T17:49:56Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [1 February 2019 17:49 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/1 "2019-02-01T17:49:56Z")

</div>

I'm pulling my hair out trying to get basic username:password security working. I'm able to modify setting.js and get the login box to show up, but it does not accept my credentials. i was not able to install the admin tools, but I could use this tool to generate the hash:

`node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" your-password-here`

but even when putting the hashed password into settings file and restarting NR, it will not take my credentials. I'm running NR in a docker container on a QNAP NAS. Any ideas would be appreciated.

Thanks  
Mike

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [4 February 2019 12:31 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/2 "2019-02-04T12:31:29Z")

</div>

As i continue to try everything I can think of, i've tried the default password scramble sample (which i believe is a scramble for the word password), which itself doesn't authenticate.

---

<div class="post-metadata">

**Author:** ![Andrei](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/andrei/32/10446_2.png) [@Andrei](https://discourse.nodered.org/u/Andrei)\
**Post date:** [4 February 2019 23:19 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/3 "2019-02-04T23:19:47Z")

</div>

Definitely what you report is not a trivial issue (that sometimes pop up in the forum):

1- Editing the wrong settings.js file ❌  
2- mistake when copy / paste the lengthy hashed password to settings.js ❌  
3- Trying to login with the hashed password (60 bytes long) ❌

The only thing that came to my mind you already tested: try the example password from the docs, which indeed match the word "password"

I will try to search in the old forum to see if I can find some clue.

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [5 February 2019 01:03 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/4 "2019-02-05T01:03:51Z")

</div>

Thank you!! I'm stumped and surely there is an explanation and way to resolve. Confident I'm editing the correct settings.js because I can comment out the password function and immediately remove the login prompt from the app. I've copied and pasted many many times to suspect that isn't the issue. I've also tried not only the node -e option to create one but several referenced online bcrypt generators and the fact that the example one doesn't work tells me its something more fundamental than the copy paste. I'm accessing the site by local IP. Can't think of anything that might in be in the equation to interfere, although this is hosted in a docker container on a QNAP NAS under container station. Just don't know if there isn't something screwy with installations and wherever the bcrypt code stuff comes from that could cause it to fail on the login (decrypt?).

Any help is appreciated. Love the app but really would like to secure it.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [5 February 2019 07:14 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/5 "2019-02-05T07:14:28Z")

</div>

Could you post the startup log from node red please, up to the point it fails to authorise.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [5 February 2019 08:42 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/6 "2019-02-05T08:42:56Z")

</div>

Hi @mikerenna

This is one of those things that should Just Work. @Andrei has already listed the common pitfalls - none of which appears to apply here.

could you provide an example of the hash running that node command on your QNAP gives you? (Along with what word you hashed with it...)

What version of node.js are you running?

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [6 February 2019 12:22 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/7 "2019-02-06T12:22:22Z")

</div>

I'm not sure how to tell which version of node.js. is that part of the docker image? There IS a version of Node.js v8 8.9.4.0 that is installed as an app in the qnap's app center. The docker image installed for Node-red itself in the qnap's container station is v8.  
.

---

<div class="post-metadata">

**Author:** ![ukmoose](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ukmoose/32/13_2.png) [@ukmoose](https://discourse.nodered.org/u/ukmoose)\
**Post date:** [6 February 2019 12:24 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/8 "2019-02-06T12:24:24Z")

</div>

When you start node-red the version of nodejs is listed in the startup log

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [6 February 2019 12:25 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/9 "2019-02-06T12:25:24Z")

</div>

aha. 8.15.0

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [6 February 2019 12:27 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/10 "2019-02-06T12:27:21Z")

</div>

also  
Node-RED version v0.19.5  
Linux 4.2.8 x64 LE  
npm 6.4.1

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [6 February 2019 12:30 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/11 "2019-02-06T12:30:00Z")

</div>

also, as for an example hash returned, if I run this:  
`node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" 7kA6H8rnGL9T  
i get:  
$2a$08$T8jtFOaq7VjPUHNQmKABXeXP/kVZ5Ntqermn6bk.nvEiZ6H3tddCm

which won't work. But again, just using the default value for password doesn't work either.

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [6 February 2019 12:33 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/12 "2019-02-06T12:33:14Z")

</div>

one other random thing. If I try to use node-red-admin path to get a hash, i can't install node-red-admin. i get a permissions error. I eventually abandoned trying to solve that having read that the node -e command could be run for the same purpose.

---

<div class="post-metadata">

**Author:** ![Andrei](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/andrei/32/10446_2.png) [@Andrei](https://discourse.nodered.org/u/Andrei)\
**Post date:** [6 February 2019 13:00 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/13 "2019-02-06T13:00:05Z")

</div>

> [@mikerenna](#):
>
> If I try to use node-red-admin path to get a hash, i can't install node-red-admin. i get a permissions error

Good catch. It is worth to investigate. The loging failure could be related to permission issues.

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [6 February 2019 13:04 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/14 "2019-02-06T13:04:02Z")

</div>

I spent a good deal of time trying to figure this one out but not being much of a linux guy and just recently getting into the docker thing (not to mention that this is running on QNAP in container station), i'm a bit stumped on how to go after that one. Adding sudo doesn't work. I'm sure there are path issues. (in the qnap scenario you SSH into QNAP and then navigate to the docker container using "docker exec -it [container name] /bin/bash" from there I can run the npm install of node-red-admin which clearly executes, downloads and attempts to install but this error: npm WARN checkPermissions Missing write access to /usr/local/lib/node\_modules  
npm ERR! path /usr/local/lib/node\_modules  
npm ERR! code EACCES  
npm ERR! errno -13  
npm ERR! syscall access  
npm ERR! Error: EACCES: permission denied, access '/usr/local/lib/node\_modules'  
npm ERR! { Error: EACCES: permission denied, access '/usr/local/lib/node\_modules'  
npm ERR! stack: 'Error: EACCES: permission denied, access '/usr/local/lib/node\_modules'',  
npm ERR! errno: -13,  
npm ERR! code: 'EACCES',  
npm ERR! syscall: 'access',  
npm ERR! path: '/usr/local/lib/node\_modules' }  
npm ERR!  
npm ERR! The operation was rejected by your operating system.  
npm ERR! It is likely you do not have the permissions to access this file as the current user  
npm ERR!  
npm ERR! If you believe this might be a permissions issue, please double-check the  
npm ERR! permissions of the file and its containing directories, or try running  
npm ERR! the command again as root/Administrator (though this is not recommended).

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [12 February 2019 02:12 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/15 "2019-02-12T02:12:50Z")

</div>

No thoughts from anyone?

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [12 February 2019 08:46 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/16 "2019-02-12T08:46:33Z")

</div>

I'm going to guess the user you are running the command as doesn't actually have the root access required. But before we go there - Is the only reason you want node-red-admin to create the hash of the password ? - you can also do that using the command line below from within the node-red-install directory

```
node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" your-password-here
```

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [13 February 2019 04:34 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/17 "2019-02-13T04:34:34Z")

</div>

that is the only reason. My real issue is that the hashed passwords don't work. In fact, even the default password in the sample file does not work. I can turn on and off the login prompt by commenting out the authentication section, which rules out working on the wrong settings file. I'm baffled.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [13 February 2019 10:22 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/18 "2019-02-13T10:22:17Z")

</div>

I wonder if this is a DOCKER issue?? (never having used Docker, I won't be much help...sorry)

---

<div class="post-metadata">

**Author:** ![mikerenna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mikerenna/32/5629_2.png) [@mikerenna](https://discourse.nodered.org/u/mikerenna)\
**Post date:** [13 February 2019 12:33 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/19 "2019-02-13T12:33:14Z")

</div>

its certainly one of the variables (and unfortunately not one easy to eliminate and rule out). Surely someone has proven this authentication model works with docker.

---

<div class="post-metadata">

**Author:** ![dvancity](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dvancity/32/48015_2.png) [@dvancity](https://discourse.nodered.org/u/dvancity)\
**Post date:** [15 September 2021 03:11 UTC](https://discourse.nodered.org/t/authentication-help-needed/7492/20 "2021-09-15T03:11:13Z")

</div>

This thread is stale, but I have a potential solution for those using node red in a container.

When the container is started, if you create a volume, then the settings.js file will be stored in the docker volume directory.  
for example /var/lib/docker/volumes/node\_red\_data/\_data  
Edit this settings file, rather than the one inside the container.