# Where logged NR failed logins?

**URL:** <https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429>\
**Category:** General\
**Tags:** security\
**Created:** [10 April 2023 17:39 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429 "2023-04-10T17:39:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![buschhardt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/buschhardt/32/78716_2.png) [@buschhardt](https://discourse.nodered.org/u/buschhardt)\
**Post date:** [10 April 2023 17:39 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429/1 "2023-04-10T17:39:26Z")

</div>

Hallo I put credentials in settings.js, but where write NR the failed login try? I have a linux system and try to look in auth-logs and add a custom logger to the settings.js, but I cant find any output to this. I would use fail2ban to anlyze this log.  
Thanks Thomas

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [10 April 2023 18:25 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429/2 "2023-04-10T18:25:51Z")

</div>

Have you checked the node-red log? That is available directly using `journalctl` if you are using systemd to run node-red. They are also written to syslog which fail2ban should be able to monitor.

If you really want robust security though and you clearly have a Linux set up with some existing security, you would likely be better off using a reverse proxy such as NGINX or Caddy and putting your logins there rather than in Node-RED itself.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [10 April 2023 19:30 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429/3 "2023-04-10T19:30:51Z")

</div>

Hi @buschhardt

You will need to enable the `audit` log level in order to get events for failed logins etc

---

<div class="post-metadata">

**Author:** ![buschhardt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/buschhardt/32/78716_2.png) [@buschhardt](https://discourse.nodered.org/u/buschhardt)\
**Post date:** [11 April 2023 09:06 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429/4 "2023-04-11T09:06:07Z")

</div>

Thank You, the setting `audit: true` was wrong. Can I see/write out which IP address the node-red client have?  
Here is my custom logger:

```auto
myCustomLogger: {
    level: "error",
    metrics: false,
    audit: true,
    handler: function(settings) {
        return function(msg) {
            var fs = require('fs');
            var text = JSON.stringify(msg) + "\n";
            fs.appendFileSync('./nodered.log', text, encoding='utf8');
        }
    }
}

```

And here a result:  
`{"event":"auth.login.fail.credentials","username":"wronguser","client":"node-red-editor","scope":"","level":98,"timestamp":1681203925853}`

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [11 April 2023 09:21 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429/5 "2023-04-11T09:21:21Z")

</div>

Ah yes - the login fail audit event doesn't include the ip address of the request. That information isn't directly available. We've looked at getting the ip address included in this event previously, but the authentication library we use (passport.js) makes it surprisingly difficult to do (or perhaps, how we use passport makes it hard to do).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [10 June 2023 09:21 UTC](https://discourse.nodered.org/t/where-logged-nr-failed-logins/77429/6 "2023-06-10T09:21:38Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.