User Management and Access Levels in MikroTik

Managing RouterOS Users: Security Best Practices

One of the most overlooked aspects of router security is user account management. By default, RouterOS comes with a single admin account with no password and full access. Leaving this default in place is a serious security risk on any network connected to the internet.

This guide covers how to create and manage users securely on RouterOS v7.

Why User Management Matters

• Default admin with no password is the first thing attackers try.
• Different people (NOC staff, read-only viewers, automation accounts) need different access levels.
• Audit trails are easier when each person has their own account.
• Disabling the default admin reduces attack surface dramatically.

Viewing Existing Users and Groups

/user print

/user group print

RouterOS has three built-in user groups:

• full: Complete access to all RouterOS features.
• write: Can change configuration but cannot manage users or access sensitive areas.
• read: View-only access, cannot make any changes.

Creating a New Admin User

Always create a named admin account before disabling the default admin:

/user add name=netadmin group=full password=Str0ng!P@ssw0rd comment="Primary admin account"

Choose a strong password — at least 12 characters, mixing uppercase, lowercase, numbers, and symbols.

Creating a Read-Only Account

For monitoring staff or NOC personnel who should view but not change configuration:

/user add name=monitor group=read password=M0n!t0rPass comment="Read-only monitoring account"

Creating a Custom Group

If the built-in groups do not fit your needs, create a custom group with specific permissions:

/user group add name=limited-ops policy=read,write,test,sniff

Available policies include: local, telnet, ssh, ftp, reboot, read, write, policy, test, winbox, password, web, sniff, sensitive, api, romon, rest-api.

Disabling the Default admin Account

After confirming your new admin account works (log in with it first!), disable the default:

/user disable admin

Or delete it entirely if you are confident:

/user remove admin

Warning: If you delete admin and then forget your new credentials, you will need to do a hard reset of the router. Always verify new accounts work before removing admin.

Restricting Access by IP Address

You can limit where a user can log in from using the allowed-address field:

/user set netadmin allowed-address=192.168.1.0/24

This means netadmin can only log in from the 192.168.1.0/24 subnet. Attempts from other IPs will be rejected, even with the correct password.

SSH Key Authentication

For even stronger security, use SSH public key authentication instead of passwords:

/user ssh-keys import public-key-file=id_rsa.pub user=netadmin

Upload the public key file first via FTP or SCP, then import it.

Password Policy

RouterOS v7 does not enforce password complexity by default, but you can set a minimum password length:

/user settings set minimum-password-length=12

Viewing Active Sessions

See who is currently logged in:

/user active print

To kick an active session:

/user active remove [find name=someuser]

Securing Management Access

Combine user management with access controls on management services:

/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes
/ip service set api disabled=yes
/ip service set winbox address=192.168.1.0/24
/ip service set ssh address=192.168.1.0/24

Disable services you do not use, and restrict the ones you do use to trusted subnets.

Summary

• Never leave the default admin account with no password.
• Create named accounts with strong passwords.
• Use the read group for monitoring-only accounts.
• Restrict login by IP with allowed-address.
• Disable unused management services.
• Consider SSH key authentication for admin accounts.

User management is a low-effort, high-impact security improvement. A few minutes of configuration can prevent unauthorized access to your router.