Hello, and thanks for your reply in advance. For a few years I have used node-red for home control, simple setup, control of heat pumps, monitoring of temperatures etc., I am far from an expert on this, but I got it to work. have been using node red dashboard, this has worked great until tonight, …

Same issue here... odd that this happened to so many folks around the same time

[image] jbudd: I'm not sure what you mean there Julian. All I mean is that I don't think it is a good idea to store a sudo-capable password in an instance of Node-RED connected to the Internet. At least with sudo, you can control quite exactly what a user is allowed to do passwordless. Puttin…

[image] yawstick1: Same issue here Do you also have your internet exposed to the internet without https and good passwords?

The Node-RED Google Assistant Bridge does NOT require the Node-RED instance to be exposed to the internet. It uses MQTT to make a secure outbound connection to receive commands. It also places no restrictions on enabling admin auth, which should always be enabled before exposing Node-RED to any ope…

[image] hardillb: The Node-RED Google Assistant Bridge does NOT require the Node-RED instance to be exposed to the internet I didn't know. AFAIK this port redirection was included in the installation instructions I followed years ago. I now closed these ports on my router and everything still…

Security FAQ updated [image] Safely accessing Node-RED over the Internet FAQs Update 2025-02-19 The best advice for most people doing home automation is still: Don't expose Node-RED to the outside world! Where you really have to have some outside access, ke…

[image] Colin: I note that on the 64 version of Raspbian Bullseye Lite the user pi is no more, it prompts for a user and password on first boot, and that sudo does require a password. This is a big step forward, it is just a pity it has taken 10 years to get to this point. Hopefully the other pi…

[image] dougle03: Agreed. It's time NR was updated to require UN/PW on first use of the interface That isn't what I am talking about. If you read my post again you will see I am referring to the system user and pwd, nothing to do with node red.

No, I just closed all ports. NR is not connected to the internet anymore

[image] Colin: If you read my post again you will see I am referring to the system user and pwd, nothing to do with node red. Yes I know. I was agreeing with your assessment of the improvements to the default Pi OS as installed. I was drawing, albeit clumsily, parallels that if Raspberry can …

Node-RED

Node-RED Forum

Dashboard suddenly asks for password (Hacked Node-RED servers)

General

TotallyInformation 18 October 2022 13:18 61

Security FAQ updated

Topic		Replies	Views
Nodered hacked by adding invisible nodes General security	143	3005	6 March 2024
Configuring Public Node-RED Server on RPi General	29	1751	23 July 2020
Securing Node-Red General security	33	8569	24 December 2023
Remote Access for my dashboard Dashboard	38	16952	18 October 2024
Have I been hacked? General security	62	1329	2 January 2024

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Dashboard suddenly asks for password (Hacked Node-RED servers)

Related topics