# Node Red starts mining Monero coins without my consent!

**URL:** <https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344>\
**Category:** General\
**Tags:** security\
**Created:** [28 July 2025 07:05 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344 "2025-07-28T07:05:06Z")\
**Posts on this page:** 1\
**Showing post:** 32

<div class="post-metadata">

**Author:** ![UnborN](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@UnborN](https://discourse.nodered.org/u/UnborN)\
**Post date:** [28 July 2025 14:07 UTC](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344/32 "2025-07-28T14:07:02Z")

</div>

> [@devifast](#):
>
> How to make fail2ban protect Node red

There is one related post here

> [@Where logged NR failed logins?](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429):
>
> Hallo I put credentials in settings.js, but where write NR the failed login try? I have a linux system and try to look in auth-logs and add a custom logger to the settings.js, but I cant find any output to this. I would use fail2ban to anlyze this log. Thanks Thomas

but unfortunately even if you enable `audit` for more detailed logs .. you wont have the remote IP there so its not possible to use fail2ban using node-red logs.

You could use a reverse proxy like [caddy server](https://caddyserver.com/) or nginx in front of your NR server  
and use their more detailed logs to implement the additional fail2ban security (protecting you from brute force attacks) along with node-red's authentication using a strong password.

---

_[View the full topic](https://discourse.nodered.org/t/node-red-starts-mining-monero-coins-without-my-consent/98344)._