# Login failed even if

**URL:** <https://discourse.nodered.org/t/login-failed-even-if/90559>\
**Category:** General\
**Tags:** security\
**Created:** [30 August 2024 15:02 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559 "2024-08-30T15:02:11Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![marke](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marke/32/95696_2.png) [@marke](https://discourse.nodered.org/u/marke)\
**Post date:** [30 August 2024 15:02 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/1 "2024-08-30T15:02:11Z")

</div>

Hi to all  
I'm running NODE RED on Raspberry PI5 Bookworm. Following the "securing nodered" instruction I have createted an hash password and edited settings.js  
Whe I try to access node-red editor login windows appears but if I'm absolutely sure of my correct user and password input the message "login failure" apper... please elp me I'm very close to the to the destruction of my raspberry 🙂  
Thanks for your cooperation

---

<div class="post-metadata">

**Author:** ![Buzzylogic](https://avatars.discourse-cdn.com/v4/letter/b/f17d59/32.png) [@Buzzylogic](https://discourse.nodered.org/u/Buzzylogic)\
**Post date:** [30 August 2024 16:01 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/2 "2024-08-30T16:01:21Z")

</div>

I had the same thing happen, I ended up starting a fresh installation without securing it, I hope someone lends some light on the situation.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [30 August 2024 16:38 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/3 "2024-08-30T16:38:13Z")

</div>

It works for me:

NB the \<\<- ! and final ! are not needed, I just used them so you can see my password is nice and secure 😄  
Also "admin" here means you want to perform an administrative task, not the username

```auto
pi@TestOS:~/.node-red $ node-red admin hash-pw <<- !
> password1
> !
Password: $2a$08$IYkf3sQb5.gxdR7C5ZUnwel3cq5siukhhjO3dTWgjykx4Q/G5ZnaG

```

In settings.js I have this.  
See that the password hash is the same, and the username is "admin"

```auto

/ *******************************************************************************
 * Security
 * - adminAuth
 * - https
 * - httpsRefreshInterval
 * - requireHttps
 * - httpNodeAuth
 * - httpStaticAuth
 ****************************************************************************** /

    /** To password protect the Node-RED editor and admin API, the following
     * property can be used. See https://nodered.org/docs/security.html for details.
     */

    adminAuth: {
        "type": "credentials",
        "users": [
            {
                "username": "admin",
                "password": "$2a$08$IYkf3sQb5.gxdR7C5ZUnwel3cq5siukhhjO3dTWgjykx4Q/G5ZnaG",
                "permissions": "*"
            }
        ]
    },

```

Restart Node-red & visit the editor URL:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/7/d/7d21ec60ef5beffa18ccd914a625beced9822992.png)

And success!

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/e/4/e4dfc4cda7e3c537b1b61ad15073501ab354417a.png)

---

<div class="post-metadata">

**Author:** ![GogoVega](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gogovega/32/71313_2.png) [@GogoVega](https://discourse.nodered.org/u/GogoVega)\
**Post date:** [30 August 2024 17:08 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/4 "2024-08-30T17:08:50Z")

</div>

Did you restart NR after setting your credentials in the settings file?

---

<div class="post-metadata">

**Author:** ![marke](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marke/32/95696_2.png) [@marke](https://discourse.nodered.org/u/marke)\
**Post date:** [30 August 2024 18:14 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/5 "2024-08-30T18:14:58Z")

</div>

Thanks for your reply

Yes

of course

This is what is in my setting.js file

```json
adminAuth: {
    type: "credentials",
    users: [
        {
            username: "admin",
            password: "$2y$08$fvIZYnWxkSOBkjEjsgSORe5dbMeJbj3wDbDND9sGsY9xFTsRSEFFK",
            permissions: "*"
        },
        {
            username: "user",
            password: "$2y$08$Bo/OKKX8ZmeUBHGallYLhehFdXIwljU7MXK3Ua6AmanhHH4wKNyXa",
            permissions: "read"
        }
    ]
}

```

Issued command after settings.js saving

```auto
chl@raspberrypi:~/.node-red $ node-red-stop

Stop Node-RED

Use node-red-start to start Node-RED again

chl@raspberrypi:~/.node-red $ node-red-restart

Restarted Node-RED

chl@raspberrypi:~/.node-red $

Starting node red login is requested and my answers are:

Username : admin

Password : $2y$08$fvIZYnWxkSOBkjEjsgSORe5dbMeJbj3wDbDND9sGsY9xFTsRSEFFK

```

……

marco cheli

Via dei Platani – 20

51100 PISTOIA

marco@cheli.info

3485100539

![signature_3794329410](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/7/d7a30ffebc76102bfcc36dcb47468fa9d9ab5a70.jpeg)

  

* * *

_Admin edit. Please use triple backticks for code and terminal output_

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [30 August 2024 18:19 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/6 "2024-08-30T18:19:07Z")

</div>

> [@marke](#):
>
> Starting node red login is requested and my answers are:
> 
> Username : admin
> 
> Password : $2y$08$fvIZYnWxkSOBkjEjsgSORe5dbMeJbj3wDbDND9sGsY9xFTsRSEFFK

If you look at my example I put the long password hash into settings.js, but at the login screen I used "password1"

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [30 August 2024 18:19 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/7 "2024-08-30T18:19:13Z")

</div>

which settings file did you edit? (full path please)

---

<div class="post-metadata">

**Author:** ![marke](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marke/32/95696_2.png) [@marke](https://discourse.nodered.org/u/marke)\
**Post date:** [30 August 2024 18:49 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/8 "2024-08-30T18:49:43Z")

</div>

Hi jbudd

Thanks for your suggestion

I’m not sure to understand what you suggest

If I choose a complex password it is because I wont to protect nodered editor from undue access to my public IP

So if for nodered editor access it is enough to digit “admin/password1” it is too much simple to hack my nodered

I don’t understand something?

Bye

marco cheli

Via dei Platani – 20

51100 PISTOIA

marco@cheli.info

3485100539

![signature_2073593026](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/7/d7a30ffebc76102bfcc36dcb47468fa9d9ab5a70.jpeg)

---

<div class="post-metadata">

**Author:** ![marke](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marke/32/95696_2.png) [@marke](https://discourse.nodered.org/u/marke)\
**Post date:** [30 August 2024 18:52 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/9 "2024-08-30T18:52:23Z")

</div>

Hi Steve

/home/chl/.node-red/settings.js

Bye

marco cheli

Via dei Platani – 20

51100 PISTOIA

marco@cheli.info

3485100539

![signature_3151906543](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/7/d7a30ffebc76102bfcc36dcb47468fa9d9ab5a70.jpeg)

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [30 August 2024 19:34 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/10 "2024-08-30T19:34:15Z")

</div>

> [@marke](#):
>
> I don’t understand something?

Certainly one of us is misunderstanding something but it's not necessarily you.

> [@marke](#):
>
> ```auto
> Starting node red login is requested and my answers are:
> Username : admin
> Password : $2y$08$fvIZYnWxkSOBkjEjsgSORe5dbMeJbj3wDbDND9sGsY9xFTsRSEFFK
> 
> ```

I interpret your replies above as meaning you typed in the password hash, not the actual password.

In settings.js you should have  
`$2y$08$fvIZYnWxkSOBkjEjsgSORe5dbMeJbj3wDbDND9sGsY9xFTsRSEFFK`

And in the login screen you should use the string which you used to generate that password hash.

> [@marke](#):
>
> I choose a complex password ... because I want to protect nodered editor from undue access to my public IP
> 
> So if for nodered editor access it is enough to digit “admin/password1” it is too much simple to hack my nodered

You are right to use a secure password. "password1" is just an example which could be guessed in a millisecond by a teenage hacker.

---

<div class="post-metadata">

**Author:** ![marke](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marke/32/95696_2.png) [@marke](https://discourse.nodered.org/u/marke)\
**Post date:** [30 August 2024 19:59 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/11 "2024-08-30T19:59:26Z")

</div>

Hi Jbudd

Now I understand !!!!!!

So it is clear that was me that doesn’t understand !!!! ☺

I try immediately

thanks

marco cheli

Via dei Platani – 20

51100 PISTOIA

marco@cheli.info

3485100539

![signature_133346019](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/7/d7a30ffebc76102bfcc36dcb47468fa9d9ab5a70.jpeg)

---

<div class="post-metadata">

**Author:** ![marke](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marke/32/95696_2.png) [@marke](https://discourse.nodered.org/u/marke)\
**Post date:** [30 August 2024 20:18 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/12 "2024-08-30T20:18:50Z")

</div>

Thanks again jbudd

Now it’s working !!!!!

Reading again your first email your explanation wos absolutely clear

Have you a nice week end

marco cheli

Via dei Platani – 20

51100 PISTOIA

marco@cheli.info

3485100539

![signature_3746374315](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/7/d7a30ffebc76102bfcc36dcb47468fa9d9ab5a70.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 September 2024 20:19 UTC](https://discourse.nodered.org/t/login-failed-even-if/90559/13 "2024-09-13T20:19:24Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.