MikroTik / RouterOS · Security · September 2026

MikroTik
Login via RADIUS

Local users on every RouterOS box is the same trap as on Cisco: no central revoke, no audit. RouterOS can authenticate WinBox, SSH, WebFig and API logins against RADIUS and map each user to a group — with User Manager it can even be the RADIUS server. The twin of Cisco device-admin AAA.

MikroTik RouterOS RADIUS User Manager Hardening

RouterOS has no TACACS+ — for centralised admin login it speaks RADIUS. Point /user aaa at a server and every management path (WinBox, SSH, WebFig, the API) checks the typed credentials against RADIUS first, then falls back to the local user database. Add or revoke an engineer in one place; get accounting for who logged in and when.

The piece people miss is the group mapping: RADIUS decides whether you're allowed in, but the RouterOS permission level (full / write / read, or a custom group) comes from the Mikrotik-Group vendor attribute the server hands back. Get that wrong and everyone lands in the fallback group. If you don't already run a RADIUS server, RouterOS 7's User Manager can be one. Throughout, the rule from the Cisco side holds: keep a local break-glass account.

Prerequisites

A RADIUS server (FreeRADIUS, User Manager, NPS) reachable from the router
A hardened RouterOS baseline with SSH/WinBox already working
A second live session while you test the change

Point RouterOS at RADIUS — Keep the Local Admin

Add a RADIUS client entry with the login service, then flip use-radius on /user aaa. The local database stays as the fallback — do not delete it.

RouterOS — RADIUS for management login

# Keep (or create) a strong LOCAL admin first — this is your break-glass.
/user add name=breakglass group=full password="S0me-Str0ng-Pass"

# The RADIUS server, scoped to the 'login' service only.
/radius add service=login address=10.0.0.11 secret="SharedSecret" \
    timeout=1s src-address=10.0.0.1

# Turn on RADIUS for AAA. accounting logs sessions; the local db is the fallback.
/user aaa set use-radius=yes accounting=yes interim-update=5m default-group=read

⚠ Gotcha — RADIUS Only Falls Back to an EXISTING Local User

When the RADIUS server is unreachable RouterOS drops to the local database — but only a local account that actually exists will get you in. If you enabled use-radius and never kept a local admin, an outage locks you out completely. Always keep breakglass (group full), and set a short timeout so a dead server fails over to local in a second rather than hanging the login.

Map Users to Groups with `Mikrotik-Group`

RADIUS says yes/no; the RouterOS group decides what you can touch. The server returns the group in a vendor-specific attribute — anything else lands the user in default-group.

FreeRADIUS — return the RouterOS group per user

# Vendor 14988 (Mikrotik), attribute Mikrotik-Group. Value = a RouterOS group.
# users file:
alice   Cleartext-Password := "..."
        Mikrotik-Group = "full"
bob     Cleartext-Password := "..."
        Mikrotik-Group = "read"

# The value must be a group that EXISTS on the router. Custom groups work:
#   /user group add name=noc policy=ssh,winbox,read,test,!ftp,!write
# then return  Mikrotik-Group = "noc".

💡 Pro Tip — Least Privilege via Custom Groups

Don't map everyone to full. Build a read-plus group (ssh,winbox,read,test, explicitly !write,!policy,!password) for NOC/monitoring, keep full for the two people who need it, and set default-group=read so a mis-configured attribute lands someone in the safest place, not the most powerful. Same least-privilege discipline as the hardening pass.

Be Your Own Server — User Manager (RouterOS 7)

No external RADIUS? User Manager v5 ships with RouterOS 7 and can authenticate your other routers. Register each router as a NAS client, add users, return the group attribute.

RouterOS 7 — User Manager as the RADIUS server

# On the box that will BE the server (often a spare/central router):
/user-manager set enabled=yes

# Register each router that will ask it (the NAS), with a matching secret.
/user-manager router add name=core-sw address=10.0.0.1 shared-secret="SharedSecret"

# Add admins; attach the RouterOS group as a returned attribute.
/user-manager user add name=alice password="..." attributes=Mikrotik-Group:full
/user-manager user add name=bob password="..." attributes=Mikrotik-Group:read

⚠ Gotcha — The Shared Secret Must Match Exactly, Both Ends

The secret in /radius on the client and the shared-secret in the User Manager router entry must be identical, and the client's source IP must match the address the server registered. A mismatch shows up as a silent auth reject with no obvious reason — check /log on both ends for radius messages before suspecting the password.

Verify and Fail Safe Safe to Run

Prove a RADIUS user gets in with the right group, watch the logs, then kill the server's reachability and confirm break-glass still works.

RouterOS — confirm login + fallback

/user aaa print                         # use-radius=yes, default-group
/radius print                            # the login-service entry
/radius monitor 0                       # live requests/accepts/rejects
/log print where topics~"radius"        # reject reasons
/user active print                      # who is logged in, via which method
# Real test: log in as a RADIUS user from a NEW session, confirm the group,
# then block the server and confirm 'breakglass' still gets in.

Takeaways

RouterOS does RADIUS, not TACACS+ — /radius with service=login plus /user aaa set use-radius=yes covers WinBox, SSH, WebFig and API.
Keep a local breakglass user — RADIUS only falls back to a local account that already exists, and a short timeout keeps failover fast.
The Mikrotik-Group attribute sets the permission level — map users to full/read/custom groups; anything unmapped lands in default-group.
Set default-group=read so a misconfigured attribute fails safe, not powerful.
User Manager (RouterOS 7) can be the server — register each router as a NAS with a matching shared secret.
Verify from a new session and test the outage path before you trust it.

One place to grant and revoke access across your routers?

Per-box local users don't scale past a handful of sites. I set up RADIUS-backed admin login for MikroTik and Cisco fleets — role-based groups, an accounting trail, and a tested break-glass path so a server outage never locks you out.

Book a Discovery Call →