Want to change API Password. What are best practices?

Configuration
1

It’s time for a HASS API password change (hassio). Should be as simple as changing it in the config. But when I do that I get hass warning me about failed login attempts from my 192.168.1.41 (an rpi which only runs a NUT server and Caddy, a reversed proxy server) and from an IP number 172.30.33.1 (which is not my range either from my private or guest network that are both in the 192 range). Which gets automatically banned after 5 attempts

Any idea what this could be?

2

the 172 one is the docker container. I’m guessing you have the API key configured in a few places you haven’t changed.

3

Any thoughts what this could be? It’s plain HASSIO and I searched all my .yaml files if they contains the (old) password

4

google assistant? alexa? ifttt??? bit hard to say when you don’t give any configuration details.

5

Well, i have tons of integrations. So bit chicken/egg.

Most of them I have setup years ago so the question is exact that; Which integrations/components should I (and others with similar issue) check to make sure I cover all my bases. I expect that many will have to start looking for those when hass moves to the new authentication system.

  • ITFFT (using)
  • Alexa (used but not using anymore)
  • Google Home (this setup changed to the cloud setup, can’t remember if I had to use a PW there)
  • Others?

p.s. the IP that get’s blocked; does this block have wider implications than just the potential integrations/components that cannot login anymore? Thanks

6

I’d go looking at the Caddy logs. They’ll tell you what’s connecting after all.

7

That’s a good one!