FTP is enabled: credentials and files travel unencrypted

What the audit found

The ftp service is enabled under IP → Services. FTP on a MikroTik gives access to the router's file store — backups, exports, scripts, firmware packages — using the same accounts and passwords as Winbox and SSH. It is enabled in the factory configuration, so most routers run it without anyone having chosen to.

The audit rates this high when port 21 is reachable from the internet, medium when it is limited to selected external addresses, and low when it can only be reached from the internal network.

Why it matters

FTP was designed in a time when nobody thought about eavesdropping. The username and password are sent as readable text, and so is every file transferred. Anyone who can see the traffic — on the same LAN, on a hotel network, or anywhere along the path from the internet — reads the router's admin password directly.

That would be bad enough for a service that only handled files, but on RouterOS the FTP login is the router login. The credentials that unlock a file transfer are the same ones that unlock Winbox and full control of the device. Every FTP session therefore exposes the keys to the whole router.

The second problem is that FTP is a favourite of automated password guessing. Port 21 is scanned constantly, FTP login attempts are cheap to make, and the protocol tells the attacker immediately whether a password worked. A router with FTP reachable from the internet receives a steady stream of guesses against admin and other common names. If any account has a weak password, this is one of the doors it will be found through.

Finally, the files themselves are sensitive. A backup or export downloaded over FTP contains your entire configuration, and on RouterOS 6 that includes passwords and keys.

What it looks like in Winbox

Open IP → Services. The row ftp (port 21) is enabled if it is not greyed out; if Available From is empty, connections are accepted from any address.

Log may show repeated login failure for user admin from ... via ftp entries if the port is exposed — that is the brute-force traffic in action.

How to fix it

The fix is to disable the ftp row under IP → Services. Nothing on the router depends on FTP, and it is unrelated to your management session, so Safe Mode is not needed; Winbox, WebFig and SSH continue to work exactly as before.

For file transfers use SFTP, which runs over the SSH service you already have. Any SFTP client (FileZilla, WinSCP, the command-line sftp tool) connects to the router's address on port 22 with your normal credentials and shows the same file store that FTP did. Winbox's Files window also supports drag-and-drop upload and download and is often the simplest option. The router's own fetch tool (Tools → Fetch) can pull files over HTTPS or SFTP, so scripts that used FTP can be adapted as well.

If you must keep FTP for a legacy tool, the principle is to narrow it rather than leave it open: put the address of that one tool into the Available From field of the ftp row so the service refuses everyone else, and make sure the input chain of the firewall drops traffic arriving on the WAN interface. Treat that as a temporary arrangement and plan to retire it — the password still crosses the LAN in the clear.

Afterwards, from outside your network, a TCP connection to port 21 on your public address should be refused or time out, and an SFTP login from the LAN should still work so you have a way to move files. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I use FTP to fetch backups automatically. What replaces it?

SFTP does the same job with the same credentials and file layout, and every backup tool that speaks FTP also speaks SFTP. Point it at port 22. Alternatively, have the router push backups outward with its fetch tool over SFTP or HTTPS on a schedule, so no inbound file service is needed at all.

Is restricting FTP to my LAN enough?

It reduces the finding to low, but the password still travels in the clear across the LAN every time you connect, and any compromised device on that network can capture it. Since SFTP is available on every router with SSH enabled, there is no practical reason to keep FTP.

Does disabling FTP affect Winbox file uploads or The Dude?

No. Winbox uses its own protocol for the Files window, and The Dude communicates over its own service. FTP is used only by external FTP clients and by any scripts you wrote to use it.