A number of node-RED users have succumbed to a new virus, which gains root access via node-RED, and then installs cryptocurrency miner, plus whatever scripts/software that the virus is programmed to install. It’s important that if anyone is exposing node-RED to the internet, that the adminAuth is s…

That’s a long guide. What specifically needs to be done to prevent unauthorized access? Is it more complicated than changing the default admin password?

It’s simply ensuring that you have set an Admin password (adminAuth) set in settings.js, and preferably NOT the default username/password pre-installed by the emoncms imagefiile. All of the reports so far relate to users who have not setup adminAuth at all, leaving their system exposed to the web (…

For all interested, there’s another thread here about NodeRed on the EmonPi relating to this security issue: node-RED virus >> emoncms image file To summarise: [image] node-RED virus >> emoncms image file does the emoncms image file have node-RED adminAuth setup by default? [image] node-R…

Thank you for that. “users chooses to open their nodered system to the internet” : what do you mean with that? Its opening port 80? Doing a factory reset should make me “peace of mind” or should i be worried? Because i was messing with node-red a year ago and don’t remember what I did.

Have you configured node-RED so that you can access the editor or dashboard from outside your private network - so that you can see them when you are away from home? This usually means opening up port 1880. If not, then it’s not a problem. node-RED cannot be reached from outside your private netwo…

Thank you! I need to double check but from what I remember and what I could see now, i didn’t open any ports, so I can sleep well. Thank you!

Please forgive me if I’m breaking any rules or conventions… I’m new :slight_smile: There is an excellent tutorial created by Richard Wenner in which he explains very clearly how to setup a secure node red installation on a Raspberry Pi. [Node-Red Raspberry Pi Updating & Securing] I al…

[image] Neil: Or, should I just paste it here? That is the best way. There’s no recognised place for information of that sort - that’s not to say that there shouldn’t be, and maybe this is something that ought to be considered. Any thoughts @glyn.hudson , @TrystanLea ?

Here’s a set of instructions that can be used in conjunction with Richard Wenner’s tutorial: How to Prepare and Secure Raspberry Pi for Node-Red Richard Wenner Youtube: Node-Red Raspberry Pi Updating & Securing - YouTube Install SD card image and configure RPI for headless operation. (Raspberry P…

Community

OpenEnergyMonitor

OpenEnergyMonitor Community

September 18: security threat affecting node-RED (does not by default effect emonPi)

Integrations NodeRED