# Login nodered ui requires password suddenly

**URL:** <https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842>\
**Category:** General\
**Tags:** security\
**Created:** [18 November 2022 16:30 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842 "2022-11-18T16:30:33Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![thedinos](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@thedinos](https://discourse.nodered.org/u/thedinos)\
**Post date:** [18 November 2022 16:30 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/1 "2022-11-18T16:30:33Z")

</div>

I’m Quite new on this subject (tool)  
After successful installation I run several weeks load jobs successfully! On Linux Debian 11 (bullseye)

After a reboot node-red interface comes with login screen.  
I checked settings.js  
There is nothing enabled. I see (in database) that jobs are still running fine.

But I cant edit jobs anymore…  
Any help is appreciated

I’m wondering how this can happen?

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [18 November 2022 17:37 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/2 "2022-11-18T17:37:51Z")

</div>

Is your device connected to the open internet ?  
If so then you have most likely been hacked - see this thread - [Dashboard suddenly asks for password (Hacked Node-RED servers)](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083)

---

<div class="post-metadata">

**Author:** ![thedinos](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@thedinos](https://discourse.nodered.org/u/thedinos)\
**Post date:** [19 November 2022 11:23 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/3 "2022-11-19T11:23:31Z")

</div>

Hi. Thanks for your reply.  
My device is not accessible from internet.  
Since it ran for more then a month (and it still runs) I rather think of an update which was semi-automatic done…

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [19 November 2022 11:45 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/4 "2022-11-19T11:45:34Z")

</div>

Passworded access to the Node-red editor is defined in ~/.node-red/settings.js.  
Here is a sample of the standard file. The password deinition is commented out, so no password is prompted for.

```auto
    //adminAuth: {
    // type: "credentials",
    // users: [{
    // username: "admin",
    // password: "$2a$08$zZWtXTja0fB1pzD4sHCPucBMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
    // permissions: "*"
    // }]
    //},

```

Note that the section could be present both commented and uncommented.  
If you comment it out and restart, you should be able to get back in to NR.  
Another option is just to delete settings.js and restart.

Node-red updates are not automatic, nor do they set passwords. If you didn't set the password, someone/something else did. What else did they do while they had access to your computer?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [19 November 2022 16:00 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/5 "2022-11-19T16:00:32Z")

</div>

If you still can't work it out then stop node red and start it again in a terminal and show us the startup log. Also which settings.js did you check?

---

<div class="post-metadata">

**Author:** ![thedinos](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@thedinos](https://discourse.nodered.org/u/thedinos)\
**Post date:** [19 November 2022 16:47 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/6 "2022-11-19T16:47:45Z")

</div>

Rebooted again today. Now even worse. Flow doesn start due to database access denied... (I can fix this in flow, but need UI acces...)  
This is the log after starting:

```auto

mcattel@penguin:~/.node-red$ sudo node-red &
[1] 962
mcattel@penguin:~/.node-red$ 
mcattel@penguin:~/.node-red$ 19 Nov 17:26:25 - [info] 

Welcome to Node-RED
===================

19 Nov 17:26:25 - [info] Node-RED version: v3.0.2
19 Nov 17:26:25 - [info] Node.js version: v12.22.12
19 Nov 17:26:25 - [info] Linux 5.10.114-16025-ge75506b9d98e x64 LE
19 Nov 17:26:30 - [info] Loading palette nodes
19 Nov 17:26:40 - [info] **Settings file :/root/.node-red /settings.js**
19 Nov 17:26:40 - [info] Context store : 'default' [module=memory]
19 Nov 17:26:40 - [info] User directory : /root/.node-red
19 Nov 17:26:40 - [warn] Projects disabled : editorTheme.projects.enabled=false
19 Nov 17:26:40 - [info] Flows file : /home/mcattel/.node-red/flows.json
19 Nov 17:26:40 - [warn] 

---------------------------------------------------------------------
Your flow credentials file is encrypted using a system-generated key.

If the system-generated key is lost for any reason, your credentials
file will not be recoverable, you will have to delete it and re-enter
your credentials.

You should set your own key using the 'credentialSecret' option in
your settings file. Node-RED will then re-encrypt your credentials
file using your chosen key the next time you deploy a change.
---------------------------------------------------------------------

19 Nov 17:26:40 - [info] Server now running at http://127.0.0.1:1880/
19 Nov 17:26:40 - [info] Starting flows
19 Nov 17:26:40 - [info] Started flows
19 Nov 17:26:40 - [error] [mysql:Database] Database not connected
19 Nov 17:26:40 - [error] [MySQLdatabase:8648a27d733482c7] Error: Access denied for user ''@'localhost' (using password: NO)
19 Nov 17:26:40 - [error] [MySQLdatabase:energy] Error: Access denied for user ''@'localhost' (using password: NO)

pwd
mcattel@penguin:~/.node-red$ pwd
/home/mcattel/.node-red
mcattel@penguin:~/.node-red$ ls -la
total 140
drwxr-xr-x 1 mcattel mcattel 454 Nov 19 17:15 .
drwxr-xr-x 1 mcattel mcattel 1050 Nov 19 17:23 ..
-rw-r--r-- 1 mcattel mcattel 16230 Sep 15 17:32 .config.nodes.json
-rw-r--r-- 1 mcattel mcattel 15554 Sep 15 17:32 .config.nodes.json.backup
-rw-r--r-- 1 mcattel mcattel 95 Sep 13 19:56 .config.runtime.json
-rw-r--r-- 1 mcattel mcattel 583 Sep 16 13:57 .config.users.json
-rw-r--r-- 1 mcattel mcattel 584 Sep 16 13:57 .config.users.json.backup
-rw-r--r-- 1 mcattel mcattel 235 Sep 16 15:18 flows_cred.json
-rw-r--r-- 1 mcattel mcattel 155 Sep 16 15:18 .flows_cred.json.backup
-rw-r--r-- 1 mcattel mcattel 13589 Sep 16 19:46 flows.json
-rw-r--r-- 1 mcattel mcattel 13541 Sep 16 19:46 .flows.json.backup
drwxr-xr-x 1 mcattel mcattel 10 Sep 13 19:56 lib
drwxr-xr-x 1 mcattel mcattel 696 Sep 15 17:32 node_modules
-rw-r--r-- 1 mcattel mcattel 244 Sep 15 17:32 package.json
-rw-r--r-- 1 mcattel mcattel 25164 Sep 15 17:32 package-lock.json
-rw-r--r-- 1 mcattel mcattel 22610 Nov 11 20:27 settings.js

```

Even tried after removing the settings.js

... But found something  
Maybe I'm running using a composer.

```auto
mcattel@penguin:/usr/local/bin$ ls -l
total 2748
-rwxr-xr-x 1 root root 2801573 Sep 26 15:28 composer
lrwxrwxrwx 1 root root 35 Sep 13 19:54 node-red -> ../lib/node_modules/node-red/red.js
lrwxrwxrwx 1 root root 52 Nov 9 15:08 node-red-admin -> ../lib/node_modules/node-red-admin/node-red-admin.js
lrwxrwxrwx 1 root root 44 Sep 13 19:54 node-red-pi -> ../lib/node_modules/node-red/bin/node-red-pi

```

At the end I think I fixed it by editing this file:  
Settings file :/root/.node-red /settings.js

Not sure how it came there.....  
instead of the file where I expect to be there.: /home/mcattel/.node-red  
The setting.js file was still default (with george and admin user)

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [19 November 2022 16:52 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/7 "2022-11-19T16:52:08Z")

</div>

You started node red using sudo, that is why it is using a file in the root folder. You should not start node-red using sudo unless you have a very good reason, and probably not even then.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [19 November 2022 16:55 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/8 "2022-11-19T16:55:42Z")

</div>

Also node-red 3.0 requires nodejs 14 or above. See [Version 3.0 released : Node-RED](https://nodered.org/blog/2022/07/14/version-3-0-released)

The best way to upgrade is to use the recommended Debian/Ubuntu/Pi install script [Running on Raspberry Pi : Node-RED](https://nodered.org/docs/getting-started/raspberrypi)

---

<div class="post-metadata">

**Author:** ![tree-frog](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/tree-frog/32/89303_2.png) [@tree-frog](https://discourse.nodered.org/u/tree-frog)\
**Post date:** [20 November 2022 01:34 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/9 "2022-11-20T01:34:26Z")

</div>

@thedinos,  
Was the login notated "Node-RED", or was it a login for your server or network? Are you local to the Node-RED instance? or on another pc on the network?

---

<div class="post-metadata">

**Author:** ![thedinos](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@thedinos](https://discourse.nodered.org/u/thedinos)\
**Post date:** [28 November 2022 18:03 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/10 "2022-11-28T18:03:55Z")

</div>

thanks Colin.

---

<div class="post-metadata">

**Author:** ![thedinos](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@thedinos](https://discourse.nodered.org/u/thedinos)\
**Post date:** [28 November 2022 18:04 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/11 "2022-11-28T18:04:47Z")

</div>

local.  
its probably because of I installed and running it with sudo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [27 January 2023 18:05 UTC](https://discourse.nodered.org/t/login-nodered-ui-requires-password-suddenly/70842/12 "2023-01-27T18:05:21Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.