# The password/security settings article mentioned on the page

**URL:** <https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707>\
**Category:** General\
**Created:** [5 October 2018 06:31 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707 "2018-10-05T06:31:12Z")\
**Posts on this page:** 10\
**Page:** 3

<div class="post-metadata">

**Author:** ![Trying\_to\_learn](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/trying_to_learn/32/28400_2.png) [@Trying\_to\_learn](https://discourse.nodered.org/u/Trying_to_learn)\
**Post date:** [7 November 2018 03:56 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/41 "2018-11-07T03:56:39Z")

</div>

Nick,

Thanks. Though reading that I now think I believe/understand it differently to what it does.

I'm not wanting to "argue" the point and I also don't want to waste your time explaining to me how that part works.

(Obviously I am going to have to read up on how that stuff works)  
But if you have a credentialSecret property (don't know how to do the formatting) and it is corrupted, then the things it "validates" can't be.

Therefore you need a back up of it as well - don't you?  
But I digress. As I said: seems I am not exactly up to speed on the mechanics of how that part works.

---

<div class="post-metadata">

**Author:** ![craigcurtin](https://avatars.discourse-cdn.com/v4/letter/c/94ad74/32.png) [@craigcurtin](https://discourse.nodered.org/u/craigcurtin)\
**Post date:** [7 November 2018 06:39 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/42 "2018-11-07T06:39:32Z")

</div>

The idea is that the CredentialSecret is something that you know i.e. a commonly used phrase etc - if it was a randomly generated phrase/password - then yes you would need to keep an external copy of it to enable the flow to be accessed

Craig

---

<div class="post-metadata">

**Author:** ![manueldiasmanuel](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@manueldiasmanuel](https://discourse.nodered.org/u/manueldiasmanuel)\
**Post date:** [17 February 2019 11:29 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/44 "2019-02-17T11:29:16Z")

</div>

Hi,

I am running node-red on Synology NAS.

I am having probelms to install node-red-admin , so i would like to know if there is an alternative to protect node-red Ui ?

I tried to generate a password here and copy to setting file but does not work

[https://www.dailycred.com/article/bcrypt-calculator](https://www.dailycred.com/article/bcrypt-calculator)

How can i protect without installing node-red-admin ?

Regards,

M Dias

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 February 2019 11:39 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/45 "2019-02-17T11:39:17Z")

</div>

Hi @manueldiasmanuel

the docs give you the `node` command you can run instead of using `node-red-admin` - [https://nodered.org/docs/security#generating-the-password-hash](https://nodered.org/docs/security#generating-the-password-hash)

Just make sure you run it the the directory wherever you have node-red installed.

---

<div class="post-metadata">

**Author:** ![manueldiasmanuel](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@manueldiasmanuel](https://discourse.nodered.org/u/manueldiasmanuel)\
**Post date:** [17 February 2019 12:09 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/46 "2019-02-17T12:09:30Z")

</div>

Hi ,

A bit of background ;

I have installed node-red in my NAS with the command sudo npm install -g --unsafe-perm node-red  
As the pm2 didn´t work i am using a script to start node-red during boot.

#!/bin/sh  
HOME=/root  
source $HOME/.profile  
PATH=/opt/bin:/opt/sbin:$PATH  
/usr/local/bin/node-red

So the node-red is working somewhere on the root perhpas here /usr/local/bin/node-red ?

To stop the node-red i have tpo shutdown the entire system . Do you know a better way to kill node-red ?

When i acess using putty i´m able to run the Root node-red and the admin node-red but i was not able to change the script to start the admin node-red instance . Any ideas of how to change script ?

When i run Admin node- red the information is ;

17 Feb 11:50:04 - [info] Node-RED version: v0.19.5  
17 Feb 11:50:04 - [info] Node.js version: v8.9.4  
17 Feb 11:50:04 - [info] Linux 3.10.105 arm LE  
17 Feb 11:50:07 - [info] Loading palette nodes  
17 Feb 11:50:09 - [warn] rpi-gpio : Raspberry Pi specific node set inactive  
17 Feb 11:50:09 - [warn] rpi-gpio : Cannot find Pi RPi.GPIO python library  
17 Feb 11:50:13 - [info] Dashboard version 2.13.2 started at /ui  
17 Feb 11:50:13 - [info] Settings file : /var/services/homes/admin/.node-red/se ttings.js  
17 Feb 11:50:13 - [info] Context store : 'default' [module=memory]  
17 Feb 11:50:13 - [info] User directory : /var/services/homes/admin/.node-red  
17 Feb 11:50:13 - [warn] Projects disabled : editorTheme.projects.enabled=false  
17 Feb 11:50:13 - [info] Flows file : /var/services/homes/admin/.node-red/wh ich  
17 Feb 11:50:14 - [info] Creating new flow file  
17 Feb 11:50:14 - [warn]

when i run node-red Root the information is ;

 ![root_node-red](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/6/6a0b4e00a893af3d4fe24549022901f49b8e3cfa.png)

Finally when run npm install -g node-red-admin and after hit the command node-red admin it returns " command not found.

So now i need to try to install node-red-admin as you advice but i need help because i don´t know how to be in the node-red directory ?

Thanks  
regards,

M Dias

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [17 February 2019 12:24 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/47 "2019-02-17T12:24:51Z")

</div>

> [@manueldiasmanuel](#):
>
> after hit the command node-red admin

The command that gets installed is `node-red-admin` - all one - not node-red admin.  
This is just a command line interface to allow you to generate password hashes and some other admin tasks if required... mostly not used by the majority of users.  
As Nick points out there is another way to generate the hash that is documented.

---

<div class="post-metadata">

**Author:** ![manueldiasmanuel](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@manueldiasmanuel](https://discourse.nodered.org/u/manueldiasmanuel)\
**Post date:** [17 February 2019 14:36 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/48 "2019-02-17T14:36:05Z")

</div>

Is this the command ?

root@NUVEM\_CASA:~# node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" your-password-here

Error: Cannot find module 'bcryptjs'  
at Function.Module.\_resolveFilename (module.js:538:15)  
at Function.Module.\_load (module.js:468:25)  
at Module.require (module.js:587:17)  
at require (internal/module.js:11:18)  
at [eval]:1:13  
at ContextifyScript.Script.runInThisContext (vm.js:50:33)  
at Object.runInThisContext (vm.js:139:38)  
at Object. ([eval]-wrapper:6:22)  
at Module.\_compile (module.js:643:30)  
at evalScript (bootstrap\_node.js:462:27)

I am a newbie .... thanks for your help.

Better to give up in running node-red on my NAS ?

M

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [17 February 2019 15:12 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/49 "2019-02-17T15:12:53Z")

</div>

Yes that is the command - but as per the docs you need to run it in the directory where Node-RED is installed - usually either /usr/local/lib/node\_modules/node-red or /usr/lib/node\_modules/node-red

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 February 2019 17:52 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/50 "2019-02-17T17:52:48Z")

</div>

> [@manueldiasmanuel](#):
>
> I tried to generate a password here and copy to setting file but does not work
> 
> [https://www.dailycred.com/article/bcrypt-calculator](https://www.dailycred.com/article/bcrypt-calculator)

I would have expected that to work.

Which settings file did you edit? Was it definitely the one node-red logs it is using when it starts up?

---

<div class="post-metadata">

**Author:** ![manueldiasmanuel](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@manueldiasmanuel](https://discourse.nodered.org/u/manueldiasmanuel)\
**Post date:** [17 February 2019 19:27 UTC](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707/51 "2019-02-17T19:27:28Z")

</div>

You are right it is working as you expected, i was playing with the wrong file.

As wrote before i am using a script to start up node-red on boot of my NAS , this script makes the node-red running and logs in the root where a don´t (i didn´t ) have access . So i had to use some tools to get access to the file in the root of my NAS where i found the correct setting file so i could edit it.  
This brings me to a different question ; How to change my script to start node-red in the admin user instead of Root user ?

This is the script i am using.

#!/bin/sh  
HOME=/root  
source $HOME/.profile  
PATH=/opt/bin:/opt/sbin:$PATH  
/usr/local/bin/node-red

[Previous page](https://discourse.nodered.org/t/the-password-security-settings-article-mentioned-on-the-page/3707.md?page=2)