Introduction · Topic 6 of 8

Router Identity, Logins and Services

Set a router identity, manage user accounts and groups, and secure the management services on a MikroTik router by disabling or restricting them.

  • 4 min
In a nutshell
  • The identity is the router name, set with /system identity set name=R1.
  • Users belong to groups, and the groups are read, write and full.
  • The default admin account should get a strong password or be replaced.

What it is

A router needs a name, a safe set of user accounts and only the management services it really uses.

The identity is the name of the router. Logins are the user accounts and groups that decide who may log in and what they may change. Services are the network listeners, such as SSH or WinBox, that accept management connections.

Together they are the first layer of router security.

Adminuser and passwordconnects toServicessh or winboxchecked byRouteridentity R1

How it works

Set the name, replace the default login, and then close every service you do not need.

Router identity

The identity is shown in WinBox, in the CLI prompt and in some discovery protocols. A clear name tells you which router you are working on.

/system identity set name=R1
/system identity print

Give every router a unique and meaningful name. When several routers look the same, a wrong identity leads to changes on the wrong device.

Manage logins

Users are managed in the user menu. Each user belongs to a group, and the group decides the permissions.

GroupWhat it allows
readLook at the configuration but not change it
writeChange the configuration, with some restrictions
fullEverything, including user management
/user add name=anna password=S3cret! group=full
/user set admin password=N3wPass!
/user print
/user active print

The first command adds a user. The second changes a password. /user print lists accounts and /user active print shows who is logged in now.

Good practice for a new router follows a few steps:

  • Set a strong password on the default admin account straight away.
  • Create a personal account for each administrator, and give it only the group it needs.
  • Once your own full account works, remove or disable the default admin account.
  • Use the address parameter of a user to limit the networks from which that user may log in.
Watch out

Test your new full account in a second session before you remove the default admin, or you may lock yourself out.

Manage services

The router listens for management connections through services. You see them with a single command.

/ip service print
ServicePurposeDefault port
telnetClear text CLI23
sshEncrypted CLI22
ftpFile transfer21
wwwWebFig over HTTP80
www-sslWebFig over HTTPS443
winboxWinBox8291
apiRouterOS API8728
api-sslRouterOS API over TLS8729

Each service can be disabled, moved to another port or restricted to certain source addresses.

/ip service disable telnet
/ip service set ssh port=2222
/ip service set winbox address=192.168.88.0/24

The first command turns Telnet off. The second moves SSH to another port, which hides it from simple scans. The third accepts WinBox only from the management network.

Keep only the services you use. Disable the clear text ones, and limit the rest by address.

MAC level access

Besides these IP services, the router can accept MAC level connections, which is how MAC-WinBox works. You can also limit which interfaces take part in neighbour discovery.

/tool mac-server print
/ip neighbor discovery-settings print

Restrict both to the trusted LAN interface list on a router that touches the Internet. Otherwise the router announces itself on every port.

What to remember for the exam

Seven facts cover this topic.

  • The identity is the router name, set with /system identity set name=R1.
  • Users belong to groups, and the groups are read, write and full.
  • The default admin account should get a strong password or be replaced.
  • The address parameter of a user limits where that user may log in from.
  • /ip service print lists the management services and their ports.
  • Unused services should be disabled with /ip service disable.
  • A service can be restricted to a network with the address parameter of /ip service set.
Exam tip

Disable telnet and ftp first, because both send credentials in clear text.

Common mistakes

These four mistakes weaken a router.

Leaving the default admin password unchanged. On many models it is empty, so set a strong password before the router is connected to any untrusted network.

Giving everyone the full group. Use read or write for people who do not manage users.

Leaving every service open. Disable what you do not use and restrict what you keep.

Locking yourself out. Removing the admin account or restricting an address wrongly can cut off your own access, so keep a second session open.

Check yourself

Work through these three questions.

  • What do the three user groups allow?

    The read group can only look at the configuration. The write group can change it with some restrictions, and the full group can do everything including user management.

  • How do you stop a router accepting Telnet?

    Run /ip service disable telnet. You can also restrict a service to one network with /ip service set winbox address=192.168.88.0/24.

  • What should you do with the default admin account on a new router?

    Give it a strong password at once. Then create your own accounts, and remove or disable the default admin once your own full account works.

Topic 6 of 8 in Introduction

Test yourself on Introduction

The full MikroTik MTCNA question bank has 558 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.