# Node red won't ask for editor password

**URL:** <https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505>\
**Category:** General\
**Created:** [19 February 2025 05:49 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505 "2025-02-19T05:49:29Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Csarugo](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Csarugo](https://discourse.nodered.org/u/Csarugo)\
**Post date:** [19 February 2025 05:49 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/1 "2025-02-19T05:49:29Z")

</div>

Hi Team,

I'm running node-red on linux (Ubuntu) and I haven't been able to figure out how to secure the editor. I've made the changes to the settings.js file according to this article [Securing Node-RED : Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red) , but it won't ask for the credentials once I open node red in my browser. I've tried different browsers (a suggestion on another post) and no luck.

Any ideas?

Thanks.

---

<div class="post-metadata">

**Author:** ![smanjunath211](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/smanjunath211/32/95742_2.png) [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)\
**Post date:** [19 February 2025 06:24 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/2 "2025-02-19T06:24:36Z")

</div>

make sure the it is the **correct** settings file. during startup you can see whcih settings file is being loaded. i had done similar mistake sometime back.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/8/2/8236318b4ebb729affffba02a6d706f637f95558.png)

---

<div class="post-metadata">

**Author:** ![Csarugo](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Csarugo](https://discourse.nodered.org/u/Csarugo)\
**Post date:** [19 February 2025 11:52 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/3 "2025-02-19T11:52:42Z")

</div>

Hi @smanjunath211 ,

I have, and I can open the settings file and see the changes.

No idea why it's not working.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [19 February 2025 12:15 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/4 "2025-02-19T12:15:29Z")

</div>

Have you restarted Node-red?

Can you show us the relevant bit of settings.js?  
Obviously falsify the login and password hash before posting.

---

<div class="post-metadata">

**Author:** ![Csarugo](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Csarugo](https://discourse.nodered.org/u/Csarugo)\
**Post date:** [19 February 2025 12:25 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/5 "2025-02-19T12:25:34Z")

</div>

Hi Team,

Here's the info for the settings file address:

19 Feb 12:20:03 - [info] Node-RED version: v4.0.9  
19 Feb 12:20:03 - [info] Node.js version: v20.18.1  
19 Feb 12:20:03 - [info] Linux 6.8.0-49-generic x64 LE  
19 Feb 12:20:03 - [info] Loading palette nodes  
19 Feb 12:20:04 - [info] Settings file : /root/.node-red/settings.js  
19 Feb 12:20:04 - [info] Context store : 'default' [module=memory]  
19 Feb 12:20:04 - [info] User directory : /root/.node-red  
19 Feb 12:20:04 - [warn] Projects disabled : editorTheme.projects.enabled=false  
19 Feb 12:20:04 - [info] Flows file : /root/.node-red/flows.json

And here's the settings file piece

adminAuth: {  
type: "credentials",  
users: [  
{  
username: "admin",  
password: "$2y$0................",  
permissions: "\*"  
}]  
},

I tried restarting node red with the **node-red-restart** command to no luck.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [19 February 2025 12:36 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/6 "2025-02-19T12:36:30Z")

</div>

I suspect this is because you are running node-red from a root terminal and not the account your service uses.

Stop node-red (node-red-stop) then Start node-red using `node-red-start` and see what settings file it reports.

---

<div class="post-metadata">

**Author:** ![Csarugo](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Csarugo](https://discourse.nodered.org/u/Csarugo)\
**Post date:** [19 February 2025 12:53 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/7 "2025-02-19T12:53:10Z")

</div>

Hi @Steve-Mcl ,

You lost me here "..the account your service uses".

How do I know the account? I have root access to the server.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [19 February 2025 12:57 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/8 "2025-02-19T12:57:32Z")

</div>

Since you mentioned " **node-red-restart**" I assume Node-RED was installed using the installer script.

The installer script setups Node-RED (typically) to NOT run as `root` (because that can be dangerous) but instead uses the account that installed it.

So just for one moment forget I said that and perform the actions I stated:

`node-red-stop` will stop the service.  
`node-red-start` will start the service using the account it was configured to use and you will see which user (and which settings file to edit) in the log output.

_this assumes you did actually use the official installer script_

---

<div class="post-metadata">

**Author:** ![Csarugo](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Csarugo](https://discourse.nodered.org/u/Csarugo)\
**Post date:** [19 February 2025 13:01 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/9 "2025-02-19T13:01:57Z")

</div>

Hi @Steve-Mcl ,

I'm new to Linux, so I might be confusing the whole thing.

I used the "sudo npm install -g --unsafe-perm node-red" to install node red.

Running the node-red-stops/start/restart is giving me a "command not found" error message.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [19 February 2025 13:15 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/10 "2025-02-19T13:15:54Z")

</div>

Is this Ubuntu machine local or a shared portion of a machine in a data centre?

> [@Csarugo](#):
>
> I'm new to Linux

> [@Csarugo](#):
>
> I have root access to the server

No criticism intended but that is a dangerous combination!

---

<div class="post-metadata">

**Author:** ![Csarugo](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Csarugo](https://discourse.nodered.org/u/Csarugo)\
**Post date:** [19 February 2025 13:22 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/11 "2025-02-19T13:22:06Z")

</div>

This is a shared portion of a machine and I agree about it being a dangerous combination. Thankfully all we're running is an MQTT Broker and Node Red, which should keep all fires to a minimum.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [20 May 2025 13:22 UTC](https://discourse.nodered.org/t/node-red-wont-ask-for-editor-password/95505/12 "2025-05-20T13:22:15Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.