# Dashboard and Admin Panel Secur problem

**URL:** <https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393>\
**Category:** General\
**Tags:** security\
**Created:** [10 November 2022 11:57 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393 "2022-11-10T11:57:28Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![dereine](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@dereine](https://discourse.nodered.org/u/dereine)\
**Post date:** [10 November 2022 11:57 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/1 "2022-11-10T11:57:28Z")

</div>

I have the problem that I can not protect the admin panel and the UI url. In settings.js I have unblocked the part which is commented out, but after restarting the server nothing happens.

 ![grafik](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/f/2/f29883bb2bd823b8194bc4dc11581c8c8e4b847c.png)

 ![grafik](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/3/7/371915ac0a9f2c4c59bf9d12c49992932c6113a3.png)

---

<div class="post-metadata">

**Author:** ![dereine](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@dereine](https://discourse.nodered.org/u/dereine)\
**Post date:** [14 November 2022 14:54 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/2 "2022-11-14T14:54:56Z")

</div>

I still have not found a solution to this problem.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 November 2022 15:41 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/3 "2022-11-14T15:41:54Z")

</div>

> [@dereine](#):
>
> I still have not found a solution to this problem

I guess that is because you have not provided enough information.

To help you, please provide following info...

1. How is node-red installed? (docker? cloud? local computer directly? Rasperry PI?)
2. What is the full path of the settings file you are editing?
3. What OS is node-red running on (Win/Linux/Mac etc)
4. How do you start node (runs as a service? always started manually by user 'PI'? etc)?

Lastly, please copy & paste the startup log of node-red (the text you see in console or log file upon starting node-red)

---

<div class="post-metadata">

**Author:** ![dereine](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@dereine](https://discourse.nodered.org/u/dereine)\
**Post date:** [16 November 2022 14:43 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/4 "2022-11-16T14:43:16Z")

</div>

Ok.

I installed NodeRed direct on a Debian 11 System.  
The Settingsfile is at /home/.node-red/settings.js  
Its in the autostart "systemctl enable nodered.service"

Hope these are the infos which do you need

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [16 November 2022 16:19 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/5 "2022-11-16T16:19:19Z")

</div>

> [@Steve-Mcl](#):
>
> Lastly, please copy & paste the startup log of node-red (the text you see in console or log file upon starting node-red

You don't appear to have provided that information. The commands  
`node-red-stop`  
`node-red-start`  
Should provide that.

Also what do you mean by 'nothing happens'.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [16 November 2022 16:44 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/6 "2022-11-16T16:44:05Z")

</div>

> [@dereine](#):
>
> Its in the autostart "systemctl enable nodered.service"

What account runs node-red? Look in top or htop for node-red when it is running as a service. What user does it show?

> [@dereine](#):
>
> The Settingsfile is at /home/.node-red/settings.js

Surely that is not the full path - it will be something like `/home/something/.node-red/settings.js`

What does `pwd` reveal? What is your username?

* * *

The point I am trying to get to is - imagine for 1 second the system runs the node-red application as `root` or `my-node-red-service-account` then the settings file loaded will most likely be somewhere different to the one you are editing. Ergo, why we need the logs to determine what settings file is being used.

---

<div class="post-metadata">

**Author:** ![dereine](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@dereine](https://discourse.nodered.org/u/dereine)\
**Post date:** [16 November 2022 17:01 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/7 "2022-11-16T17:01:07Z")

</div>

> The point I am trying to get to is - **imagine for 1 second the system runs the node-red application as `root`** or `my-node-red-service-account` then the settings file loaded will most likely be somewhere different to the one you are editing. Ergo, why we need the logs to determine what settings file is being used.

That was the solution. I forgot, that when i use it as startup service, it run as root. So it was at /root/.node-red/settings.js

I Repalce the settingsfile from /home/.node-red/ to the root folder and now it works.

Thanks alot for your time and the hint and have a nice day

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [16 November 2022 17:11 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/8 "2022-11-16T17:11:06Z")

</div>

It really isn't a good idea idea to run node red as root. A bug in your flows could trash the whole system.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [16 November 2022 17:16 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/9 "2022-11-16T17:16:00Z")

</div>

> [@Colin](#):
>
> It really isn't a good idea idea to run node red as root

+1

Also, if your node-red is accessed by a bad actor (and i dont mean **Sylvester Stallone** ), then a very simple flow modification to infect your full system (at root level no less) is next on the cards.

---

<div class="post-metadata">

**Author:** ![dereine](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@dereine](https://discourse.nodered.org/u/dereine)\
**Post date:** [16 November 2022 17:26 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/10 "2022-11-16T17:26:38Z")

</div>

Its realy safe. No default Port and no access to the www.  
It runs in our intranet in seperat vlan without connection to our mainnetwork.

The Machine run as VM on a test physical server without access to other things. So its ok i think so =)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [30 November 2022 17:26 UTC](https://discourse.nodered.org/t/dashboard-and-admin-panel-secur-problem/70393/11 "2022-11-30T17:26:54Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.