# September 18: security threat affecting node-RED (does not by default effect emonPi)

**URL:** <https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603>\
**Category:** NodeRED\
**Created:** [24 September 2018 09:17 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603 "2018-09-24T09:17:25Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/paul/32/28_2.png) [@Paul](https://community.openenergymonitor.org/u/Paul)\
**Post date:** [24 September 2018 09:17 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/1 "2018-09-24T09:17:25Z")

</div>

A number of node-RED users have succumbed to a new virus, which gains root access via node-RED, and then installs cryptocurrency miner, plus whatever scripts/software that the virus is programmed to install.

It’s important that if anyone is exposing node-RED to the internet, that the adminAuth is set [as per the node-RED guide](https://nodered.org/docs/security). This will prevent rogue code accessing the adminAPI, and gaining root access, to add and run rogue code.

Hopefully, most savvy users will have already done this anyway 😉

Paul

> **[Custom Sustes Malware Infects Linux and IoT Servers Worldwide](https://sensorstechforum.com/custom-sustes-malware-infects-linux-iot-servers-worldwide/)**
>
> The Sustes malware is a custom virus that was recently discovered in a global infection, it carries a Monero cryptocurrency miner, read more in our article

---

<div class="post-metadata">

**Author:** ![SolarMill](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/solarmill/32/817_2.png) [@SolarMill](https://community.openenergymonitor.org/u/SolarMill)\
**Post date:** [26 September 2018 01:59 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/2 "2018-09-26T01:59:57Z")

</div>

That’s a long guide. What specifically needs to be done to prevent unauthorized access? Is it more complicated than changing the default admin password?

---

<div class="post-metadata">

**Author:** ![Paul](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/paul/32/28_2.png) [@Paul](https://community.openenergymonitor.org/u/Paul)\
**Post date:** [26 September 2018 08:27 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/3 "2018-09-26T08:27:38Z")

</div>

It’s simply ensuring that you have set an Admin password (adminAuth) set in settings.js, and preferably NOT the default username/password pre-installed by the emoncms imagefiile.

All of the reports so far relate to users who have not setup adminAuth at all, leaving their system exposed to the web (and there are lots & lots!!).

A bit like leaving your front door open when you go out…

If you want a checklist to harden node-RED further, [these notes](https://github.com/node-red/cookbook.nodered.org/wiki/How-to-safely-expose-Node-RED-to-the-Internet) should help.

Paul

---

<div class="post-metadata">

**Author:** ![Paul](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/paul/32/28_2.png) [@Paul](https://community.openenergymonitor.org/u/Paul)\
**Post date:** [26 September 2018 13:31 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/6 "2018-09-26T13:31:01Z")

</div>



---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [29 September 2018 09:35 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/7 "2018-09-29T09:35:39Z")

</div>

8 posts were split to a new topic: [NodeRED security offtopic - to be deleted](https://community.openenergymonitor.org/t/nodered-security-offtopic-to-be-deleted/8658)

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [29 September 2018 09:38 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/8 "2018-09-29T09:38:20Z")

</div>

For all interested, there’s another thread here about NodeRed on the EmonPi relating to this security issue: [node-RED virus \>\> emoncms image file](https://community.openenergymonitor.org/t/node-red-virus-emoncms-image-file/8621/4)

To summarise:

> [@node-RED virus \>\> emoncms image file](https://community.openenergymonitor.org/t/node-red-virus-emoncms-image-file/8621/2):
>
> does the emoncms image file have node-RED adminAuth setup by default?

> [@node-RED virus \>\> emoncms image file](https://community.openenergymonitor.org/t/node-red-virus-emoncms-image-file/8621/4):
>
> **Yes, every single emonPi / emonBase / emonSD with nodered is secured with an adminAuth username / password**.
> 
> From my understanding it seems that the malware has only affected systems open to the internet without secure admin access. By default emonPi / emonBase systems should not have the nodered port open to the internet, if a users chooses to open their nodered system to the internet we have always strongly recommend they change the default password.
> 
> I’ve just scanned all the nodred installations that I have access (all have adminauth) to and have not been able to find any infections.
> 
> With this in mind, I guess we should be ‘ok’ and no further action is needed other than to make users aware of the importance of changing the emonPi default nodered password, if they choose to open their nodered port to the world. Do you agree?

---

<div class="post-metadata">

**Author:** ![CelsoHenriques](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/celsohenriques/32/9586_2.png) [@CelsoHenriques](https://community.openenergymonitor.org/u/CelsoHenriques)\
**Post date:** [1 October 2018 21:32 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/9 "2018-10-01T21:32:42Z")

</div>

Thank you for that.

- “users chooses to open their nodered system to the internet” : what do you mean with that? Its opening port 80?  
Doing a factory reset should make me “peace of mind” or should i be worried? Because i was messing with node-red a year ago and don’t remember what I did.

---

<div class="post-metadata">

**Author:** ![Paul](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/paul/32/28_2.png) [@Paul](https://community.openenergymonitor.org/u/Paul)\
**Post date:** [1 October 2018 21:50 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/10 "2018-10-01T21:50:04Z")

</div>

Have you configured node-RED so that you can access the editor or dashboard from outside your private network - so that you can see them when you are away from home?  
This usually means opening up port 1880.

If not, then it’s not a problem. node-RED cannot be reached from outside your private network, and can’t be exploited.

If you have, then you need to change your adminAuth username/password in node-RED’s settings.js file.

There are a number of online tools such as [http://www.canyouseeme.org/](http://www.canyouseeme.org/) to help you see which ports you are exposing.

Paul

---

<div class="post-metadata">

**Author:** ![CelsoHenriques](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/celsohenriques/32/9586_2.png) [@CelsoHenriques](https://community.openenergymonitor.org/u/CelsoHenriques)\
**Post date:** [1 October 2018 22:08 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/11 "2018-10-01T22:08:44Z")

</div>

Thank you! I need to double check but from what I remember and what I could see now, i didn’t open any ports, so I can sleep well.  
Thank you!

---

<div class="post-metadata">

**Author:** ![Neil](https://community.openenergymonitor.org/letter_avatar_proxy/v4/letter/n/839c29/32.png) [@Neil](https://community.openenergymonitor.org/u/Neil)\
**Post date:** [3 January 2019 12:57 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/12 "2019-01-03T12:57:05Z")

</div>

Please forgive me if I’m breaking any rules or conventions… I’m new 🙂

There is an excellent tutorial created by Richard Wenner in which he explains very clearly how to setup a secure node red installation on a Raspberry Pi.

[![](https://img.youtube.com/vi/z9a_ztJqaII/maxresdefault.jpg "Node-Red Raspberry Pi Updating & Securing") ](https://www.youtube.com/watch?v=z9a_ztJqaII)

I also have a written set of innstructions of Richard’s excellent video tutorial. I will gladly share this if someone can help me understand how to share a document. Or, should I just paste it here?

Thanks

---

<div class="post-metadata">

**Author:** ![Robert.Wall](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/robert.wall/32/38246_2.png) [@Robert.Wall](https://community.openenergymonitor.org/u/Robert.Wall)\
**Post date:** [3 January 2019 13:09 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/13 "2019-01-03T13:09:02Z")

</div>

> [@Neil](#):
>
> Or, should I just paste it here?

That is the best way.

There’s no recognised place for information of that sort - that’s not to say that there shouldn’t be, and maybe this is something that ought to be considered. Any thoughts @glyn.hudson, @TrystanLea?

---

<div class="post-metadata">

**Author:** ![Neil](https://community.openenergymonitor.org/letter_avatar_proxy/v4/letter/n/839c29/32.png) [@Neil](https://community.openenergymonitor.org/u/Neil)\
**Post date:** [3 January 2019 14:43 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/14 "2019-01-03T14:43:05Z")

</div>

Here’s a set of instructions that can be used in conjunction with Richard Wenner’s tutorial:

**How to Prepare and Secure Raspberry Pi for Node-Red**

Richard Wenner Youtube: [Node-Red Raspberry Pi Updating & Securing - YouTube](https://www.youtube.com/watch?v=z9a_ztJqaII)

Install SD card image and configure RPI for headless operation. (Raspberry Pi configuration is probably not required with a functioning emonPi SD Image)

**sudo raspi-config**

Change RPi password  
Change host name from raspberrypi to your hostname  
Set boot to command line  
Set localization options  
Enable SSH  
Expand file system  
Exit and reboot

Update operating system  
**sudo apt-get -y update**  
**sudo apt-get -y upgrade**  
**sudo apt-get dist upgrade**

Check node-red version  
**node -v**

Install node packet manager and update node-red

**`bash <(curl -sL https://raw.githubusercontent.com/node-red/raspbian-deb-package/master/resources/update-nodejs-and-nodered)`**

Check error log  
**cat /var/log/nodered-install.log**

Check node-red version  
**node -v**

Check npm packet manager version  
**npm -v**

Install ’n’ utility to check the latest version of node-red and upgrade for us  
**sudo npm install -g n**

Upgrade to very latest version of node red  
**sudo n latest**

Reboot  
**sudo shutdown -r now**

Check node-red version  
**node -v**

Check npm packet manager version  
**npm -v**

Start node-red (hit ctrl-c to get the prompt, node-red will continue to run)  
**node-red-start**  
**ctrl-c**

Note the error with the serial port. This is well known and easy to fix  
**cd ~/.node-red**  
**ls -la**  
**node-red-stop**  
**sudo npm rebuild**

Start node-red - Confirm the error has beed fixed  
**node-red-start**  
**ctrl-c**

Could stop here but need to add an encrypted password and use https  
First we need to stop node-red completely and reboot…  
**sudo systemctl disable nodered.service**  
**node-red-stop**  
**sudo shutdown -r 0**

First, switch to https

Generate https self-certified certificate  
**cd ./node-red**  
**ls -la**

Check that we have these packages:  
**.config.json**  
**package.json**  
**settings.js**

Generate a private key  
**openssl genrsa -out privatekey.pem 1024**  
**openssl req -new -key privatekey.pem -out private-csr.pem**

Country Name (2 letter code) [AU]: **US**  
State or Province Name (full name) [Some-State]: **New-Jersey**  
Locality Name (eg, city) []: **(leave blank)**  
Organization Name (eg, company) [Internet Widgits Pty Ltd]: **(leave blank)**  
Organizational Unit Name (eg, section) []: **(leave blank)**  
Common Name (e.g. server FQDN or YOUR name) []: **(enter the RPi IP address)**  
Email Address []: **(enter your email address)**  
A challenge password []:Email Address []: **(leave blank)**  
An optional company name []: **(leave blank)**

The prompt returns…

Signature confirmation  
**ls -la**

Should now see:  
**privatekey.pem**  
**certificate.pem**

Edit settings.js  
**nano settings.js**  
Uncomment this line…  
**//var fs = require(“fs”);**

Uncomment this section:  
**//https: {**  
\*\* // key: fs.readFileSync(‘privatekey.pem’),\*\*  
\*\* // cert: fs.readFileSync(‘certificate.pem’)\*\*  
\*\* //},\*\*

And change to:  
**https: {**  
\*\* key: fs.readFileSync(’/home/pi/.node-red/privatekey.pem’),\*\*  
\*\* cert: fs.readFileSync(’/home/pi/.node-red/certificate.pem’)\*\*  
\*\* },\*\*

Uncomment this section:  
//adminAuth: {  
// type: “credentials”,  
// users: [{  
// username: “admin”,  
// password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcx$  
// permissions: “\*”  
// }]  
//},

Save and Exit

Note: To set a root password enter: **sudo passwd root** enter the password twice.

Need to encode the node-red password and need to install some encryption software. This is done with node-red

**su**  
Password: **(enter your password)**  
**npm node-install -g node-red-admin**  
**exit**  
Password: **(enter password)** (this is the password you will use to access node-red, your’s will be different)

$2a$08$LAD8pMesZ6f5akNxgXbOvO/KK400WRaa2J/DqnoV4JTrn4sJd1h62

Copy the password.

Re-open the settings.js file  
Locate the adminAuth section and paste the copied password over the existing password

adminAuth: {  
type: “credentials”,  
users: [{  
username: “admin”,  
password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV$  
permissions: “\*”  
}]  
},

Save and exit

Start node-red  
**node-red-start**  
**ctrl-c**

Go to your browser and enter:  
**https://(your raspberry pi IP address):1880**  
Make sure to trust your self-signed certificate (it’s safe to do this as you created the certificate. normally you would not accept certificates from unknown sources)

Enter: **admin** (for username, or whatever you like)  
Enter your **node-red password** that you set above)  
You will now see the node-red gui

Enable auto-start for node-red service on boot  
**sudo systemctl enable nodered.service**

Now add some nodes that will be needed.

From the Manage Pallet Menu in Node-Red search for:

**node-red-dashboard** and install the nodes (Graphical GUI nodes)

**Now make a backup of the Raspberry Pi SD Card image**

---

<div class="post-metadata">

**Author:** ![glyn.hudson](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/glyn.hudson/32/35003_2.png) [@glyn.hudson](https://community.openenergymonitor.org/u/glyn.hudson)\
**Post date:** [10 January 2019 16:53 UTC](https://community.openenergymonitor.org/t/september-18-security-threat-affecting-node-red-does-not-by-default-effect-emonpi/8603/15 "2019-01-10T16:53:57Z")

</div>

12 posts were split to a new topic: [Upgrading NodeRED](https://community.openenergymonitor.org/t/upgrading-nodered/9734)