Hello, and thanks for your reply in advance. For a few years I have used node-red for home control, simple setup, control of heat pumps, monitoring of temperatures etc., I am far from an expert on this, but I got it to work. have been using node red dashboard, this has worked great until tonight, …

I am just trying to point out that vulnerabilities are always there. I am no fan of centralized cloud services, as those are the most interesting to hackers and if things goes wrong there, it is always at a massive scale. Zero-tier, vpns and the like are only reachable from devices that have been s…

[image] bakman2: I don't always have these requirements available, but still want to access my systems somehow and opted for nginx proxy+ssl and authelia (2FA) instead (with my fingers crossed that those are all safe). If i do not have my phone or laptop available to initiate a VPN from then …

[image] bakman2: I am just trying to point out that vulnerabilities are always there. I am no fan of centralized cloud services, as those are the most interesting to hackers and if things goes wrong there, it is always at a massive scale. I'm not a fan of centralized cloud services and run my…

[image] tve: One thing I'm wondering is why are people exposing NR to the internet? Or more specifically, what functionality are they trying to get remotely? Hey Thorsten, Via the NR dashboard you can: Control your garage doors when you arrive home Watch your camera's when you are not home …

[image] pgScorpio: sudo visudo added this line: pi ALL=(ALL) ALL Strange. Adding that line did nothing for me. No change to whether the user pi needs a password when executing a sudo command.

I did. Sort of. Didn't read far enough (missed the fine print) :man_facepalming:t3:. For the record, the fine print is this: sudo visudo /etc/sudoers.d/010_pi-nopasswd and change pi ALL=(ALL) NOPASSWD: ALL to pi ALL=(ALL) ALL Problem solved! Thanks.

[image] TotallyInformation: Even using vanilla SSH will let you fairly easily configure "port forwarding" that lets you define a local (to your laptop) port that connects to a remote port (such as Node-RED's 1880 port) on the server. Though I recommend that you change the SSH entry port from the…

As far as I can see that attack did not get in through SSH, which is what is referenced in the text you replied to.

[image] PanicMan: This is not safe enough, as I got hacked through exactly this: I don't think i would be arguing about security with Julian !! @TotallyInformation

Node-RED

Node-RED Forum

Dashboard suddenly asks for password (Hacked Node-RED servers)

General

Steve-Mcl 23 October 2022 17:11 115

read this link: linux - Raspberry Pi don't asking me for password when using sudo - Super User

1 Like

Topic		Replies	Views
Nodered hacked by adding invisible nodes General security	143	2995	6 March 2024
Configuring Public Node-RED Server on RPi General	29	1735	23 July 2020
Securing Node-Red General security	33	8558	24 December 2023
Remote Access for my dashboard Dashboard	38	16950	18 October 2024
Have I been hacked? General security	62	1316	2 January 2024

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Dashboard suddenly asks for password (Hacked Node-RED servers)

Related topics