Hello, and thanks for your reply in advance. For a few years I have used node-red for home control, simple setup, control of heat pumps, monitoring of temperatures etc., I am far from an expert on this, but I got it to work. have been using node red dashboard, this has worked great until tonight, when I had to change the temp setting, worked fine earlier today. What suddenly happened is that the dashboard asks for a password, the same for the flow editor. I have not set this up with a password. get in touch with pI via Putty, and have tried rebooting. have also tried from both PC and phone, same result. Does anyone have any good tips to solve this?

Same issue here... odd that this happened to so many folks around the same time

[image] jbudd: I'm not sure what you mean there Julian. All I mean is that I don't think it is a good idea to store a sudo-capable password in an instance of Node-RED connected to the Internet. At least with sudo, you can control quite exactly what a user is allowed to do passwordless. Putting a password into Node-RED is just another avenue of attack. [image] jbudd: All I suggest is that it's more secure if the Node-red user does not have passwordless sudo. I agree in general but, as mentioned, passwordless sudo is quite fine-grained, its just that most of us are too lazy to configure it in detail :slight_smile: Again, it would be better to have a separate instance of node-red that couldn't easily be accessed from the Internet to do anything sensitive. [image] jbudd: This attack was mounted over the internet but the vulnerability is the same within a company intranet or home network. That is, of course, generally true. However the risk levels aren't the same. Having an internal-only server, especially if well-configured, reduces risks still further. [image] jbudd: I'm sure that those you manage don't! :wink: nope! Well, not quite true in fact. My server CAN be accessed from the Internet. BUT, only when I turn the server feature on via a completely separate secure route, then I can remote network to the server using one of the afore mentioned cloud services. Once I'm done, I turn the external access off again. Mostly, I never need external access. But if I ever needed to use Node-RED to provide an Internet-facing web service, it would at least be protected by Cloudflare first, then my router firewall, then a server firewall, then a reverse proxy providing authentication and authorisation. And I would probably still run it on a separate instance of Node-RED. That sounds like a lot of faff, but actually isn't that hard to do. In fact, I'd likely run the external facing services all on a locked-down Pi and leave my home server internal-only with a very limited interface between the Pi and the server. And I would periodically do an auto-compare of settings between the Pi and a known good config. But given that All I really need to do is check if the home server is working properly - more accurately, get it to tell me if something is wrong. All I generally need is Telegram with a couple of simple commands that let me turn on/off external remote networking, query the running apps and turn on/off a few lights. [image] jbudd: Is Node-red's access control "relatively loose"? Hmm, I think it is in line with what I'd expect really. My stance has always been that it isn't really Node-RED's job to worry too much about security, that's best left to more specialist tools. What is there is for simple use in my view. Though I do know that some organisations have done security testing. But Node-RED is a general purpose compute environment and it is fairly easy to mess up the security on such a beast. Harder on a tool designed to be the gateway to your systems. [image] jbudd: On those devices where I set a password, it occasionally asks me for the password, at long indeterminate intervals. Ah, well that's a conversation for another day. Session expiry, JWT, websocket security, etc are things that also need care and attention if exposing one's systems to 7 billion people (and probably 10's of millions of bots). [image] jbudd: I know there are efforts ongoing to enhance access control, mostly via buzzwords such as "reverse proxy" and "middleware" which serve to exclude those who don't already speak the jargon. Yes, there is still much to be done to try and simplify that. I made a start with some of the documentation for uibuilder but it is a complex subject and certainly hard to put into bite-sized pieces. I still shudder at some of the junk put out on Internet blog posts. Though it is generally getting better. [image] yawstick1: odd that this happened to so many folks around the same time Not really, a similar thing happened last time. Someone spots a new hole and word gets round. Or it could be a single actor who discovered a hole and then searched for exposed servers. Not really that hard.

[image] yawstick1: Same issue here Do you also have your internet exposed to the internet without https and good passwords?

The Node-RED Google Assistant Bridge does NOT require the Node-RED instance to be exposed to the internet. It uses MQTT to make a secure outbound connection to receive commands. It also places no restrictions on enabling admin auth, which should always be enabled before exposing Node-RED to any open network

[image] hardillb: The Node-RED Google Assistant Bridge does NOT require the Node-RED instance to be exposed to the internet I didn't know. AFAIK this port redirection was included in the installation instructions I followed years ago. I now closed these ports on my router and everything still seems to work indeed. Thanks for noting!

Security FAQ updated [image] Safely accessing Node-RED over the Internet FAQs Update 2025-02-19 The best advice for most people doing home automation is still: Don't expose Node-RED to the outside world! Where you really have to have some outside access, keep it as hands-off and restricted as possible. For example, using a Telegram bot. Also keep it as minimal as possible, e.g. Don't expose the Editor - EVER! If you want to provide remote control of your heating or the precious plants in your greenhouse, provide explicit controls with strong limits. Don't expose ever…

[image] Colin: I note that on the 64 version of Raspbian Bullseye Lite the user pi is no more, it prompts for a user and password on first boot, and that sudo does require a password. This is a big step forward, it is just a pity it has taken 10 years to get to this point. Hopefully the other pi images are the same. Agreed. It's time NR was updated to require UN/PW on first use of the interface rather than asking novice users to jump out of the friendly UI and delve into settings.js via the command line; and the convoluted process of creating a hash that's not really a novice activity - I hope it should be simple to implement and would make all new installations safer out of the box, thus improve reputation despite people not taking enough care over their own IT security... It's great that NR appeals to the tech novice, just a shame it expects a level of technical competence to give it some basic security. At the very least it would be better if the settings.js was editable via the UI in a sensible way.

[image] dougle03: Agreed. It's time NR was updated to require UN/PW on first use of the interface That isn't what I am talking about. If you read my post again you will see I am referring to the system user and pwd, nothing to do with node red.

No, I just closed all ports. NR is not connected to the internet anymore

[image] Colin: If you read my post again you will see I am referring to the system user and pwd, nothing to do with node red. Yes I know. I was agreeing with your assessment of the improvements to the default Pi OS as installed. I was drawing, albeit clumsily, parallels that if Raspberry can do it, perhaps NR should to, after all NR is as much targeted at novices as much as is to experienced users.

Node-RED

Node-RED Forum

Dashboard suddenly asks for password (Hacked Node-RED servers)

General

TotallyInformation 18 October 2022 13:18 61

Security FAQ updated

Topic		Replies	Views
Nodered hacked by adding invisible nodes General security	142	3823	6 January 2024
Configuring Public Node-RED Server on RPi General	28	1908	9 July 2020
Securing Node-Red General security	33	8766	24 December 2023
Remote Access for my dashboard Dashboard	38	17179	18 October 2024
Have I been hacked? General security	61	1706	3 November 2023

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Dashboard suddenly asks for password (Hacked Node-RED servers)

Related topics