Summary

MikroTik RouterOS router user facility manages the users connecting the router from any of the Management tools. The users are authenticated using either a local database or a designated RADIUS server. Each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items.

In case the user authentication is performed using RADIUS, the RADIUS client should be previously configured.

User Settings

The settings submenu allows to control the password complexity requirements of the router users. 

User Groups

The router user groups provide a convenient way to assign different permissions and access rights to different user classes. 

Properties

Default groups

There are three default system groups which cannot be deleted:

[admin@MikroTik] > /user group print 
0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!ftp,!write,!policy skin=default 

1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,sniff,sensitive,api,romon,rest-api,!ftp,!policy skin=default 

2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,rest-api skin=default 

Please note, that even the "read" group includes sensitive, reboot, and other important policies, meaning that this group should not be given to untrusted users. For truly limited groups, make a custom group, defining specific policies. All groups have access to file operations. Exclamation sign '!' just before the policy item name means NOT.

Router Users

The router user database stores information such as username, password, allowed access addresses, and group about router management personnel. 

Properties

Actions

Actions for existing router user.

Notes

There is one predefined user with full access rights:

[admin@MikroTik] user> print
Flags: X - disabled
# NAME GROUP ADDRESS LAST-LOGGED-IN
0 ;;; system default user
admin full 0.0.0.0/0 dec/08/2010 16:19:24

There always should be at least one user with full access rights. If the user with full access rights is the only one, it cannot be removed.

Monitoring Active Users

/user active print

 The command shows the currently active users along with respective statistics information.

Properties

All properties are read-only.

Request logout

It is possible to close an active CLI session using the request logout function.

 /user/active/request-logout ACTIVE_USER_SESSION_NUMBER

Remote AAA

Router user remote AAA enables router user authentication and accounting via a RADIUS server. The RADIUS user database is consulted only if the required username is not found in the local user database.

Properties

SSH Keys 

 This menu allows importing of private and public keys used for SSH authentication. 

Public keys

This menu is used to import and list imported public keys. Public keys are used to approve another device's identity when logging into a router using an SSH key.

On public key import, is it possible to specify key-owner.

Private keys

This menu is used to import and list imported private keys. Private keys are used to approve the router's identity during login into another device using an SSH key.

On private key import, is it possible to specify key-owner.