Manual:Router AAA: Difference between revisions
| Line 285: | Line 285: | ||
|prop=Property | |prop=Property | ||
|desc=Description | |desc=Description | ||
}} | |||
{{Mr-arg-table | |||
|arg=accounting | |||
|type=yes {{!}} no | |||
|default=yes | |||
|desc= | |||
}} | |||
{{Mr-arg-table | |||
|arg=exclude-groups | |||
|type=list of group names | |||
|default= | |||
|desc=Exclude-groups consists of the groups that should not be allowed to be used | |||
for users authenticated by radius. If radius server provides group specified in | |||
this list, default-group will be used instead. | |||
This is to protect against privilege escalation when one user (without policy | |||
permission) can change radius server list, setup it's own radius server and | |||
log in as admin. | |||
}} | }} | ||
| Line 310: | Line 331: | ||
{{Note|If you are using RADIUS, you need to have CHAP support enabled in the RADIUS server for Winbox to work}} | {{Note|If you are using RADIUS, you need to have CHAP support enabled in the RADIUS server for Winbox to work}} | ||
==SSH Keys== | ==SSH Keys== | ||
Revision as of 14:26, 28 September 2011
Applies to RouterOS: 2.9, v3, v4, v5+
Summary
Sub-menu: /user
MikroTik RouterOS router user facility manage the users connecting the router from the local console, via serial terminal, telnet, SSH or Winbox. The users are authenticated using either local database or designated RADIUS server.
Each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items.
In case the user authentication is performed using RADIUS, the RADIUS Client should be previously configured.
User Groups
Sub-menu: /user group
The router user groups provide a convenient way to assign different permissions and access rights to different user classes.
Properties
| Property | Description |
|---|---|
| name (string; Default: ) | The name of the user group |
| policy (local | telnet | ssh | ftp | reboot | read | write | policy | test | web | sniff | api | winbox | password | sensitive; Default: ) | List of allowed policies:
|
Sensitive information
Starting with RouterOS v3.27, the following information is regarded as sensitive, and can be hidden from certain user groups with the 'sensitive' policy unchecked.
Also, since RouterOS v4.3, backup files are considered sensitive, and users without this policy will not be able to download them in any way.
system package
/radius: secret /snmp/community: authentication-password, encryption-password
advanced-tools package
/tool/sms: secret
wireless package
/interface/wireless/security-profiles: wpa-pre-shared-key, wpa2-pre-shared-key, static-key-0, static-key-1, static-key-2, static-key-3, static-sta-private-key /interface/wireless/access-list: private-key, private-pre-shared-key
wireless-test package
/interface/wireless/security-profiles: wpa-pre-shared-key, wpa2-pre-shared-key, static-key-0, static-key-1, static-key-2, static-key-3, static-sta-private-key, management-protection-key /interface/wireless/access-list: private-key, private-pre-shared-key, management-protection-key
user-manager package
/tool/user-manager/user: password /tool/user-manager/customer: password
hotspot package
/ip/hotspot/user: password
ppp package
/ppp/secret: password
security package
/ip/ipsec/installed-sa: auth-key, enc-key /ip/ipsec/manual-sa: ah-key, esp-auth-key, esp-enc-key /ip/ipsec/peer: secret
routing package
/routing/bgp/peer: tcp-md5-key /routing/rip/interface: authentication-key /routing/ospf/interface: authentication-key /routing/ospf/virtual-link: authentication-key
routing-test package
/routing/bgp/peer: tcp-md5-key /routing/rip/interface: authentication-key /routing/ospf/interface: authentication-key /routing/ospf/virtual-link: authentication-key
Notes
There are three system groups which cannot be deleted:
[admin@rb13] > /user group print 0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,!ftp,!write,!policy 1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,!ftp,!policy 2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web 3 name="test" policy=ssh,read,policy,!local,!telnet,!ftp,!reboot,!write,!test,!winbox,!password,!web [admin@rb13] >
Exclamation sign '!' just before policy item name means NOT.
Example
To add reboot group that is allowed to reboot the router locally or using telnet, as well as read the router's configuration, enter the following command:
[admin@rb13] user group> add name=reboot policy=telnet,reboot,read,local [admin@rb13] user group> print 0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,!ftp,!write,!policy 1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,!ftp,!policy 2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web 3 name="reboot" policy=local,telnet,reboot,read,!ssh,!ftp,!write,!policy,!test,!winbox,!password,!web [admin@rb13] user group>
Router Users
Sub-menu: /user
Router user database stores the information such as username, password, allowed access addresses and group about router management personnel.
Properties
| Property | Description |
|---|---|
| address (IP/mask | IPv6 prefix; Default: ) | Host or network address from which the user is allowed to log in |
| group (string; Default: ) | Name of the group the user belongs to |
| name (string; Default: ) | User name. Although it must start with an alphanumeric character, it may contain "*", "_", "." and "@" symbols. |
| password (string; Default: ) | User password. If not specified, it is left blank (hit [Enter] when logging in). It conforms to standard Unix characteristics of passwords and may contain letters, digits, "*" and "_" symbols. |
Notes
There is one predefined user with full access rights:
[admin@MikroTik] user> print
Flags: X - disabled
# NAME GROUP ADDRESS
0 ;;; system default user
admin full 0.0.0.0/0
[admin@MikroTik] user>
There always should be at least one user with fulls access rights. If the user with full access rights is the only one, it cannot be removed.
Monitoring Active Users
Sub-menu: /user active
/user active print command shows the currently active users along with respective statisics information.
Properties
All properties are read-only.
| Property | Description |
|---|---|
| address (IP/IPv6 address) | Host IP/IPv6 address from which the user is accessing the router. 0.0.0.0 means that user is logged in locally |
| group (string) | Group that user belongs to. |
| name (string) | User name. |
| radius (true | false) | Whether user is authenticated by RADIUS server. |
| via (console | telnet | ssh |winbox | api | web) | User's access method |
| when (time) | Time and date when user logged in. |
Example
To print currently active users, enter the following command:
[admin@dzeltenais_burkaans] /user active> print detail Flags: R - radius 0 when=dec/08/2010 16:19:24 name="admin" address=10.5.8.52 via=winbox 2 when=dec/09/2010 09:23:04 name="admin" address=10.5.101.38 via=telnet 3 when=dec/09/2010 09:34:27 name="admin" address=fe80::21a:4dff:fe5d:8e56 via=api
Remote AAA
Sub-menu: /user aaa
Router user remote AAA enables router user authentication and accounting via RADIUS server. The RADIUS user database is consulted only if the required username is not found in the local user database
Properties
| Property | Description |
|---|---|
| accounting (yes | no; Default: yes) | |
| exclude-groups (list of group names; Default: ) | Exclude-groups consists of the groups that should not be allowed to be used
for users authenticated by radius. If radius server provides group specified in this list, default-group will be used instead.
|
| default-group (string; Default: read) | User group used by default for users authenticated via RADIUS server. |
| interim-update (time; Default: 0s) | Interim-Update time interval |
| use-radius (yes |no; Default: no) | Enable user authentication via RADIUS |
Note: If you are using RADIUS, you need to have CHAP support enabled in the RADIUS server for Winbox to work
SSH Keys
Sub-menu: /user ssh-keys
This menu allows to import public keys used for ssh authentication.
Warning: User is not allowed to login via ssh by password if ssh-keys for the user is added
Properties:
| Property | Description |
|---|---|
| user (string; Default: ) | username to which ssh key is assigned. |
Read-only properties:
| Property | Description |
|---|---|
| key-owner (string) |
When importing ssh key by /user ssh-keys import command you will be asked for two parameters:
- public-key-file - file name in routers root directory containing the key.
- user - name of the user to which key will be assigned
Private keys
Sub-menu: /user ssh-keys private
This menu is used to import and list imported private keys. Private keys are used to authenticate remote login attempts using certificates.
Read-only properties:
| Property | Description |
|---|---|
| user (string) | |
| key-owner (string) |
When importing ssh keys from this sub menu using /user ssh-keys private import command you will be asked for three parameters:
- private-key-file - file name in routers root directory containing private key.
- public-key-file - file name in routers root directory containing public key.
- user - name of the user to which key will be assigned