# Dashboard suddenly asks for password (Hacked Node-RED servers)

**URL:** <https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083>\
**Category:** General\
**Tags:** security\
**Created:** [15 October 2022 19:11 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083 "2022-10-15T19:11:52Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jan.ove](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@jan.ove](https://discourse.nodered.org/u/jan.ove)\
**Post date:** [15 October 2022 19:11 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/1 "2022-10-15T19:11:52Z")

</div>

Hello, and thanks for your reply in advance.  
For a few years I have used node-red for home control, simple setup, control of heat pumps, monitoring of temperatures etc., I am far from an expert on this, but I got it to work.  
have been using node red dashboard, this has worked great until tonight, when I had to change the temp setting, worked fine earlier today. What suddenly happened is that the dashboard asks for a password, the same for the flow editor. I have not set this up with a password.  
get in touch with pI via Putty, and have tried rebooting.  
have also tried from both PC and phone, same result.

Does anyone have any good tips to solve this?

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [16 October 2022 17:33 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/2 "2022-10-16T17:33:47Z")

</div>

Same problem here ! And all flows stoped working...

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 18:28 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/3 "2022-10-16T18:28:07Z")

</div>

Also have two pi running node-red and both just started asking for login and password. I have a third pi running and it’s still working

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [16 October 2022 18:52 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/4 "2022-10-16T18:52:59Z")

</div>

What password is it asking for ? ie. what popup do you get, is it from node-red itself ? the browser ?  
Did you perform any updates anywhere ? this is without home assistant ? docker ? etc, details please if available.

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 19:03 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/5 "2022-10-16T19:03:24Z")

</div>

Just running node red  
Trying to log into dashboard or my node red flows flows. Using iPhone safari or from another pc and chrome it looks like it’s coming from node red.  
All has been running now for over a year and half all of a sudden it just popped up asking for password  
I have a pi 3 that this happened to yesterday and now on my pi4.  
I haven’t changed anything on either for at least 3-4months.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/b/f/bf3a3e40cc75e8286328fae5335e0219b2a74108.jpeg)

Not running anything else but nodered

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [16 October 2022 19:10 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/6 "2022-10-16T19:10:55Z")

</div>

I had another instance of node-red running on an other port. It did not have this problem. It is running on another port (1881).  
Because this instance had no real use anymore, I copied all files of the broken instance to this one. I had to install some missing nodes, and all was running like before.

My node red is running on it's own (no HA, ...). I have been working in it all day. I only installed one new node (solar forecaster) early this morning. As far as I know I did not do any updates.

I now have this login screen. But it started with a node-red login screen (in the typical colors and logo).  
In de UI and in the node screen.

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/b/4/b4732ddc2aebd540b40b382ebaa174c4a6736b80.png)

I could not find any similar problem on the internet, expect those here posted today.

I am not sure, but I think in the settings file de adminAuth is uncommented, but not by me...

```auto
/ *******************************************************************************
 * Security
 * - adminAuth
 * - https
 * - httpsRefreshInterval
 * - requireHttps
 * - httpNodeAuth
 * - httpStaticAuth
 ****************************************************************************** /

    /** To password protect the Node-RED editor and admin API, the following
     * property can be used. See http://nodered.org/docs/security.html for details.
     */
adminAuth: {
    type: "credentials",
    users: [
        {
            username: "admin",
            password: "$2b$08$O8/aEWlLrdbCkA1hAsnmZe84m3HuXNf5Qpk5W2JtcP9KAeKyb98LO",
            permissions: "*"
        },

        {
            username: "george",
            password: "$2b$08$O8/aEWlLrdbCkA1hAsnmZe84m3HuXNf5Qpk5W2JtcP9KAeKyb98LO",
            permissions: "read"
        }
    ]
},

    /** The following property can be used to enable HTTPS
     * This property can be either an object, containing both a (private) key
     * and a (public) certificate, or a function that returns such an object.
     * See http://nodejs.org/api/https.html#https_https_createserver_options_requestlistener
     * for details of its contents.
     */

```

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [16 October 2022 19:11 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/7 "2022-10-16T19:11:18Z")

</div>

Use the cli on one of the pi and do a `cd .node-red` then `ls -al` and look at the date of the settings.js, what is it?

Do you access the pi’s from outside your local network?

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [16 October 2022 19:13 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/8 "2022-10-16T19:13:35Z")

</div>

On my pi it was today, but I did not change it. See my previous post.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [16 October 2022 19:15 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/9 "2022-10-16T19:15:57Z")

</div>

If you did not uncommon those lines then my first worry is you have been hacked. That’s why I was asking what the date is on the file.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [16 October 2022 19:17 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/10 "2022-10-16T19:17:49Z")

</div>

> [@DidierWindey](#):
>
> On my pi it was today, but I did not change it.

Take note of the time it changed. Then look in /var/log/syslog and see if anything else happened at that time.

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [16 October 2022 19:20 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/11 "2022-10-16T19:20:38Z")

</div>

@Mastrond @jan.ove please read the last couple posts and check the date/time settings.js was changed.  
Also what version of NR and node.js are you running?

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [16 October 2022 19:28 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/12 "2022-10-16T19:28:32Z")

</div>

> coming from node red.

Node-red has its own login UI form. This is the webserver, was Pi directly accessible from the internet ?

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [16 October 2022 19:35 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/13 "2022-10-16T19:35:48Z")

</div>

In my case the pi is accessable from the internet.

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [16 October 2022 19:40 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/14 "2022-10-16T19:40:44Z")

</div>

problem is I checked the settings file after the problem started, so I don't have the exact timestamp anymore. But I can remember it was today.  
I tried to login with the uncommented login and password, but I could not login with them...

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [16 October 2022 19:54 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/15 "2022-10-16T19:54:09Z")

</div>

In that case, i would immediately pull out the cable of the modem and verify all systems within the LAN for processes that should not be running/exist, change all passwords and close down all the "allowed" open ports on the router.

A lot has been written on this forum about not giving access to node-red over the internet, only via secure methods, ie. vpn's, ssl etc.

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 19:57 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/16 "2022-10-16T19:57:26Z")

</div>

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/3/43b8cdf4d93d929d8def5c6dd83f4ed26080a827.jpeg)  
Yes it must of been accessed today.  
It wasn’t me this sucks.  
How do I fix.

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 20:02 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/17 "2022-10-16T20:02:27Z")

</div>

Yes pi was directly accessible over the internet.

---

<div class="post-metadata">

**Author:** ![jan.ove](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@jan.ove](https://discourse.nodered.org/u/jan.ove)\
**Post date:** [16 October 2022 20:15 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/18 "2022-10-16T20:15:58Z")

</div>

Hi, and thanks for your reply, I was also thinking along those lines, so I have disconnected it from the network. it was connected to the internet.  
Will try what you describe tomorrow.

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 20:24 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/19 "2022-10-16T20:24:57Z")

</div>

This is exactly what my settings.js file looks like they were un commented  
I tried to comment them out but get errors when I do.  
Is there a solution I could try to fix this?

---

<div class="post-metadata">

**Author:** ![jan.ove](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@jan.ove](https://discourse.nodered.org/u/jan.ove)\
**Post date:** [16 October 2022 20:29 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/20 "2022-10-16T20:29:34Z")

</div>

same here, disconnected again  
22765 Oct 15 19:40 settings.js

[Next page](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083.md?page=2)