MikroTik RouterOS router user facility manages the users connecting the router from any of the Management tools. The users are authenticated using either a local database or a designated RADIUS server. Each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items.

In case the user authentication is performed using RADIUS, the RADIUS client should be previously configured.

User Groups

The router user groups provide a convenient way to assign different permissions and access rights to different user classes. 


name (string; Default: )The name of the user group
policy (local | telnet | ssh | ftp | reboot | read | write | policy | test | winbox | password | web | sniff | sensitive | api | romon | dude | tikapp; Default: none)List of allowed policies:

Login policies:

  • local - policy that grants rights to log in locally via console
  • telnet - policy that grants rights to log in remotely via telnet
  • ssh - policy that grants rights to log in remotely via secure shell protocol
  • web - policy that grants rights to log in remotely via WebFig.
  • winbox - policy that grants rights to log in remotely via WinBox and bandwidth test authentication
  • password - policy that grants rights to change the password
  • api - grants rights to access router via API.
  • tikapp - policy that grants rights to log in remotely via Tik-App.
  • dude - grants rights to log in to dude server.
  • ftp - policy that grants full rights to log in remotely via FTP, to read/write/erase files and to transfer files from/to the router. Should be used together with read/write policies.
  • romon - policy that grants rights to connect to RoMon server.

Config Policies:

  • reboot - policy that allows rebooting the router
  • read - policy that grants read access to the router's configuration. All console commands that do not alter router's configuration are allowed. Doesn't affect FTP
  • write - policy that grants write access to the router's configuration, except for user management. This policy does not allow to read the configuration, so make sure to enable read policy as well
  • policy - policy that grants user management rights. Should be used together with the write policy. Allows also to see global variables created by other users (requires also 'test' policy).
  • test - policy that grants rights to run ping, traceroute, bandwidth-test, wireless scan, snooper, and other test commands
  • sensitive - grants rights to change "hide sensitive" option, if this policy is disabled sensitive information is not displayed.
  • sniff - policy that grants rights to use packet sniffer tool.
skin (name; Default: default)Used skin for WebFig

Default groups

There are three system groups that cannot be deleted:

[admin@MikroTik] > /user group print 
0 name="read" policy=local,telnet,ssh,reboot,read,test,winbox,password,web,sniff,sensitive,api,romon,tikapp,!ftp,!write,!policy,!dude skin=default 

1 name="write" policy=local,telnet,ssh,reboot,read,write,test,winbox,password,web,sniff,sensitive,api,romon,tikapp,!ftp,!policy,!dude skin=default 

2 name="full" policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,tikapp,!dude skin=default 

Please note, that even the "read" group includes sensitive, reboot, and other important policies, meaning that this group should not be given to untrusted users. For truly limited groups, make a custom group, defining specific policies. All groups have access to file operations. Exclamation sign '!' just before policy item name means NOT.

Router Users

Router user database stores the information such as username, password, allowed access addresses, and group about router management personnel. 


address (IP/mask | IPv6 prefix; Default: )Host or network address from which the user is allowed to log in
group (string; Default: )Name of the group the user belongs to
name (string; Default: )User name. Although it must start with an alphanumeric character, it may contain "*", "_", "." and "@" symbols.
password (string; Default: )User password. If not specified, it is left blank (hit [Enter] when logging in). It conforms to standard Unix characteristics of passwords and may contain letters, digits, "*" and "_" symbols.
last-logged-in (time and date; Default: "")Read-only field. Last time and date when a user logged in.


There is one predefined user with full access rights:

[admin@MikroTik] user> print
Flags: X - disabled
0 ;;; system default user
admin full dec/08/2010 16:19:24

There always should be at least one user with full access rights. If the user with full access rights is the only one, it cannot be removed.

Monitoring Active Users

/user active print

 The command shows the currently active users along with respective statistics information.


All properties are read-only.

address (IP/IPv6 address)Host IP/IPv6 address from which the user is accessing the router. means that the user is logged in locally
group (string)A group that the user belongs to.
name (string)User name.
radius (true | false)Whether a user is authenticated by the RADIUS server.
via (local | telnet | ssh |winbox | api | web | tikapp | ftp | dude)User's access method
when (time)Time and date when the user logged in.

Remote AAA

Router user remote AAA enables router user authentication and accounting via a RADIUS server. The RADIUS user database is consulted only if the required username is not found in the local user database.


accounting (yes | no; Default: yes)
exclude-groups (list of group names; Default: )Exclude-groups consists of the groups that should not be allowed to be used

for users authenticated by radius. If the radius server provides a group specified in this list, default-group will be used instead.

This is to protect against privilege escalation when one user (without policy permission) can change the radius server list, set up its own radius server and

log in as admin.
default-group (string; Default: read)User group used by default for users authenticated via a RADIUS server.
interim-update (time; Default: 0s)Interim-Update time interval
use-radius (yes |no; Default: no)Enable user authentication via RADIUS

If you are using RADIUS, you need to have CHAP support enabled in the RADIUS server for WinBox to work

SSH Keys

 This menu allows importing of public keys used for ssh authentication. 

User is not allowed to login via ssh by password if ssh-keys for the user is added 


key-owner (string)
user (string; Default: )username to which ssh key is assigned.

When importing ssh key by /user ssh-keys import the command you will be asked for two parameters:

  • public-key-file - file name in routers root directory containing the key.
  • user - name of the user to which key will be assigned

Private keys

This menu is used to import and list imported private keys. Private keys are used to verify the public keys of remote devices.

Read-only properties:

user (string)
key-owner (string)

When importing ssh keys from this sub-menu using /user ssh-keys private the import command you will be asked for three parameters:

  • private-key-file - file name in routers root directory containing private key.
  • public-key-file - file name in routers root directory containing public key.
  • user - name of the user to which key will be assigned
  • No labels