Lab 01-05 · Secure your router: identity, users, SSH keys and services¶

Every winter, news sites publish the list of the most used passwords of the year, and every year 123456 and admin are near the top. Now picture a router that everybody in a school manages with the user admin, the same password, and every door open: web, Telnet, FTP, API... When something breaks, who did it? When a password leaks, which door did the attacker use?

In this lab you turn a factory-fresh router into a tidy one: it gets a name, every person gets their own user, you log in with a key instead of a password, and every door you do not use gets closed.

One analogy: your router is a house¶

Identity¶

The identity is the router's name. It appears in the CLI prompt ([admin@13_JohnDoe] >), in the WinBox title bar, in neighbour discovery (lab 01-01) and in backup file names (lab 01-06).

When you manage 30 routers, the identity is what stops you from rebooting the wrong one.

Users, groups and policies¶

A user is an account to log in with. Each user belongs to a group, and the group's policies say what its members may do.

RouterOS comes with three groups:

Some policies inside a group: read, write, policy (manage users), ssh, winbox, web, ftp, reboot, sensitive (see secrets). You can create your own groups by ticking exactly the policies you want.

SSH keys¶

An SSH key pair is two linked files: a private key that stays on your laptop, and a public key that you give to the router. The router lets in whoever proves they hold the private key, without any password crossing the network.

flowchart LR
    subgraph L["<b>Your laptop</b>"]
        PRIV["private key<br>(the key in your pocket)"]
        PUB["public key<br>(a copy of the lock)"]
    end
    PUB -- "1 · upload (scp)" --> R["<b>Router</b><br>2 · import it for user john"]
    PRIV -- "3 · ssh -i: prove you have the key" --> R

Services¶

A service is a program on the router that waits for connections on a port: SSH on 22, Telnet on 23, web (WebFig) on 80, WinBox on 8291, API on 8728...

Every open service is a door an attacker can knock on. The rule: disable what you do not use, restrict what you keep (with available from, the list of addresses allowed to connect), and change default ports if you like.

The scenario¶

flowchart LR
    YOU["<b>Your PC</b><br>ssh, ssh-keygen, scp"] -- "management port<br>(ether1, lab plumbing)" --> R1["<b>r1</b><br>bridge1 192.168.88.1/24"]
    R1 -- "ether3 — eth1" --- PC1["<b>pc1</b><br>browser (curl)<br>192.168.88.10"]

Start the lab¶

Download the lab files and unzip them: 01-05-identity-users-services.zip. Open a terminal inside the 01-05-identity-users-services folder.

sudo containerlab deploy -t topology.clab.yml
ssh admin@clab-mtcna-01-05-r1                 # password: admin
docker exec -it clab-mtcna-01-05-pc1 bash      # the LAN laptop

Step 1 · Name your router¶

Why: the course asks for the format YourNumber_YourName, e.g. 13_JohnDoe, so the trainer can tell 20 routers apart.

In WinBox: System → Identity. On r1 (use your number and name, one word, no spaces):

/system identity set name=13_JohnDoe

Expected: the prompt changes immediately to [admin@13_JohnDoe] >. In WinBox the title bar shows the identity in brackets, like admin@192.168.88.1 (13_JohnDoe) - WinBox ....

Done when: your prompt shows your identity.

Step 2 · Create your personal administrator¶

Why: from now on you will log in as you, not as admin.

In WinBox: System → Users → +, Name john, Group full, Password. On r1 (use your own name and a password you can remember; write both down):

/user add name=john group=full password="Lab-Pass-13"
/user print

Now open a second terminal and log in as your new user:

ssh john@clab-mtcna-01-05-r1

Expected: prompt [john@13_JohnDoe] >. Keep this window open.

Done when: you are logged in as your new user in a second window.

Step 3 · Demote admin to read-only¶

Why: the well-known name admin should not be able to change anything.

In WinBox: System → Users, double-click admin, Group read. In the john window:

/user set admin group=read
/user print

Now, in the admin window, try to change something:

/system identity set name=hacked

Expected: not enough permissions (9). Admin can still look (/ip address print works), but cannot touch.

Done when: admin gets not enough permissions when it tries to change the identity.

Step 4 · Log in with an SSH key (optional LAB, slide 73)¶

Why: a key cannot be guessed like a password, and nothing secret travels over the network.

On your PC (not in the router), create a key pair. Press Enter at the passphrase question for this lab (in real life, use a passphrase):

ssh-keygen -t ed25519 -f ~/.ssh/mtcna_lab -C john@laptop
ls ~/.ssh/mtcna_lab*

Expected: two files, mtcna_lab (private, never share it) and mtcna_lab.pub (public). On Windows, PuTTYgen does the same.

Upload the public key to the router (WinBox: drag it onto Files):

scp ~/.ssh/mtcna_lab.pub john@clab-mtcna-01-05-r1:

Import it and attach it to your user. In WinBox: System → Users → SSH Keys → Import SSH Key. In the john window:

/user ssh-keys import public-key-file=mtcna_lab.pub user=john
/user ssh-keys print

Expected: one key, user john, type ed25519. The .pub file disappears from Files: RouterOS keeps it in its configuration now.

Log in with the private key:

ssh -i ~/.ssh/mtcna_lab john@clab-mtcna-01-05-r1

Expected: you are in, and nobody asked for a password.

Done when: you log in as john with the key.

Step 5 · Close the doors you do not use¶

Why: the course's services LAB (slide 77): open WebFig, disable www, refresh, and see it die.

First, on pc1, open WebFig:

curl -s http://192.168.88.1/ | grep -i title

Expected: <title>RouterOS</title>.

In WinBox: IP → Services, select www, click Disable. Do the same with telnet, ftp, api and api-ssl. Then double-click winbox and set Available From to 192.168.88.0/24. On r1 (as john):

/ip service disable www,telnet,ftp,api,api-ssl
/ip service set winbox address=192.168.88.0/24
/ip service print

Expected: an X on the five disabled services, and 192.168.88.0/24 in the ADDRESS column of winbox.

"Refresh the browser" on pc1:

curl -m 4 http://192.168.88.1/

Expected: Failed to connect to 192.168.88.1 port 80. The window is closed.

Done when: WebFig no longer answers and only ssh and winbox (LAN only) remain enabled among the main services.

Check your work¶

CLAB_EXEC="docker exec" ./check.sh

All lines PASS, last line Lab 01-05 SOLVED.

If something goes wrong¶

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

• The identity names the router in the prompt, WinBox title, neighbour list and backup names: use Number_Name in class.
• Every person gets their own user; the group (full, write, read, or your own) decides what they may do through its policies.
• Create and test your personal full user before demoting admin to read, or you lock yourself out.
• An SSH key pair replaces the password: the public key goes to the router, the private key never leaves your laptop. In RouterOS 7 a user with a key can no longer use an SSH password.
• Services are doors: disable the unused ones (www, telnet, ftp, api...) and restrict the rest with available from.

Quick check¶

Your router now has a name, real users and only the doors it needs. Next lab: back it all up, wipe it, and bring it back.