# Does the default 'umbrel' account pose a security vulnerability?

**URL:** <https://community.umbrel.com/t/does-the-default-umbrel-account-pose-a-security-vulnerability/16110>\
**Category:** General Discussion\
**Created:** [April 5, 2024, 7:14pm UTC](https://community.umbrel.com/t/does-the-default-umbrel-account-pose-a-security-vulnerability/16110 "2024-04-05T19:14:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![random](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@random](https://community.umbrel.com/u/random)\
**Post date:** [April 5, 2024, 7:14pm UTC](https://community.umbrel.com/t/does-the-default-umbrel-account-pose-a-security-vulnerability/16110/1 "2024-04-05T19:14:22Z")

</div>

I recently set up my new Umbrel node and encountered a hiccup while upgrading to Umbrel 1.0. The upgrade process seemed to get stuck midway. To resolve this, I SSH’d into the node using the default ‘umbrel’ username and password. After a reboot, I found myself unable to log back in with the default credentials, facing an ‘invalid password’ error, despite not changing the password myself.

This situation raises a few questions regarding the default ‘umbrel’ account:

1. **Security Best Practices** : Is it recommended to change the default password or delete this account entirely for enhanced security?

2. **SSH Access Concerns** : Given the default credentials, is there a significant risk of unauthorized SSH access to my Umbrel node? What steps can I take to mitigate this risk and ensure only authorized access to the node?